Privacy Policy

Last updated: September 2026

1. Data Controller

Gaston Media SAS, 18 Rue de Copenhague, 67610 La Wantzenau, France (SIREN: 884 076 027).

2. Data We Collect

Account data: email address, name, language preference
Usage data: API request counts, timestamps (aggregated daily)
Session data: session cookies for authentication

3. Data We Do Not Collect

We do not store the email addresses submitted through the API for classification beyond what is needed to answer the request
We do not sell personal data
We do not run advertising or analytics cookies without your consent

4. How We Use Your Data

To provide and maintain the Service
To process billing via Stripe
To send transactional emails (verification, password reset)

5. Legal Basis (GDPR)

Contract execution: processing necessary to provide the Service
Legitimate interest: service improvement and security

6. Sub-processors

Hetzner (Germany): hosting
Stripe (USA): payment processing
Resend: transactional emails
PostHog (EU region, data stored in the European Union): product analytics — which pages are viewed and which features are used
Google Ads (Google Ireland Ltd.): measuring the performance of our advertising, including whether a visit that came from an ad led to a signup or a purchase

PostHog and Google Ads only receive data once you have accepted cookies. Refuse, and neither is given anything to store.

7. Data Retention

Account data is retained for the duration of your account. Usage data is retained for 12 months. Upon account deletion, all personal data is removed within 30 days.

Files you upload for list analysis are processed to produce your results CSV and are kept with the job so you can download it again. They are deleted with the job when you delete it, and in any case within 90 days. The addresses they contain are used only to classify their domains — they are never added to a list, sold, or used to contact anyone.

Analytics records held by PostHog are retained for 12 months. Advertising identifiers held by Google Ads follow Google's own retention periods.

8. Your Rights

Under GDPR, you have the right to access, rectify, delete, and port your data. To exercise your rights, please use our contact form.

9. Cookies

Essential cookies are always set, because the site cannot work without them: session authentication, language preference, and the CSRF token that protects forms. They require no consent.

Measurement and advertising cookies are only set once you accept them:

PostHog, to understand how the site is used. Until you accept, PostHog keeps nothing on your device — it holds the session in memory only.
Google Ads, to measure whether an ad led to a signup, and a ek_gclid cookie that stores the click identifier for 90 days so a signup made a few days after the click can still be attributed to it.

In the EEA, the United Kingdom and Switzerland these are denied by default until you choose. Elsewhere they are enabled by default and you can refuse them at any time.

You can change your mind whenever you like through Manage cookies at the bottom of any page.

10. Changes

We may update this policy at any time. The date at the top indicates the latest revision.