Legal
Privacy policy
What personal data Loop & Roll handles, why, for how long, who else sees it, and how to exercise your rights. Written under the GDPR and the French Data Protection Act.
Two roles, in short
For this website, its forms, prospects and accounts, TRUSTELIA SAS decides what is collected and why: it is the controller.
For the emails, attachments, contacts and tables that your organisation handles in its own Loop & Roll instance, your organisation decides: it is the controller, and TRUSTELIA SAS acts as its processor (GDPR, article 28). We process this data only to run the service, on your organisation’s instructions, and never for our own purposes.
Controller
TRUSTELIA SAS, 11 Rue Jean Giraudoux, 75016 Paris, France. Contact: contact@mankova-consulting.com.
TRUSTELIA SAS is not legally required to appoint a data protection officer (DPO). Every question about your data goes to the address above.
What we collect, why, and for how long
- Demo booking and callback requests: name, work email, company, phone number (required for a callback), the chosen slot or time, your message, the page you came from and the date of your consent. To organise the demo or the call and follow up on it. Legal basis: steps taken at your request before a contract (article 6.1.b). Kept 3 years after our last contact if no contract follows. A booking creates an event in the calendar of the team member who will meet you (Google Workspace), with you as a guest.
- Partner applications: name, email, company, website, phone, number of SME clients and your message. To study the application and start the partnership. Legal basis: pre-contractual steps (article 6.1.b). Kept 3 years after our last contact if no partnership follows.
- Prospects: the details above and our exchanges with you. To follow up on your interest in Loop & Roll. Legal basis: our legitimate interest in answering and following up on incoming requests (article 6.1.f). Kept 3 years after our last contact. You can object at any time.
- Customer and partner accounts (instance administrators, partner portal): name, work email, password (stored hashed, never readable), company, billing details, sign-in logs. To provide the service, the portal and the invoices. Legal basis: the contract (article 6.1.b); invoices: legal obligation (article 6.1.c). Kept for the length of the contract, then 3 years; invoices and accounting records 10 years (French Commercial Code, article L.123-22).
- Back-office accounts (our own team): name, email, role, sign-in logs and an audit trail of actions. To secure and trace access to customer data. Legal basis: our legitimate interest in securing the service (article 6.1.f). Kept while the person is on the team; logs 12 months.
- The content of your instances (as a processor): the mailboxes your members connect, emails and attachments, address book, workflows, runs and tables. Processed only to run the service, hosted in France. Retention is set by your organisation in its instance; at the end of the contract the data is returned on request, then deleted, under the terms of your contract.
- Referral cookie: if you arrive through a partner’s link and accept it, a cookie stores the partner code (nothing about you) so that the partner is credited if you sign up. Legal basis: your consent (article 6.1.a).
- Audience measurement and behaviour analysis, only if you accept them: see Cookies. Legal basis: your consent (article 6.1.a), which you can withdraw at any time.
No decision producing legal effects is taken on the sole basis of automated processing. Your data is never sold or rented.
Recipients and subprocessors
Your data is seen only by the members of our team who need it, and by the subprocessors below, each bound by a contract that meets article 28 of the GDPR. It may be disclosed to an authority on a lawful request.
| Provider | What for | Where | Safeguards outside the EU |
|---|---|---|---|
| OVHcloud (OVH SAS) | Hosting of the site and instances, backups, AI hosted in France | France (Gravelines, Strasbourg) | Not applicable |
| Brevo (Sendinblue SAS) | Transactional emails (sign-in, notifications, follow-up of your requests) | France, EU | Not applicable |
| Google (Google Workspace, Google Analytics) | Calendar for demo bookings; audience measurement if you accept it | EU and United States | Standard contractual clauses (European Commission decision 2021/914) and the EU-US Data Privacy Framework |
| Microsoft (Clarity) | Behaviour analysis, if you accept it | United States | Standard contractual clauses (European Commission decision 2021/914) and the EU-US Data Privacy Framework |
| OpenAI | AI models, when they serve your instance: chosen by your organisation, or among the platform AI connections we provide | United States | Standard contractual clauses (European Commission decision 2021/914) and the EU-US Data Privacy Framework |
| Stripe (once online payment opens) | Card payment | EU and United States | Standard contractual clauses (European Commission decision 2021/914) and the EU-US Data Privacy Framework |
Transfers outside the European Union
Hosting, backups, transactional email and the AI hosted by OVHcloud stay in France. Some providers are American and may process data in the United States: Google and Microsoft for the measurement tools (only if you accept them), OpenAI when its models serve your instance (chosen by your organisation, or among the platform AI connections we provide; the AI hosted in France stays available), Stripe later for payments.
These transfers rely on the European Commission’s standard contractual clauses and, for certified companies, on the EU-US Data Privacy Framework. We say it plainly: these safeguards reduce the risk of access by foreign authorities, they do not remove it. That is why the measurement tools wait for your consent, and why the instance lets your organisation choose an AI hosted in France. A copy of the safeguards is available on request.
Security
Every connection is encrypted (HTTPS). Passwords are stored hashed, the access keys to your mailboxes and services are encrypted, and each customer has its own isolated instance. Access to customer data by our team is restricted to those who need it and recorded. Backups are kept in a second data centre.
The sensitive data filter
In the instances, a filter looks for the special categories of data of the GDPR (health, sex life and orientation, origin, opinions, beliefs, trade union membership, genetics, criminal records) and the intimate sphere. An email it flags as sensitive is never sent to an AI model, never quoted in an analysis report and never used as an example: it is only counted. Social security numbers, IBANs and card numbers are masked before any sending.
An optional check by AI, off by default and set by your organisation, sends the model only a short, cleaned extract (420 characters at most). Like any automatic filter, it can miss an unusual wording: it lowers the risk, it does not replace your own rules (the scope, which keeps chosen senders out of every workflow).
Your rights
You can access your data, have it corrected or erased, restrict its processing, receive it in a portable format, object to its processing (in particular for prospecting), withdraw your consent at any time, and give instructions on what happens to it after your death.
Write to contact@mankova-consulting.com. We answer within one month (three for a complex request) and may ask you to prove your identity if there is a reasonable doubt. If your request concerns data held in a customer’s instance, we pass it on to that customer, the controller, and help them answer.
If you think your rights are not respected, you can lodge a complaint with the CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.
Changes
This policy follows the service. A substantial change is announced on this site and, for customers, by email.
Last updated: October 18, 2026