Privacy Policy

1. Introduction

Madeleine Agency (hereinafter "we", "our", or "us") is committed to protecting the privacy and security of its users' personal data. This privacy policy explains how we collect, use, share, and protect your personal information.

This policy complies with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

2. Data Controller

3. Data Collected

3.1 Identification Data

• When creating an account: email address, password (encrypted), first name, last name.
• Profile information: company, industry, company size, use case.

3.2 Billing Data

• Payment information (processed by Stripe — we do not store card numbers).
• Transaction history and invoices.
• Billing address.

3.3 Usage Data

• Templates and creations generated, along with their parameters (brief, style, colours).
• Images uploaded to the library, CRM contacts, forms.
• Generation history and credit consumption.
• Favourites and user preferences.

3.4 Technical Data

• IP address, browser type, operating system.
• Pages visited, visit duration, clicks.
• Connection and error logs.
• Cookies (see our cookie policy for details).

4. Purposes of Processing

We use your personal data for: service delivery, billing, transactional and marketing communications (with consent), service improvement, security, and legal compliance.

5. Legal Basis for Processing

• Performance of a contract: to provide the requested service.
• Legitimate interests: to improve our service and secure our systems.
• Consent: for marketing communications and analytics tracking.
• Legal obligation: for accounting and tax reporting purposes.

6. Data Sharing and Transfers

We engage technical sub-processors to operate the service. Each sub-processor is bound by contractual data protection obligations.

These services comply with the GDPR or are covered by Standard Contractual Clauses (SCCs) issued by the European Commission, or by the EU–US Data Privacy Framework for companies certified under it.

MarketingAtelier is a product of Madeleine Software, a brand of Madeleine Agency, which is the data controller.

6a. Use of AI and Data Processing

MarketingAtelier uses artificial intelligence to deliver certain features. It is important that you understand how your data interacts with these systems.

What actually uses AI

• Content generation: your brief (subject, tone, objective) and your brand guidelines (colours, fonts, identity) are sent to the model you selected, to produce text, images, video and synthetic voice.
• Conversations: what you write in a chat, along with the memory the platform has built of your exchanges, is sent to the model you selected.
• Suggestions and strategies: the model receives a numerical summary of your account — number of contacts, names of your audiences and campaigns, volumes. It receives neither the name, nor the address, nor the individual behaviour of any contact in your CRM.
• Suggesting a scoring scale: on your request, a model proposes a points grid for a form. It analyses the form's questions, not the people who answer them, and nothing is applied without your approval.

Transparency (AI Act, Article 50)

• Every conversational assistant states, under its input field, that you are talking to an AI.
• Generated images and videos carry a machine-readable marking (XMP metadata, or the provider's C2PA marking, kept intact). This marking can be removed, and social networks strip it on upload.

What does NOT use AI

Lead scoring is entirely deterministic and computed on our servers: no AI model is involved. A contact's score is the sum of measured engagement (open rate, click rate, recency, volume), the rules you defined, and points from your forms. Given the same data, the result is always the same, and the breakdown is visible on the contact record.

Automated processing — what happens without intervention

For transparency, and because this may affect people in your database:

• A form submission scored “hot” automatically adds a tag to the contact. If you created a workflow triggered by that tag, an email may be sent without any action from you.
• A contact's score changes their membership of your dynamic audiences, recalculated hourly. A contact may therefore enter or leave a campaign purely because their score changed.
• Engagement scores are recalculated nightly for all of your contacts.

You can disable each of your scoring rules individually from CRM → Scoring, and delete or edit any tag-triggered workflow. You retain the right to obtain human intervention on any automated decision concerning you, to express your point of view and to contest it (Article 22 GDPR): write to contact@marketingatelier.ai.

7. Retention Periods

• Account data: for the duration of your subscription plus 3 years.
• Billing data: 10 years (legal obligation).
• Technical logs: 12 months maximum.
• Marketing data (with consent): until consent is withdrawn.

8. Your Rights (GDPR)

You have rights in relation to your personal data: access, rectification, erasure, objection, restriction, portability, and withdrawal of consent at any time.

9. Data Security

HTTPS / TLS encryption on all communications, hashed passwords, API keys and tokens encrypted with AES-256-GCM at rest, access restricted by row-level security (RLS), regular backups, 24/7 monitoring.

10. Contact