Skip to main content

Privacy Policy

Last updated: 2026-10-06

This English text is a translation. The French version prevails.

Introduction

H277 SAS (“ResonanceMetrics”, “we”, “our”, or “us”) protects the privacy of users of the ResonanceMetrics platform at https://resonancemetrics.com (the “Service”).

This Privacy Policy describes how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and the French Data Protection Act.

1. Data controller

The controller of your personal data is:

H277 SAS

For any question about the protection of your personal data, contact [email protected].

2. Data we collect

2.1 Data you give us

When you use the Service, we collect data you provide directly:

| Category | Data | Purpose | |----------|------|---------| | Account data | Email address, name, company name | Create and manage your account | | Billing data | Name, billing address, payment information* | Process payments and invoicing | | Brand data | Website URLs, brand names, company information | Provide the Service (visibility analysis) | | Configuration data | Prompts, personas, competitors, settings | Personalize and operate the Service | | Communications | Email content, support messages | Answer your requests and improve the Service |

*Payment information is processed directly by our payment provider, Lemon Squeezy. We do not store your card details.

2.2 Data collected automatically

When you browse the Service, some data is collected automatically:

| Category | Data | Purpose | |----------|------|---------| | Connection data | IP address, date and time of access, pages viewed | Security, usage analysis | | Technical data | Browser type, operating system, screen resolution | Technical optimization of the Service | | Usage data | Actions in the Service, features used | Improve the Service | | Cookies | Session identifiers, preferences | Operation and personalization (see the Cookie Policy) |

2.3 Data from third parties

We may receive data about you from:

  • Payment provider (Lemon Squeezy): payment confirmation, subscription status
  • Authentication services: if you sign in through a third-party service (where available)

3. Purposes and legal bases

We process your personal data for the following purposes:

| Purpose | Legal basis (GDPR Art. 6) | Detail | |---------|---------------------------|--------| | Providing the Service | Contract (Art. 6.1.b) | Account creation, visibility analysis, report generation | | Customer relationship | Contract (Art. 6.1.b) | Customer support, account communications | | Billing and payments | Contract (Art. 6.1.b) | Process payments, issue invoices | | Improving the Service | Legitimate interest (Art. 6.1.f) | Aggregated usage analysis, new features | | Security | Legitimate interest (Art. 6.1.f) | Fraud prevention, protection against unauthorized access | | Marketing communications | Consent (Art. 6.1.a) | Newsletter and product news (with your agreement) | | Legal obligations | Legal obligation (Art. 6.1.c) | Invoice retention, responses to lawful requests | | Analytics cookies | Consent (Art. 6.1.a) | Audience measurement, optimization of the Service |

3.1 Legitimate interests

Where we rely on legitimate interest, we have assessed that it does not override your rights and freedoms. Our legitimate interests include:

  • Improving and developing the Service
  • Securing our infrastructure and protecting against fraud
  • Understanding how the Service is used so we can meet your needs

You can object to processing based on legitimate interest (see section 8).

4. Sharing data

4.1 Processors

We use processors to provide the Service. They process your data only on our instructions and are contractually required to keep it confidential and secure.

| Processor | Purpose | Location | Safeguards | |-----------|---------|----------|------------| | Supabase | Hosting, database, authentication | European Union (eu-west) | GDPR-compliant, DPA | | Vercel | Web application hosting | European Union | GDPR-compliant, DPA | | OpenAI | AI platform (ChatGPT) for visibility analysis | United States | DPA, API with no data retention | | Anthropic | AI platform (Claude) for visibility analysis | United States | DPA, API with no retention | | Google | AI platform (Gemini) for visibility analysis | United States | GDPR-compliant, DPA | | Perplexity AI | AI platform for visibility analysis | United States | API terms |

4.2 We do not sell data

We do not sell your personal data to third parties.

4.3 Other disclosures

We may disclose your personal data:

  • If the law requires it (court order or request from a public authority);
  • To protect our rights, property, or safety, or those of our users;
  • In connection with a merger, acquisition, or sale of assets (your data would transfer to the successor).

5. International transfers

5.1 Where data is stored

Your data is stored primarily in the European Union (Supabase and Vercel hosting in a European region).

5.2 Transfers to the United States

Some processors are located in the United States. For those transfers we rely on:

  • Standard Contractual Clauses (SCCs) approved by the European Commission, which require US recipients to protect data to a standard equivalent to the GDPR.
  • The EU-U.S. Data Privacy Framework, where the processor is certified under that framework.

We have assessed that these safeguards provide an adequate level of protection for your data.

5.3 Data sent to AI platforms

When you use the Service to analyze visibility, the prompts you create are sent to third-party AI platforms (OpenAI, Anthropic, Google, Perplexity) through their APIs. That data:

  • Does not contain personal data that identifies you directly;
  • Concerns information about your brands and visibility queries;
  • Is processed under those platforms’ own policies.

6. How long we keep data

We keep personal data for the following periods:

| Data category | Retention | Reason | |---------------|-----------|--------| | Account data | Life of the account + 3 years after closure | Customer relationship, possible disputes | | Brand and configuration data | Life of the account + 30 days after termination | Providing the Service, possible reactivation | | Billing data | 10 years from invoicing | Legal obligation (French Commercial Code) | | Connection data and logs | 1 year | Security, LCEN compliance | | Usage data (aggregated) | Indefinitely in anonymized form | Improve the Service | | Support communications | 3 years after the last interaction | Service quality, evidence | | Cookies | See the Cookie Policy | Depends on the cookie |

When these periods end, your data is deleted or irreversibly anonymized.

7. Security

We implement appropriate technical and organizational measures to protect your data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.

Those measures include:

Technical measures:

  • Encryption in transit (TLS/HTTPS)
  • Encryption at rest
  • Secure authentication and access management
  • Access monitoring and logging
  • Regular backups
  • Security testing

Organizational measures:

  • Need-to-know access to data
  • Staff awareness of data protection
  • Security-incident procedures
  • Careful selection of processors

If a data breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay, in accordance with the GDPR.

8. Your rights

Under the GDPR you have the following rights:

| Right | Description | How to exercise it | |-------|-------------|--------------------| | Access | Confirm that your data is processed and receive a copy | Email [email protected] | | Rectification | Correct inaccurate data or complete incomplete data | Account interface or email | | Erasure | Ask us to delete your data in certain cases | Email [email protected] | | Restriction | Ask us to suspend processing temporarily | Email [email protected] | | Portability | Receive your data in a structured format and transmit it to a third party | Email [email protected] | | Objection | Object to processing based on legitimate interest | Email [email protected] | | Withdraw consent | Withdraw consent you previously gave | Account settings or email |

8.1 Exercising your rights

You can exercise your rights:

We will reply within one (1) month of receiving your request. That period may be extended by two further months for a complex request, in which case we will tell you.

We may ask you to confirm your identity before we act on the request.

8.2 Right to complain

If you believe the processing of your personal data violates the GDPR, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL):

  • Website: https://www.cnil.fr
  • Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07

We encourage you to contact us first so we can try to resolve the issue.

9. Cookies and similar technologies

Cookies and similar technologies are covered by our Cookie Policy.

10. Children’s data

The Service is intended for professionals and is not designed for anyone under 18. We do not knowingly collect personal data about children.

If we learn that we have collected a child’s personal data, we will take the steps needed to delete it.

11. Use of data for artificial intelligence

11.1 We do not train on your data

We do not use your Customer Data (brands, prompts, configurations) to train artificial-intelligence or machine-learning models.

11.2 Data sent to third-party AI platforms

When the Service runs your prompts on third-party AI platforms, the following may be transmitted:

  • The text of the prompt you configured;
  • The location/language context associated with the prompt.

That data does not contain personal information that identifies you directly. Processing by those platforms is subject to their own privacy policies.

12. Changes to this policy

We may change this Privacy Policy at any time. If we make a material change, we will tell you:

  • By email to the address on your account;
  • By a visible notice in the Service.

The last-updated date is shown at the top of this document.

Please review this Policy regularly so you stay informed about how we protect data.

13. Contact

For any question about this Privacy Policy or the processing of your personal data:

H277 SAS

We will respond to every request as soon as we can.

By using the Service, you acknowledge that you have read this Privacy Policy.