Privacy Policy

1. Data controller

The personal data controller is Dogan Sezer, publisher of FichePro AI. For any question about your data, contact us at: contact@fichepro.ai

2. Data collected

We collect the following data:

• Account data: email address, hashed password, registration date
• Usage data: number of generated listings, subscription plan, generation history
• Payment data: processed directly by Stripe — we do not store any banking information
• Technical data: IP address, browser type, pages visited (via analytics cookies if consented)

3. Processing purposes

Your data is used to:

• Create and manage your user account
• Provide the product listing generation service
• Process payments and manage subscriptions
• Send service-related communications (confirmations, invoices)
• Improve the service by measuring the key steps of each account's use (first listing, copy or export, return visit, quota reached, payment), without cookies or advertising tools, and by fixing technical errors

4. Legal basis

Processing of your data is based on the performance of the service contract (art. 6.1.b GDPR) for data necessary for the operation of the service, on our legitimate interest (art. 6.1.f GDPR) in measuring the use of the service and tracking technical errors, and on your consent for marketing communications.

5. Sub-processors

We use the following sub-processors for the operation of the service:

5.1 Clarification on AI Usage (Anthropic and OpenAI)

Product listing generation and translation go through the Anthropic API (Claude models). Only the data needed for the listing is sent to it: product name, features or description, price, target audience, keywords, tone, target marketplace, output language and the other optional fields you fill in, plus, where they exist, the writing style and market analyses saved in your workspace. FichePro attaches neither your email address nor any account identifier. Anthropic processes this data on our behalf, under the data processing agreement (DPA) shown in the table above.

We also use the OpenAI API (GPT models, notably gpt-4o-mini and gpt-4o) with the option to not use data for training enabled by default: data sent to OpenAI is not used to train its models. Only the data necessary for the requested use is transmitted to OpenAI:

• A/B variants and bulk refresh of listings: product name, characteristics, tone, target marketplace, output language
• Ad Spy insights: public text of the analyzed advertisement, advertiser page name, public metrics (days active, platforms, estimated audience)
• Niche Finder, Persona Simulator, Predictive Winning: entered keyword, category, product context

No identifying personal data (email, user identifier, payment data) is transmitted to OpenAI. Ad Spy analyses are cached anonymously for 24 hours via Upstash to avoid redundant calls to the same public content.

5.2 Public Source: Meta Ad Library

The Ad Spy module queries the Meta Ad Library — a public database made available by Meta Platforms Inc. for advertising transparency purposes. No user data is transmitted to Meta during these requests: only the keyword entered by the user and the country code are sent.

5.3 Connected stores and marketplaces (optional)

If you connect a store (Shopify, Etsy, eBay, WooCommerce or PrestaShop; Amazon and TikTok Shop are coming soon), we keep what the platform gives us to access it: an OAuth access token and, depending on the platform, its refresh token, or, for WooCommerce and PrestaShop, the API key you create in your store. These tokens and keys are encrypted at rest (AES-256-GCM).

To let you choose the listings to import, we read the list of your listings (up to 50: title, description, price, images, quantities and product identifiers such as the SKU or ASIN) and show it to you without storing it. When you import a listing, we store its name, category and identifiers. For Shopify, we also receive the creation, update and deletion notifications for the products of your store, which we store to keep your catalogue up to date.

The Shopify connection asks for read access to your orders: we only read them if you turn on Autopilot (coming soon), to count a product's sales before and after a change. We do not request buyers' names, email addresses or postal addresses, and we store only the number of sales. For Amazon, Etsy, eBay, WooCommerce, PrestaShop and TikTok Shop, we read no orders and no buyer data.

This data serves your workspace only: it is never sold or shared with another customer. It is sent to an AI sub-processor (see the table above) only when you use a feature that needs it: the chat assistant receives the name and score of a few products in your catalogue (OpenAI), and Autopilot (coming soon) will send the text of a Shopify listing to OpenAI to suggest a variant. An error message returned by a platform (for example, a rejected SKU) may appear in our error logs (Sentry, see the table).

When you disconnect a store, its token or key is deleted from our database immediately. To also cut access on the platform's side, remove the FichePro app's access in the platform settings or delete the API key you created. Imported products stay in your workspace until you delete them or close your account (see section 6).

6. Data retention

Your data is kept for the entire duration of your account, then deleted within 30 days after closure of your account, except for legal retention obligations (billing data: 10 years).

7. Your rights

In accordance with the GDPR, you have the following rights:

• Right of access — obtain a copy of your data
• Right of rectification — correct inaccurate data
• Right to erasure — request deletion of your data
• Right to portability — receive your data in a structured format
• Right to object — object to processing for marketing purposes

You can exercise your portability and erasure rights directly from your account dashboard (« Export my data » and « Delete my account » buttons).

For any other request, contact us at contact@fichepro.ai. You also have the right to lodge a complaint with the French data protection authority (CNIL).

8. Cookies and analytics

We use cookies strictly necessary for the operation of the service (authentication, session). No advertising cookies are used.

On your first visit, a consent banner allows you to accept or refuse analytics cookies. Your choice is recorded in a cookie_consent cookie (duration: 365 days).

If you consent, we activate Vercel Analytics and Vercel Speed Insights. These tools measure visited pages and technical performance (Core Web Vitals). Data is aggregated and anonymous. No advertising cookies are placed.

Regardless of your choice, we collect strictly anonymous and aggregated audience metrics (page visited, device type, country) without any cookie or identifier. This measurement is exempt from consent under the GDPR exception for strictly necessary audience analytics.

9. Marketing emails and right to object

We may send marketing emails (activation reminders, monthly reactivation) to users who have not exercised their right to object. Each marketing email includes a one-click unsubscribe link. You can also unsubscribe from your account dashboard.

10. Security

We implement appropriate technical measures to protect your data: TLS encryption of communications (HTTPS), secure authentication via Supabase Auth, restricted data access. Tokens and keys of connected stores (see 5.3), Google Search Console tokens and app passwords are encrypted at rest with AES-256-GCM. Outbound webhooks are signed with HMAC-SHA256 and automatically disabled after 5 consecutive failures. User content moderation (cluster comments) uses the OpenAI Moderation API to detect spam and inappropriate content.

11. Modifications

This policy may be updated. Any significant change will be notified by email or via a banner on the site.