AcquiScanPrivacy and cookies
Last updated: October 25, 2026 — version 2.2
This English translation is provided for information only. Only the French version is legally binding and prevails in the event of any discrepancy. The Terms you accept when signing up are the French ones: read the French version.
This policy describes the processing of personal data carried out in connection with the AcquiScan website and service, in accordance with Regulation (EU) 2016/679 (GDPR) and amended French Law No. 78-17 of 6 January 1978 (“Informatique et Libertés”).
1. Data controller
Hugo Aubry, sole trader (Litho 3D), SIREN 930 435 870, 7 rue du Clair Soleil, 25300 Arçon, France, phone +33 6 61 66 49 63 — contact@litho3d.fr. The Publisher has not appointed a data protection officer, as this is not mandatory for its activity; any question may be sent to the address above.
2. Data processed, purposes and legal bases
| Data | Purpose | Legal basis (Art. 6 GDPR) | Retention period |
|---|---|---|---|
| Email address, name, account identifier, password (stored in encrypted form by the authentication provider), or Google identity | Creating, securing and managing the account | Performance of the contract (Terms of use) | Lifetime of the account |
| Search criteria, situation, buyer profile (contact details, background, skills, personal contribution, motivation), CV | Providing the Service: filtering listings, simulating financing, writing messages and the acquisition plan, filling in advertisers' forms | Performance of the contract | Lifetime of the account |
| Pipeline, notes, prepared messages, history of declared sendings | Tracking the User's deals | Performance of the contract | Lifetime of the account |
| Telegram chat identifier, questions asked to the assistant (written or voice) and answers. Voice messages are transcribed into text and then immediately discarded: the audio recording is never kept by AcquiScan | Sending alerts, answering questions | Performance of the contract | Lifetime of the account; conversation history limited to the latest exchanges |
| Usage counters, login dates, technical logs | Security, abuse prevention, beta limits, aggregated internal statistics | Legitimate interest | 12 months maximum |
| Account data: profile, CV, criteria, pipeline and notes, prepared messages, alerts sent, questions asked to the assistant and answers, usage counters | User support, diagnosis and correction of malfunctions, security and abuse prevention, improvement of the Service | Performance of the contract (support); legitimate interest of the Publisher (security, improvement of the Service) | Viewed without copying, for the lifetime of the account; log of views kept for 12 months maximum |
| Pages viewed, referring page, device and browser type, visit duration; IP address and browser used only to calculate an anonymous code renewed every day, never stored | Audience measurement of the showcase website: aggregated statistics on visits and journeys, to improve the website | Legitimate interest of the Publisher; tracker exempt from consent (Art. 82 of the French Data Protection Act, CNIL guidelines) | 25 months maximum |
| Name, email, profile and message from the contact form | Replying to requests, managing the relationship | Legitimate interest / pre-contractual measures | 3 years from the last contact |
Mandatory fields are indicated at the time of collection; without them, the Service cannot be provided. No decision producing legal effects concerning the User is taken solely on the basis of automated processing: scores and analyses are decision-support tools for the User. No data is sold, rented or used for advertising purposes.
3. Third-party data (company directors and companies)
To help the User analyze a listing, the Service may display information about companies and their directors taken from public sources: the French government's business directory (Annuaire des entreprises), the National Business Register, the BODACC, company websites. This processing is based on legitimate interest (assistance in analyzing a business acquisition); only the necessary data is presented, with its source, and it is kept for 12 months maximum. Any data subject may object to this processing or request the deletion of data concerning them by writing to contact@litho3d.fr; the request is processed within one month.
Businesses in difficulty (optional feature). If the User activates this option, the Service presents the opening of safeguard, receivership and judicial liquidation proceedings published in the BODACC (open data from the DILA, Licence Ouverte). Only companies are included: sole traders, identified by their name, are excluded. The entries mention the company name, its activity, its municipality, the court and the appointed professionals (judicial administrator, creditors' representative or liquidator), as published; they are removed no later than 120 days after publication.
4. Recipients and processors
Within the Publisher, only Hugo Aubry, as administrator of the Service, may consult the data in an account, and only when necessary for User support, diagnosing a malfunction, the security of the Service or its improvement. To improve the Service, the Publisher favors overall statistics; personal content (notes, CVs, questions asked to the assistant) is only consulted when there is a specific need. Each consultation is recorded in a log. This data is never communicated to third parties, advertisers or sellers, nor used for other purposes. You can object to it being consulted for the purpose of improving the Service by writing to contact@litho3d.fr. Data is also processed, within the limits of their tasks, by the following processors, bound by commitments compliant with Article 28 of the GDPR:
| Provider | Role | Data location |
|---|---|---|
| Supabase Inc. | Database, authentication | European Union (Ireland) |
| Vercel Inc. | Hosting of the website and application | European Union (Frankfurt) for processing; global content delivery network |
| Groq Inc. | AI models: analyses, writing, assistant, transcription of voice messages sent to the Telegram bot | United States |
| Google LLC (Gemini, Google Sign-In) | Backup AI model; Google sign-in if chosen | United States / European Union |
| Tavily | Web search about companies (no User data) | United States |
| Telegram | Delivery of alerts and messages, if the User activates it | According to Telegram's policy |
| FormSubmit | Email relay for contact form messages | United States |
| PostHog Inc. (PostHog Cloud EU) | Audience measurement of the showcase website, aggregated statistics | European Union (Frankfurt, Germany) |
Data sent to AI models is limited to what is necessary for the requested task (listing text, questions, relevant elements of the profile for writing a message). It is not used by the Publisher to train models.
5. Transfers outside the European Union
Some providers are established outside the European Union, in particular in the United States. These transfers are governed by an adequacy decision (EU–US Data Privacy Framework for certified companies) or, failing that, by the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures. A copy of the safeguards can be obtained on request.
6. Security
The Publisher implements appropriate technical and organizational measures: encryption of communications (HTTPS/TLS), authentication delegated to a specialized provider, passwords never stored in plain text, systematic server-side access control, separation of data between users, database access restricted to the application server, secrets stored outside the code, rate limiting, logging. In the event of a data breach likely to result in a risk to individuals, the Publisher notifies the CNIL under the conditions of Article 33 of the GDPR and, where applicable, the data subjects.
7. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection (Articles 15 to 21 of the GDPR), as well as the right to set guidelines regarding what happens to your data after your death. From your account Settings, you can at any time modify your information, download all your data and delete your account. For any other request: contact@litho3d.fr; a reply is provided within one month, and proof of identity may be requested in case of reasonable doubt.
You can lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr.
8. Minors
The Service is intended for adults. It is not intended for persons under 18.
9. Cookies and trackers
Showcase website: no cookies are set. We measure website traffic with the PostHog tool, hosted in the European Union (Frankfurt), configured not to store anything in your browser. To count visitors without identifying them, an anonymous code is calculated on PostHog's server from your IP address and your browser, with a random value that is changed and deleted every day: it cannot be used to recognize you from one day to the next, and your IP address is not stored. The data is used only to produce aggregated statistics for our own account (page views, referrers, journeys); it is not combined with other data, passed on to third parties or used for advertising purposes, and is kept for 25 months maximum. This system is exempt from consent (Article 82 of the French Data Protection Act, CNIL guidelines). You can object to it at any time with the button below; your choice is then stored in your browser. The only other thing stored, in your browser's local storage, is your choice of light or dark display, if you use the button provided for this purpose: this preference, saved at your request and never transmitted, is exempt from consent.
This setting requires JavaScript; if JavaScript is disabled, no audience measurement takes place.
Application: only strictly necessary items are stored in the browser's local storage: the login session (authentication token) and the light or dark theme preference. In accordance with Article 82 of the French Data Protection Act and the CNIL guidelines, these items are exempt from consent. No advertising or audience-measurement cookies are used, and fonts are hosted by the application itself. If you choose “Continuer avec Google” (Continue with Google), sign-in takes place on Google's pages, under its own rules.
Browser extension (optional): the auto-fill extension only stores, for a maximum of 30 minutes, the temporary token used to fill in the form opened from AcquiScan; it only accesses the pages of supported advertisers and collects no browsing data.
10. Changes to this policy
This policy may change. The date of the latest update appears at the top of the page; any substantial change is brought to Users' attention.