Privacy Policy

1. Data Controller

The data controller for personal data is:

• Company: SAS Cooking University (MATVI Consulting)
• Address: 26 rue du four à chaux, 85470 Brem-Sur-Mer, France
• Email: contact@matvi-consulting.com

2. Data Collected

We may collect the following types of data:

Identification Data

• First and last name
• Email address
• Phone number (optional)
• Company name

Connection Data

• IP address
• Browser type
• Pages visited
• Date and time of connection

Usage Data

• Conversational agent interactions
• Documents uploaded to the knowledge base
• Settings and configurations

Payment Data

• Billing information (name, address)
• Transaction history and invoices

Note: credit card data is processed exclusively by our payment provider Stripe and is never stored on our servers. See Stripe's privacy policy.

3. Processing Purposes

Your data is collected for the following purposes:

• Provision and management of the RAG Weaver service
• Creation and management of your user account
• Improvement of our services and user experience
• Communication regarding your account and our services
• Compliance with our legal obligations
• Statistical and anonymized usage analysis

4. Legal Basis for Processing

The processing of your data is based on:

• Contract performance: for service provision
• Your consent: for marketing communications
• Our legitimate interest: for improving our services
• Our legal obligations: for regulatory compliance

5. Data Retention

Your data is retained for:

• Account data: during your subscription, then 3 years after termination
• Conversations: according to your retention settings (default 12 months)
• Documents: until deleted by user or account closure
• Connection data: 12 months
• Billing data: 10 years (legal requirement)

6. Data Recipients

Your data may be shared with the following categories of recipients:

Internal team

Our support and technical teams, strictly within the scope of their duties and on a need-to-know basis.

Technical sub-processors

Our sub-processors are bound by Data Processing Agreements (DPAs) compliant with the GDPR:

• Hosting: OVH (France/EU) — servers, databases, storage
• Payment: Stripe (United States, DPF certified) — credit card payment processing
• AI providers: OpenAI, Mistral, Anthropic (depending on user configuration) — processing of conversational queries. Only query content and knowledge base context are transmitted, never user identification data
• Email: SMTP provider for transactional emails (notifications, password reset)

Authorities

Competent authorities (judicial, administrative) if required by law.

Commitment: we never sell your personal data to third parties. We do not use it for advertising purposes. Your data is only shared as strictly necessary to provide the service.

7. International Transfers

Some data may be transferred to countries outside the European Union (particularly for AI services). These transfers are governed by:

• European Commission Standard Contractual Clauses
• Data Privacy Framework for transfers to the United States

8. Your Rights

Under the GDPR, you have the following rights:

• Right of access: obtain a copy of your data
• Right to rectification: correct inaccurate data
• Right to erasure: request deletion of your data
• Right to object: object to the processing of your data
• Right to portability: receive your data in a structured format
• Right to restriction: limit the processing of your data
• Right to withdraw consent: at any time

To exercise these rights, contact us at: contact@matvi-consulting.com

You may also lodge a complaint with the French Data Protection Authority (CNIL) at www.cnil.fr.

9. Cookies

Our website uses cookies for:

• Essential cookies: necessary for website operation
• Preference cookies: remember your choices (language, etc.)
• Analytics cookies: understand site usage (with anonymization)

You can manage your cookie preferences through your browser settings.

10. Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of sensitive data at rest
• Strict access control
• Regular security audits
• Staff training

11. On-premise deployment

For clients who have opted for an on-premise deployment of RAG Weaver:

• Locally hosted data: all data (accounts, conversations, documents, knowledge base) is stored on the client's infrastructure. MATVI Consulting does not have access to this data
• Licence data: only licence information (licence key, tenant identifier, expiry date) is transmitted to our servers for periodic validation
• AI providers: if the user configures third-party API keys, conversational data is transmitted directly from the client's infrastructure to the AI provider, without passing through our servers

The on-premise client is the data controller under the GDPR for data stored on their infrastructure. MATVI Consulting acts as a data processor solely for licence validation.

12. Data breach

In accordance with Articles 33 and 34 of the GDPR, in the event of a personal data breach likely to result in a risk to your rights and freedoms:

• We will notify the CNIL within 72 hours of becoming aware of the breach
• If the breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay
• We will immediately take the necessary measures to mitigate the consequences of the breach

13. Minors

The RAG Weaver service is not intended for persons under 16 years of age. We do not knowingly collect personal data from minors. If we become aware that data has been collected from a minor without the required parental consent, we will delete such data as soon as possible.

14. Changes

This policy may be updated. In case of substantial changes, we will notify you by email or via a notification on the platform at least 30 days before the changes take effect. The last update date is indicated at the top of this page.