AcquiScanPrivacy and cookies
Last updated: November 4, 2026 — version 2.4
This English translation is provided for information only. Only the French version is legally binding and prevails in the event of any discrepancy. The Terms you accept when signing up are the French ones: read the French version.
This policy describes the processing of personal data carried out in connection with the AcquiScan website and service, in accordance with Regulation (EU) 2016/679 (GDPR) and amended French Law No. 78-17 of 6 January 1978 (“Informatique et Libertés”).
1. Data controller
Hugo Aubry, sole trader (Litho 3D), SIREN 930 435 870, 7 rue du Clair Soleil, 25300 Arçon, France, phone +33 6 61 66 49 63 — [email protected]. The Publisher has not appointed a data protection officer, as this is not mandatory for its activity; any question may be sent to the address above.
2. Data processed, purposes and legal bases
| Data | Purpose | Legal basis (Art. 6 GDPR) | Retention period |
|---|---|---|---|
| Email address, name, account identifier, password (stored in encrypted form by the authentication provider), or Google identity | Creating, securing and managing the account | Performance of the contract (general terms) | Lifetime of the account |
| Search criteria, situation, buyer profile (contact details, background, skills, personal contribution, motivation), CV | Providing the Service: filtering listings, simulating financing, writing messages and the acquisition plan, filling in advertisers' forms | Performance of the contract | Lifetime of the account |
| Pipeline, notes, prepared messages, history of declared sendings | Tracking the User's deals | Performance of the contract | Lifetime of the account |
| Documents uploaded by the User to a file (scoping sheet, balance sheets, income statements, tax returns, leases…), extracted text, figures read and analyses, log of exchanges with the seller. These documents may contain third-party data (director, landlord); the User only uploads documents they are entitled to share. The administrator has no access to them | Analysis of the acquisition project, follow-up of exchanges | Performance of the contract | Until deleted by the User or until the account is deleted |
| Telegram chat identifier, questions asked to the assistant (written or voice) and answers. Voice messages are transcribed into text and then immediately discarded: the audio recording is never kept by AcquiScan | Sending alerts, answering questions | Performance of the contract | Lifetime of the account; conversation history limited to the latest exchanges |
| Usage counters, login dates, technical logs | Security, abuse prevention, usage limits, aggregated internal statistics | Legitimate interest | 12 months maximum |
| Account data: profile, CV, criteria, pipeline and notes, prepared messages, alerts sent, questions asked to the assistant and answers, usage counters | User support, diagnosis and correction of malfunctions, security and abuse prevention, improvement of the Service | Performance of the contract (support); legitimate interest of the Publisher (security, improvement of the Service) | Viewed without copying, for the lifetime of the account; log of views kept for 12 months maximum |
| Pages viewed, referring page, device and browser type, visit duration; IP address and browser used only to calculate an anonymous code renewed every day, never stored | Audience measurement of the showcase website: aggregated statistics on visits and journeys, to improve the website | Legitimate interest of the Publisher; tracker exempt from consent (Art. 82 of the French Data Protection Act, CNIL guidelines) | 25 months maximum |
| Name, email, profile and message from the contact form | Replying to requests, managing the relationship | Legitimate interest / pre-contractual measures | 3 years from the last contact |
| Stripe identifiers, card type, last 4 digits, expiry date, payment status | Collecting the subscription, handling failed payments and refunds | Performance of the contract | Duration of the subscription, then 13 months (15 months for deferred debit) in archive for disputes |
| Identity, addresses, SIREN and VAT numbers if any, amounts, invoices | Invoicing and keeping accounts; sending the required data to the tax authorities | Legal obligation | 10 years |
| Acceptances, immediate-start request, withdrawal, termination, mandatory messages relating to the subscription | Proof and management of the contract; defending our rights | Performance of the contract; legitimate interest (proof) | Duration of the contract + 5 years; contract of €120 or more: 10 years |
| Detection of fraudulent use of promotional codes and trials | Abuse prevention | Legitimate interest | 12 months maximum |
Mandatory fields are indicated at the time of collection; without them, the Service cannot be provided. No decision producing legal effects concerning the User is taken solely on the basis of automated processing: scores and analyses are decision-support tools for the User. No data is sold, rented or used for advertising purposes.
3. Third-party data (company directors and companies)
To help the User analyze a listing, the Service may display information about companies and their directors taken from public sources: the French government's business directory (Annuaire des entreprises), the National Business Register, the BODACC, company websites. This processing is based on legitimate interest (assistance in analyzing a business acquisition); only the necessary data is presented, with its source, and it is kept for 12 months maximum. Any data subject may object to this processing or request the deletion of data concerning them by writing to [email protected]; the request is processed within one month.
Businesses in difficulty (optional feature). If the User activates this option, the Service presents the opening of safeguard, receivership and judicial liquidation proceedings published in the BODACC (open data from the DILA, Licence Ouverte). Only companies are included: sole traders, identified by their name, are excluded. The entries mention the company name, its activity, its municipality, the court and the appointed professionals (judicial administrator, creditors' representative or liquidator), as published; they are removed no later than 120 days after publication.
4. Payment and invoicing
When you take out a paid subscription, payment is processed by Stripe. You enter your card number directly on Stripe's secure page: AcquiScan neither receives nor keeps this full number or the security code. We only receive the information needed for tracking: customer and subscription identifiers assigned by Stripe, card type, last four digits and expiry date, payment status and date, refunds.
To issue your invoices, we process your name or company name, your email and billing addresses, your status as a private individual or professional, where applicable your SIREN and VAT numbers, the plan chosen, amounts and dates. We also record proof of your acceptances: version of the terms, immediate-start request, date and time, as well as your withdrawal and termination requests.
Stripe acts in two capacities. It is our processor for payment processing carried out on our instructions. It is a separate controller for its own obligations and activities, in particular fraud prevention and legal obligations relating to payments; its privacy policy then applies. Your bank and the card networks also receive the data needed for the transaction. This payment and invoicing data is not sent to artificial intelligence models or used for advertising purposes.
Retention. Card data is kept by Stripe, for payments, until the end of your subscription, then in archive solely to handle a dispute, for 13 months after the debit (15 months for a deferred-debit card). Invoices and accounting records are kept for 10 years, even after your account is deleted. Proof of acceptance and exchanges relating to the contract are kept for the duration of the contract plus 5 years (limitation period); the contract itself is kept for 10 years when its amount reaches €120.
5. Recipients and processors
Within the Publisher, only Hugo Aubry, as administrator of the Service, may consult the data in an account, and only when necessary for User support, diagnosing a malfunction, the security of the Service or its improvement. To improve the Service, the Publisher favors overall statistics; personal content (notes, CVs, questions asked to the assistant) is only consulted when there is a specific need. Each consultation is recorded in a log. This data is never communicated to third parties, other than the processors listed below and authorized authorities (for example the tax authorities), nor to advertisers or sellers, nor used for other purposes. You can object to it being consulted for the purpose of improving the Service by writing to [email protected]. Data is also processed, within the limits of their tasks, by the following processors, bound by commitments compliant with Article 28 of the GDPR:
| Provider | Role | Data location |
|---|---|---|
| Supabase Inc. | Database, authentication | European Union (Ireland) |
| Cloudflare, Inc. | Website hosting, domain management, encrypted routing and protection of application traffic | Global network, including the United States |
| Groq Inc. | AI models: scoring of listings, assistant and AI expert, Telegram bot (including transcription of voice messages), writing of messages and of the acquisition plan, detailed analyses, reading and analysis of documents uploaded by the User (including scanned pages), research on companies and their directors | United States |
| OpenRouter Inc. | Backup used solely to score listings, based on their public text with names and contact details removed (no User data); the request is routed to the provider of the model used (including Google) | United States |
| Cloudflare Inc. (Workers AI) | Backup used solely to score listings, based on their public text with names and contact details removed (no User data) | United States |
| Cohere Inc. | Backup used solely to score listings, based on their public text with names and contact details removed (no User data) | Canada |
| Google LLC (Gemini, Google Sign-In) | Backup AI model used solely to score listings, based on their public text with names and contact details removed (no User data); Google sign-in if the User chooses it | United States |
| Tavily | Web search about companies and, during research, their directors (first and last name from public registers); no User data | United States |
| Telegram | Delivery of alerts and messages, if the User activates it | According to Telegram's policy |
| FormSubmit | Email relay for contact form messages | United States |
| PostHog Inc. (PostHog Cloud EU) | Audience measurement of the showcase website, aggregated statistics | European Union (Frankfurt, Germany) |
| Stripe Payments Europe, Limited (Ireland) | Online payment, subscription management, invoices. Also a separate controller for its own obligations | European Union and United States |
Data sent to AI models is limited to what is necessary for the requested task. Content relating to the User or to third parties (profile, criteria, questions asked to the assistant, voice messages, messages and acquisition plan, information about directors gathered during research) is entrusted, among AI providers, to Groq only. Under its contractual terms, Groq may not use it to train models; it does not retain it, except for temporary logging in the event of a technical incident or suspected abuse, for 30 days maximum unless legally required. The backup models (Google Gemini, Cloudflare Workers AI, Cohere, OpenRouter) only receive the public text of listings, with names and contact details removed, to score them. The Publisher does not use this data to train models.
6. Transfers outside the European Union
Some providers are established outside the European Union, in particular in the United States. These transfers are governed by an adequacy decision (EU–US Data Privacy Framework for certified companies) or, failing that, by the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures; for Groq, these clauses are incorporated into its data processing addendum. For Stripe, these transfers rely on the EU–US Data Privacy Framework where it applies or on the standard contractual clauses. As the backup models (Google Gemini, Cloudflare Workers AI, Cohere, OpenRouter) only receive the public text of listings, with names and contact details removed, no personal data of the User is transferred to them. A copy of the safeguards can be obtained on request.
7. Security
The Publisher implements appropriate technical and organizational measures: encryption of communications (HTTPS/TLS), authentication delegated to a specialized provider, passwords never stored in plain text, systematic server-side access control, separation of data between users, database access restricted to the application server, secrets stored outside the code, rate limiting, logging. In the event of a data breach likely to result in a risk to individuals, the Publisher notifies the CNIL under the conditions of Article 33 of the GDPR and, where applicable, the data subjects.
8. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection (Articles 15 to 21 of the GDPR), as well as the right to set guidelines regarding what happens to your data after your death. From your account Settings, you can at any time modify your information, download all your data and delete your account. Deleting the account does not extend to the invoices and records that the law requires us to keep. For any other request: [email protected]; a reply is provided within one month, and proof of identity may be requested in case of reasonable doubt.
You can lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr.
9. Minors
The Service is intended for adults. It is not intended for persons under 18.
10. Cookies and trackers
Showcase website: no cookies are set. We measure website traffic with the PostHog tool, hosted in the European Union (Frankfurt), configured not to store anything in your browser. To count visitors without identifying them, an anonymous code is calculated on PostHog's server from your IP address and your browser, with a random value that is changed and deleted every day: it cannot be used to recognize you from one day to the next, and your IP address is not stored. The data is used only to produce aggregated statistics for our own account (page views, referrers, journeys); it is not combined with other data, passed on to third parties or used for advertising purposes, and is kept for 25 months maximum. This system is exempt from consent (Article 82 of the French Data Protection Act, CNIL guidelines). You can object to it at any time with the button below; your choice is then stored in your browser. The only other thing stored, in your browser's local storage, is your choice of light or dark display, if you use the button provided for this purpose: this preference, saved at your request and never transmitted, is exempt from consent.
This setting requires JavaScript; if JavaScript is disabled, no audience measurement takes place.
Application: only strictly necessary items are stored in the browser's local storage: the login session (authentication token) and the light or dark theme preference. In accordance with Article 82 of the French Data Protection Act and the CNIL guidelines, these items are exempt from consent. No advertising or audience-measurement cookies are used, and fonts are hosted by the application itself. If you choose “Continuer avec Google” (Continue with Google), sign-in takes place on Google's pages, under its own rules.
Browser extension (optional): the auto-fill extension only stores, for a maximum of 30 minutes, the temporary token used to fill in the form opened from AcquiScan; it runs on all HTTPS websites so that it can fill in the form of any advertiser, only acts in a tab opened from AcquiScan and collects no browsing data.
11. Changes to this policy
This policy may change. The date of the latest update appears at the top of the page; any substantial change is brought to Users' attention.