Privacy Policy
Last updated: 13 October 2026
This policy explains what personal data divin.ai collects about the people who use it, why, who receives it, how long we keep it, and what rights you have. We only describe what the site really does. For cookies specifically, see our Cookie Policy.
Who is responsible for your data
The data controller is Emmanuel Nicolas, operating divin.ai as a Entreprise individuelle (sole proprietorship), SIREN 752 754 192, 2 chemin du midi, 63960 Veyre-Monton, France. Contact for any privacy question or request: [email protected]. Details of the publisher and host are in the Legal Notice.
What we collect, why, and on what basis
Your account
Your email address (and a name derived from it unless you give one). We use it to sign you in with a one-time link, which is valid for 15 minutes and works once, and to send you service emails. Basis: performance of the contract (GDPR art. 6(1)(b)).
Your business profile
What you choose to publish: business name, category, address, optional GPS position, phone, public email, website and social links, opening hours, description, services, products and photos. This content is public by design: anyone, including AI engines and search engines, can read it. Please don't publish personal data you don't want public. Basis: performance of the contract.
Ownership attestation
When you first publish a profile you certify you're authorized to represent the business. We record the date and time, your IP address and your account email as evidence. Basis: our legitimate interest in preventing fraud and resolving disputes over who owns a profile (art. 6(1)(f)).
Verification documents
If you choose to upload a supporting document (for example a business registration extract) to raise your profile's trust level, we store the file in private storage, where only signed-in divin.ai staff can open it, and our staff review it. The file is never published. Uploading is optional. Basis: your consent, given by the act of uploading (art. 6(1)(a)); you can withdraw it by asking us to delete the file. Please don't upload documents containing more personal data than needed, and don't send identity documents.
Payments and invoices
Paid plans are processed by Stripe on Stripe's own payment page; your card details never reach our servers. We keep the Stripe customer and subscription identifiers, your plan, billing cycle, and your invoices (amount, date, status and a link to the invoice). Basis: performance of the contract and our legal accounting obligations (art. 6(1)(b) and (c)).
Contact form and issue reports
If you write to us through the contact form we receive your name, email address and message. If you report an issue with a profile we record your email address, the type of report and your description, to handle it. Basis: our legitimate interest in answering you and handling reports (art. 6(1)(f)).
AI crawler activity on profiles
For the activity chart in a profile owner's dashboard, when a known AI crawler (a bot) requests a profile page we record the bot's name, the page and its user-agent string, plus a one-way salted hash of its IP address rather than the address itself. Ordinary visitors are not recorded in this log. Basis: our legitimate interest in giving owners this feature (art. 6(1)(f)).
Technical and security logs
Like any website, our servers and our security/delivery provider process your IP address, browser type, the pages requested and timestamps, to deliver the site and protect it from abuse. Basis: our legitimate interest in the security and operation of the service (art. 6(1)(f)).
We do not use advertising or analytics trackers, we do not sell your data, and we make no decision about you based solely on automated processing that has legal or similarly significant effects.
Is providing your data mandatory?
An email address is required to have an account and to receive your sign-in link. A profile needs the business details the form marks as required to be published; everything else is optional. Without the required details we can't create your account or publish your profile. Payment details are required only if you choose a paid plan.
Who receives your data
- Our staff, who can see profile data, verification documents, reports and account emails as needed to run the service.
- The public, for everything you publish on your profile.
- Stripe (payment processing).
- Resend (sending our service emails: sign-in links, alerts).
- HostGator.com LLC (hosting and our email inbox).
- Cloudflare (content delivery and security filtering).
These providers act on our instructions as processors, or as independent controllers for their own legal obligations (Stripe, for payments and fraud prevention). We may also disclose data where the law requires it.
Transfers outside the European Union
Some of these providers are based in or operate from the United States. Where data is transferred there, the transfer relies on the EU–US Data Privacy Framework where the provider is certified under it, or otherwise on the European Commission's Standard Contractual Clauses. You can ask us for details at [email protected].
How long we keep it
| Data | Kept for |
|---|---|
| Account (email, name) | While your account is active; deleted when you ask us to close it. |
| Profile content and photos | Until you remove it or we close your account. |
| Ownership attestation | As long as the profile exists. |
| Verification documents | As long as the profile exists, or until you ask us to delete them. |
| Invoices and billing records | 10 years, as French accounting law requires (Code de commerce, art. L123-22). |
| Contact messages | Up to 3 years after our last exchange. |
| Issue reports | As long as needed to handle the report, then with the related profile. |
| AI crawler log (bot name, page, user agent, IP hash) | Counted into daily totals and then deleted the same day; the totals contain no IP data. |
| Technical and security logs | A short rolling period set by our hosting and security providers. |
Your rights
Under the GDPR and the French Loi Informatique et Libertés you have the right to:
- access the data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data erased, where the law allows;
- restrict or object to certain processing, including processing based on our legitimate interest;
- receive the data you provided in a portable format;
- withdraw your consent at any time, where processing is based on it (this does not affect what was done before);
- give instructions about what happens to your data after your death.
To exercise a right, write to [email protected]. We answer within one month. We may ask you to confirm your identity first. If you think we haven't handled your data correctly, you can complain to the French data protection authority, the CNIL (3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr/fr/plaintes), or your local authority.
Security
The whole site is served over HTTPS. There are no passwords to leak: sign-in uses single-use, short-lived email links. Card data stays with Stripe. Access to back-office tools is limited to staff accounts.
Children
divin.ai is a service for business owners and isn't aimed at children under 15.
Changes to this policy
If what we do with personal data changes, we'll update this page and its date. For significant changes affecting account holders we'll also tell you by email.