Privacy policy

1. Who is responsible for your data?

The controller for processing related to platform management is OCTOPUS WEB, a French limited liability company (SARL) with share capital of €500.00, registered with the Paris Trade and Companies Register under SIREN 947 795 431, with its registered office at 60 rue François 1er, 75008 Paris, France.

For questions about your data or to exercise your rights: contact@octopus-web.fr. You may also write to the registered office, stating “Personal data – Site Gratos”.

2. What data is involved?

• Contact and account data: email address, telephone, representative identity and technical account identifiers. Passwords are stored as secure hashes, not in plain text.
• Project information: business, activity, city, country, services, design preferences, keywords, address of a website to redesign, logos, images and content you provide.
• Information needed for publication and, where applicable, billing: registered business name, business address, SIRET, legal representative, public contact details and opening hours.
• Service content and communications: generated websites, working versions, revision requests, replies, approvals, support messages and notifications.
• Technical data needed for operation and security: IP address, connection information, dates, session identifiers and technical events. Form anti-spam protection uses, among other things, a technical fingerprint derived from the IP address.

This data mainly comes from you. For a redesign, information may also be collected from the website whose address you supply. Fields marked as required are necessary to handle the corresponding request; without them, that feature cannot be provided.

Do not submit passwords, bank details or sensitive data, particularly health data, in project descriptions or revision requests. Only provide third-party data if you are authorised to do so.

3. Why do we use this data?

• To create and manage your account, prepare your website, make revisions and publish it: pre-contractual measures requested by you and performance of the contract. When you act for a business, management of its contacts also relies on our legitimate interest in maintaining that professional relationship.
• To answer your requests and update you about the service: performance of the contract or our legitimate interest in responding to enquiries. Production, error, approval and password-recovery emails are service messages.
• To prevent abuse, protect accounts and resolve incidents: our legitimate interest in securing the platform and keeping it operational.
• To meet accounting obligations and requests from competent authorities: compliance with our legal obligations.
• To defend our rights in disputes: our legitimate interest in establishing and retaining necessary evidence.

When processing requires your consent, it must be subject to a separate choice. You may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

After free publication, a congratulatory email confirms that the website is live. For professional users informed at publication who do not object, three follow-up emails present Premium after 1, 7 and 15 days. This business-related marketing relies on our legitimate interest in presenting an upgrade to the service. You can decline before publication and unsubscribe from each follow-up without affecting your website or service notifications. Upgrading to Premium stops follow-ups for that website.

We record scheduling dates, sending results, the first click on each follow-up’s Premium link and subsequent Premium upgrades to evaluate the sequence. Clicks are indicative: email software may preload links. No open-tracking pixel is inserted. Tracking cannot establish that a follow-up caused a purchase. To object to this follow-up tracking, use the unsubscribe link or contact us.

4. AI-assisted generation

Creation and revisions use artificial intelligence tools, including OpenAI services and processing on our production infrastructure. Your brief, relevant content and editing instructions may be sent to them to fulfil your request.

Content intended for your website, including your public contact details, may therefore be processed in this context. Avoid adding confidential information unrelated to the website to your brief. Check proposed content and contact details before publication.

These tools produce and edit the website; their output is not an assessment of your personal circumstances. If a request is automatically refused or blocked, you can request human intervention at the contact address above.

5. Who may receive your data?

Data is accessible to authorised Octopus Web personnel and providers needed to deliver the service, according to their role: platform operation, hosting, generation, email delivery and technical support.

The platform is deployed through Sites on Cloudflare infrastructure. Published customer websites may be hosted by alwaysdata. OpenAI is used for generation features. Production processing may also run on infrastructure administered by Octopus Web.

When a payment or domain-management feature involves another provider, its identity and terms must be presented in the relevant journey. Data may also be disclosed to authorities where required by law.

Information you choose to publish on a website becomes accessible to visitors and may be indexed or copied by third-party services. A shared preview link should also be considered accessible to its recipients.

6. Processing outside the European Economic Area

International providers, including OpenAI and Cloudflare, may involve processing or access from countries outside the European Economic Area, including the United States.

These transfers must be covered by a mechanism provided for by the GDPR, such as an applicable adequacy decision or standard contractual clauses, with supplementary measures where needed. You may ask Octopus Web for details of recipients, processing locations and safeguards applicable to services used for your project.

7. How long is data retained?

Retention depends on the purpose of the data and your account’s situation:

• Account, projects and content: during the service relationship and while necessary to manage the account, website and requested changes. Deletion requests are considered in light of retention obligations and possible disputes.
• Support communications and uncompleted requests: while the request is handled and for the period needed for follow-up or to substantiate communications.
• Logs and security records: for the period useful to detect, analyse and handle incidents; evidence needed for a dispute may be retained separately.
• Accounting documents and invoices, where issued: ten years under applicable accounting obligations.
• Site Gratos login cookie: up to thirty days, unless you sign out or the session expires earlier.

Deleting a website and closing an account are separate operations. Deletion may involve a recovery or technical backup phase before permanent erasure; it does not automatically erase copies already received by email or held by third parties. Contact us to find out what data is still retained in your situation.

8. Cookies and technical storage

Site Gratos uses a login cookie named site_gratos_session to recognise your session and protect access to your account. Technical security mechanisms may also operate at the hosting level.

Trackers strictly necessary for the requested service may be used without prior consent. You can block them in your browser, but login and some features may stop working. Any addition of non-essential trackers, particularly advertising trackers, must be accompanied by information and, where regulations require it, prior consent.

Learn more: CNIL information about cookies and trackers (in French).

9. Forms on customer websites

When you contact a business through a centralised Site Gratos form embedded in its website, your name, email, optional phone number and message are stored and sent to that business so it can reply. Technical checks limit abusive submissions.

The receiving business determines how these messages are used and is responsible for processing them for its own activity. Site Gratos supplies the technical service on its behalf and processes data needed for platform security. For follow-up to your enquiry, the business’s own retention periods or exercising your rights with it, consult its privacy policy and contact it directly. Octopus Web remains available for questions about the technical service.

10. Security

Protective measures include encryption in transit, access controls, password protection and limits on abusive requests. No system can guarantee absolute security.

Keep your credentials confidential, choose a unique password and promptly report suspicious access. Information intended to be public must be kept distinct from private account data.

11. Your rights and how to exercise them

Under the conditions set out in the GDPR, you have rights of access, rectification, erasure, restriction, objection and portability. You may withdraw consent where processing relies on it and set instructions concerning your data after your death, in accordance with French law.

Write to contact@octopus-web.fr, specifying your request and the account address concerned. Additional evidence will only be requested if there is reasonable doubt about your identity.

You must receive a response within one month. This may be extended by two months because of the complexity or number of requests; you will then be informed within the first month. Some rights may be limited by a legal obligation or third-party rights.

If you believe your rights are not respected, you can complain to the French data protection authority, the CNIL.

12. Changes to this policy

This policy may be updated as the service or processing activities change. The date at the top identifies the latest update. Any change requiring specific information or fresh consent will be accompanied by the appropriate steps.