How we handle your data

Que pense Michel is operated by its publisher (the “editor”), reachable at the contact address below. The editor decides why and how your personal data is processed and is the data controller within the meaning of the GDPR.

Until full legal mentions are published, treat the contact email below as the official channel for any data-protection request.

Data you provide:

• The WhatsApp chat export (.txt or .zip) you upload, including message text, timestamps and sender display names as they appear in the file.
• The participant display names you confirm or edit in the wizard, the group name, and the optional cover image.
• Your email address, used to deliver the report link and, if you sign in, to create your account.
• Billing identifiers returned by Stripe (transaction ID, last 4 digits, country). We never see or store your full card number.
• Basic technical data: IP address (truncated where possible), browser user-agent, request timestamps and error logs, kept for security and debugging.

• Generating and delivering your report, managing your account and reports — performance of the contract (art. 6.1.b).
• Processing your payment and issuing invoices — performance of the contract and legal obligation (art. 6.1.b & 6.1.c).
• Sending transactional emails (report ready, magic link, receipts) — performance of the contract (art. 6.1.b).
• Preventing fraud, abuse and ensuring service security — legitimate interest (art. 6.1.f).
• Anonymous product analytics (page views, conversion) — legitimate interest (art. 6.1.f); no advertising cookies.

To produce the report, we send the parsed chat content to Google's Gemini API. Under Google's API terms for paid Gemini usage, your inputs and outputs are not used to train Google's models.

Once the report is generated, the raw chat content is deleted from our database within the retention window above. The AI provider does not retain inputs for longer than the period required to process the request and run abuse-prevention checks.

The report itself is content authored by an AI based on your chat. It is intended as entertainment and does not produce legal effects about you within the meaning of GDPR art. 22 (no fully automated decision with significant consequences).

Some sub-processors above are based outside the European Union. When that is the case, transfers rely on the European Commission's Standard Contractual Clauses (Decision 2021/914), complemented where relevant by additional technical and organisational measures (encryption in transit, access controls, minimisation of the data shared).

• All traffic between your browser and our servers is encrypted in transit (HTTPS / TLS).
• Data at rest is encrypted by our cloud infrastructure provider.
• Database access is enforced by row-level security: by default a user can only read and modify their own rows.
• Administrative access to production is limited to the editor, protected by strong authentication.
• We do not claim any third-party certification (SOC 2, ISO 27001, HIPAA, etc.) on this page. If we ever obtain one, we will say so here, with evidence.

• Right of access (art. 15) — get a copy of the personal data we hold about you.
• Right to rectification (art. 16) — correct inaccurate data (e.g. participant names).
• Right to erasure (art. 17) — delete a specific report or your entire account. Self-serve from the dashboard.
• Right to restriction (art. 18) — ask us to freeze processing while a dispute is resolved.
• Right to object (art. 21) — object to processing based on legitimate interest.
• Right to data portability (art. 20) — receive your report and account data in a structured, machine-readable format (JSON).
• Right to withdraw consent at any time, where processing was based on consent.
• Right to lodge a complaint with a supervisory authority (CNIL in France).

We use strictly necessary cookies to keep you signed in and to remember your language preference. These do not require consent under French law (CNIL guidance) because they are essential to providing the service.

We also collect privacy-friendly product analytics (page views, conversion funnel, referrer). This data is not enriched with third-party identifiers, is not used for advertising, and is stored in our own database. UTM attribution parameters are stored in your browser's sessionStorage for the duration of a single browsing session.

Que pense Michel is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor uploaded a chat, contact us and we will remove the report and associated data.

We may update this policy as the product evolves or as legal requirements change. Material changes will be reflected in the “Last updated” date above. Continued use of the service after a change means you accept the updated policy.