Privacy policy

1. Data controller

Marketplace Factory, 6 rue d’Armaillé, 75017 Paris, SIREN 943 924 639. For any question about your data: contact@marketplacefactory.com.

2. Our role, depending on the data

We are the data controller for the data of website visitors, studio users and our customers (account, subscription, invoicing, correspondence).

For the data of the users of a marketplace created with Marketplace Factory (its buyers, its sellers, their listings and their messages), the data controller is the company that publishes that marketplace; we act as its processor. To exercise your rights over this data, contact that company first: its contact details are on its marketplace.

3. The data we process

• Browsing: visitor identifier, IP address, browser type, pages requested, date and time, technical logs.
• Studio: the sentences you write, your choices, your edits, the text and photos you import, your drafts and your recovery code.
• Account: name, email address, password (stored with irreversible encryption), company, or Google sign-in identifier.
• Subscription and invoicing: plan, billing details, VAT number, payment and invoice history. Card numbers are processed by Stripe and never reach us.
• Correspondence: your messages and our replies.
• Acceptance of the terms: the version of the terms accepted when your account was created, its date, and how it was accepted (checkbox or “Continue with Google” button).

4. Why, and on what legal basis

5. How long

• Visitor identifier: 180 days after the last visit.
• Proposals and drafts without an account: 180 days after the last visit, like the visitor identifier, then deleted. A draft linked to an account follows the account’s retention period.
• Sign-in code sent by email: ten minutes; only its fingerprint is kept, like the address that asked for it.
• Account and studio data: for the duration of the relationship, then three years after the last activity or the end of the subscription.
• Marketplace data: for the duration of the subscription, then thirty days for export, before deletion.
• Database backups: daily, kept for thirty days (restorable to the minute), then erased.
• Deleted photos: recoverable for thirty days, then erased.
• Export archives: erased thirty days after they are created.
• Invoices and accounting records: ten years (article L. 123-22 of the French Commercial Code).
• Technical logs: ninety days.
• Cost of artificial intelligence, per customer: thirteen months; an anonymous visitor’s identifier is erased from it after thirty days.
• Job applications and CVs: erased two years after their last activity.
• Refused sentences (prohibited activities): six months.
• Correspondence: three years after the last message.
• Proof of your acceptance of the terms: for the life of the account, then five years after its deletion, without your name or email address.
• Shared photo library: photos created for an idea from a universe recipe and a trade’s subject, without your content, serve the next ideas; those created from your content stay in your project.
• Content reports and decisions: twelve months after the decision, then anonymised.

6. Who has access: our subprocessors

Your data is accessible only to the members of our team who need it, and to the following providers, who act on our instructions and under contract:

7. Transfers outside the European Union

Some providers process data in the United States. These transfers are governed by the European Commission’s standard contractual clauses or, for certified companies, by the EU–US Data Privacy Framework. We send our artificial intelligence providers only what the requested task needs: your sentence, the text to edit, the description of a photo — never your account or payment data.

8. Security

Encrypted connections, irreversibly encrypted passwords, separation of each marketplace’s data, restricted and logged access, daily backups kept for thirty days: we take technical and organizational measures suited to the risks. In the event of a data breach posing a risk, we notify the CNIL (the French data protection authority) and, where necessary, the people concerned.

To protect email sign-up from automated abuse, Cloudflare Turnstile invisibly checks that the request really comes from a browser: technical browser signals are analysed at the time of the request, for this check only.

9. Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data, as well as the right to set instructions for what happens to your data after your death. Write to contact@marketplacefactory.com; we reply within one month, and may ask you to prove your identity if in doubt.

From your account, you can also download your data and delete your account yourself. A deleted account is anonymised immediately; accounting records are kept, without your name, for their statutory period.

If you believe your rights are not being respected, you can lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr.

10. Cookies

We only use cookies that are necessary for the service to work, with no analytics or advertising. The details are on the Cookies page.

11. Changes

We may update this policy, in particular if we change providers. The date of the last update appears at the top of the page; our customers are notified by email of any significant change, and of any new sub-processor for their marketplace’s data.