Privacy policy

Data controller

Mixelligence, Auriel Metonou
Registered office: 14 rue du Collège, 59480 La Bassée, France
SIRET: 884 804 220 00025
Email: contact@mixelligence.fr

Data collected

We only collect the data needed to provide the service:

  • First / last name or brand name
  • Email address
  • Business information (activity, target audience, platforms)
  • Payment data (processed by Stripe, we do not store your card details)

Purposes of processing

  • Generating and sending weekly social media content
  • Managing the subscription and billing
  • Service-related communication (transactional emails)
  • Improving the quality of the service

Legal basis

Processing is based on the performance of the contract (art. 6.1.b GDPR) to provide the service, and on your consent for marketing communications.

Retention period

Your data is kept for the duration of your subscription, then 3 years after the end of the commercial relationship for legal purposes.

Sub-processors

For each provider, we state what it receives and why. The country of establishment and the framework covering transfers outside the European Union are stated where we have verified them.

  • Stripe, online payment (United States, EU standard contractual clauses)
  • Anthropic, AI content generation (United States, EU standard contractual clauses)
  • Vercel, hosting (United States, EU standard contractual clauses)
  • Neon, database (quotes, scheduling and appointments), hosted in the European Union (EU region)
  • Resend, email sending (United States, EU standard contractual clauses)
  • fal.ai, image and video generation for the Influencer Studio: the product photos and reference videos you provide pass through it (United States, EU standard contractual clauses)
  • ElevenLabs, voice synthesis for talking videos: your script texts pass through it (United States, EU standard contractual clauses)
  • TikTok, Meta (Instagram/Facebook): publishing content on your accounts, only if you connect those accounts
  • LinkedIn: publishing on Mixelligence's own LinkedIn Page. It is not an account you connect, and no LinkedIn connection is offered to you
  • Apify, searching publicly published information: the activity and city you search to find prospects, the Instagram or TikTok account name you submit to the virality analysis, and the business whose reviews you ask us to read are sent to it (Czech Republic, European Union; its data processing addendum provides for transfers to the United States, covered by the EU standard contractual clauses)
  • Airtable, storing requests and working lists: your quote request (name, email address, phone, activity, need), your sign-up to our free resources, the prospects you search for (name, email address, phone, website, city) and the register of people who have opted out are recorded there (United States, Formagrid Inc. dba Airtable, San Francisco; its data processing addendum incorporates the EU standard contractual clauses, Decision 2021/914, modules 2 and 3)
  • Amazon Web Services, storage and rendering of video files: the media you send for publication, the generated voice-overs and the videos produced by the Studio are stored there, in the eu-west-3 region (Paris, France). The entity with which customers located in Europe contract is Amazon Web Services EMEA SARL, Luxembourg; its data processing addendum, part of its service terms, incorporates the EU standard contractual clauses (Decision 2021/914, module 2 or 3) for any transfer to a country without an adequacy decision
  • Microsoft, sending your prospecting messages from your own Outlook mailbox, only if you connect it: the message you have reviewed and its recipient's address pass through its servers. We never read your mailbox (Ireland, Microsoft Ireland Operations Limited, for the European Economic Area; transfers to Microsoft Corporation, United States, are covered by the EU standard contractual clauses, Decision 2021/914, and Microsoft is certified under the EU-U.S. Data Privacy Framework)
  • Shotstack, video editing (subtitles, soundtrack): your video files and the texts shown on screen pass through it for the time of the render (Australia, a country with no European Commission adequacy decision; EU standard contractual clauses, module 2 or 3)
  • Google, Meta and TikTok, measuring our traffic and our advertising campaigns, only if you accept the trackers: see the « Cookies and trackers » section below
  • The French State business register (recherche-entreprises.api.gouv.fr): when you enter your SIRET number, that number alone is sent to it to check that the business is registered. No other data from your account is transmitted

Data of our subscribers' clients (Scheduling & Quotes)

When you use the Scheduling (online booking) or Quotes modules, your own clients may send us their data (name, email, phone, appointment reason). For this data, you are the data controller and Mixelligence acts solely as a processor, on your behalf and on your instructions, under the terms of the "Personal data protection (processing on your behalf)" article of the Terms.

This data is used only to provide the service (display availability, record and confirm appointments, create and send quotes) and is never resold or used for advertising. Appointments are automatically deleted 12 months after their date. Quote-related data is kept for the duration of your subscription, then deleted or returned at your request (subject to any legal retention obligation for an accepted quote). It is your responsibility to inform your own clients of this processing and to obtain their consent where applicable.

Collaborators invited into a subscriber's space

This section is for subscribers who invite collaborators into their space, and for the people they invite. The subscriber gives each collaborator one of two roles: "View only" or "View and decide". The collaborator sees the assignment tracking and Rilo's plans of that space, and nothing else.

The data processed

  • the invited person's email address and the role the subscriber gives them
  • the invitation dates (creation, expiry, acceptance or cancellation) and the date they joined the team
  • the decisions they make in the space, each linked to their address: approving or declining delivered work, approving a Rilo plan, removing a step from it, confirming a step, asking Rilo to revise a plan, with the text of that request

Why

To send the invitation by email, let the invited person sign in to the subscriber's space, limit their rights to the chosen role, pass their plan revision requests on to Rilo, and show the subscriber and the other collaborators who made each decision. This data is never resold or used for advertising.

Who is the controller

For this data, the subscriber who sends the invitation is the data controller: they choose whom to invite, with which role, and whom to remove. Mixelligence acts as a processor, on their behalf and on their instructions, under the terms of the "Personal data protection (processing on your behalf)" article of the Terms. It is the subscriber's responsibility to inform their collaborators of this processing and to have a legal basis for it.

Mixelligence remains the controller only for the processing it carries out for its own purposes: securing sign-ins, and checking, when the invitation is accepted, that the invited address does not already have its own Mixelligence space, so that no one's own data is ever hidden from them. Both rely on our legitimate interest in securing the service (Art. 6(1)(f) GDPR).

Who receives this data

Within the space, the subscriber and their other collaborators see the person's address, their role and who made each decision. Service providers: Neon (database), Vercel (hosting), Resend (sending the invitation email), Anthropic (the text of a request asking Rilo to revise a plan) and Stripe, queried with the invited address for the check described above. Each provider's country and the framework for transfers outside the European Union are listed in the "Sub-processors" section above.

How long we keep it

  • An invitation, accepted or not, is deleted 30 days after the end of its 72-hour validity.
  • Team membership (address, role, date joined) is deleted as soon as the person leaves the team or the subscriber removes them, and at the latest with the subscriber's account.
  • Decisions are part of the space's assignment history. They stay linked to their author's address after they leave, and are kept and then deleted with that history, for the period stated for the subscriber's account data ("Retention period" section).

Your rights, if you are or were a collaborator

You can leave the team at any time from your space: your access stops immediately. For the space's data, including the decisions that carry your address, send your request for access, rectification, erasure, objection or restriction to the holder of the space, who is the controller. You can also write to contact@mixelligence.fr: we forward your request to them, and we handle ourselves any request about the processing we carry out for our own purposes. We reply within 30 days. If there is a dispute, you can contact the CNIL.

If we gathered your business contact details without asking you

This section is addressed to professionals whose contact details appear in our outreach lists without their having given them to us. It answers Article 14 of the GDPR, the one that applies when personal data has not been obtained from the data subject. It applies whether or not you have received a message from us.

Where your details come from

From publicly published business sources, and from those only: your public Google Maps business listing, your company's public page on Facebook or LinkedIn, your public Instagram or TikTok account, and the contact address displayed on your own website. These searches are carried out by our provider Apify. Your details may also have been typed in by hand by the person who wishes to write to you, when they met you or when you were recommended to them.

The categories of data

  • the name of your business or account, and your line of activity
  • your town and your website address
  • your business email address and business phone number, where they are published
  • for a public social media account, the follower count displayed
  • the message drafted for you, and the state of the outreach: sent, followed up, replied to, objected to

Why, and on what basis

To send you a business-to-business commercial proposal. The legal basis is legitimate interest (Art. 6.1.f GDPR), applied to business contact details published in order to be contacted. You may object at any time, without having to give a reason.

Who is the controller

Two situations, which must not be confused. When the campaign is ours, the controller is Mixelligence, 14 rue du Collège, 59480 La Bassée, France, reachable at contact@mixelligence.fr. When the campaign belongs to a professional subscribed to Mixelligence, that subscriber is the controller and Mixelligence acts only as a processor on their behalf: their name and reply address appear in the message you received. In both cases, write to us: we will tell you who you are dealing with, and we pass your request on.

Who receives this data

The recipients are Apify for the search, Airtable for storing the lists, Vercel for hosting the application, and, at the moment of sending, Resend or the sender's own business mailbox at Google or Microsoft when they have connected it. Each provider, its country and the framework for its transfers outside the European Union are listed in the « Sub-processors » section above. Your details are never sold, rented or handed over.

How long we keep them

For as long as the commercial approach they were gathered for lasts, and 36 months at most from the day we gathered them. After that, a record left without follow-up is deleted automatically, without you having to ask. An erasure request, on the other hand, is carried out without waiting for that term.

Your rights, and how to exercise them

You have the right of access, rectification, erasure, objection, restriction of processing and portability. If you have received a message, the quickest way is the « stop contacting me » link at the bottom of it: it works in one click. Otherwise, write to contact@mixelligence.fr: we answer within 30 days. In case of dispute, you may lodge a complaint with the CNIL, the French data protection authority.

An objection applies to every account using Mixelligence, not only to the one that wrote to you. It stops sending immediately, including follow-ups already scheduled, and it prevents a new search from bringing you back into our lists.

Business lookup in our demonstration

When you use our « Put my team to work » demonstration, the business name and city you enter are sent to the Google Places API in order to find the establishment's public listing. That service is operated by Google LLC, in the United States. The transfer is covered by the European Commission adequacy decision of 10 July 2023 (EU-US Data Privacy Framework), which Google LLC has joined, and by the standard contractual clauses. No data personally identifying you (name, email address, identifier) is sent to Google during this lookup : only the business name and the city are. The information returned comes from the establishment's public listing and from reviews published publicly by its customers.

If you leave us your email address at the end of the demonstration, it is so that you receive the work prepared for you, then a few pieces of advice. You do so by ticking a box that is never pre-ticked, and every one of our emails carries an unsubscribe link that works in a single click. The data of a demonstration without an email address is deleted automatically after 30 days ; with an email address, it follows the same duration as our other professional contacts, that is 3 years from the last exchange.

The reviews displayed or quoted come from the establishment's public listing. When a review is used in a message we prepare, its author is never identified otherwise than by the first name and initial already displayed publicly by Google. For healthcare professions, no review is sent to our writing systems, and no reply to a review is offered : professional secrecy forbids it.

Google data (connecting your mailbox)

If you use the Prospecting Agent, you can connect your own Gmail mailbox so that your messages are sent from your address. This connection is optional : without a connected mailbox, no sending takes place.

Permissions requested

  • gmail.send : send, on your behalf, the messages you have reviewed and approved.
  • openid and userinfo.email : identify the connected address in order to display it to you.

We request no read permission. Mixelligence cannot access your inbox, nor read, nor list your emails.

What we do with this data

The send permission is used only to dispatch the messages you have reviewed and approved. No data from your mailbox is stored. Your messages carry your own address as the reply-to address : your prospects' replies reach you directly, without passing through Mixelligence, and we have no knowledge of them.

What we do not do

We neither sell nor transfer your Google data to third parties. We do not use it for advertising purposes. We do not use it, nor pass it to a third party, to train or improve an artificial intelligence model. No human reads it, except with your explicit agreement to resolve an incident, to meet a legal obligation, or for security reasons.

Retention and deletion

The access tokens to your mailbox are encrypted (AES-256-GCM) and kept for as long as the connection is active. You can disconnect your mailbox at any time from your account, on the Prospecting screen : the tokens are then deleted immediately and access is revoked with Google. You can also revoke that access from your Google account, at myaccount.google.com/permissions.

Mixelligence's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Connecting your social media accounts

Mixelligence lets you publish your content on your own social media accounts (TikTok, Instagram, Facebook). This connection is optional and goes through the platforms' official authorisation interfaces (OAuth).

  • You explicitly grant access, and can revoke it at any time from the platform's settings.
  • The access tokens obtained are used only to publish the content you have yourself prepared and scheduled in Mixelligence.
  • Regarding TikTok, we use the Content Posting API with the video.publish permission to upload your videos to your account, in accordance with TikTok's terms and privacy policy.
  • We do not resell, share or use this data for any purpose other than the requested publication.

Your rights

Under the GDPR, you have the following rights:

  • Right of access to your data
  • Right to rectification
  • Right to erasure ("right to be forgotten")
  • Right to data portability
  • Right to object to processing
  • Right to restrict processing

If you have an account, the simplest way is to file your request from your client area, on the My account page, a screen served in French for now: the request receives an identifier and a date, and you can follow its status. Otherwise, write to us at contact@mixelligence.fr. Response within 30 days in both cases.
In the event of a dispute, you may refer the matter to the French CNIL.

Cookies and trackers

This site places technical cookies strictly necessary for it to work (your session, and remembering the choice described below).

It also uses three traffic and advertising measurement trackers, published by Google, Meta and TikTok. They are not loaded until you have accepted them : for as long as your choice has not been made, or if it is « Reject all », their tags are absent from the page, not merely disabled. You can change your choice at any time through the « Cookies » link in the footer.

If you have accepted those trackers and you take out a subscription, a fingerprint of your email address is sent to Meta so that the purchase can be attributed to the campaign that brought you. Without your consent, that transmission does not happen.

Last updated: October 2026