Privacy and legal notice

Site publisher

The altyxo.com website and the Altyxo service are published by QWEB, société par actions simplifiée with a share capital of 20 000 €, registered office at 4 rue de la Roche, 26600 Pont-de-l'Isère, company number 902 455 971 00025 (RCS 902 455 971), VAT number FR52 902 455 971.

Publication director: Bill PELIN. Contact: info@qweb.fr.

The application and its database run on servers rented from Amazon Web Services, 31 place des Corolles, 92400 Courbevoie, France, located in France. QWEB operates and administers these servers itself; Amazon Web Services provides the underlying physical infrastructure.

Our two roles

Altyxo is a management tool that merchants connect to their own PrestaShop store. This puts us in two distinct situations, worth separating clearly.

For data collected on this site — a demo request, an account signup — we are the data controller: we decide why and how it is used.

For data coming from a merchant's store — their products, orders and customers — we are a data processor: the merchant remains responsible for that data, and we process it only to provide the service they asked for, on their instructions.

What we collect

We only collect what the service actually needs.

• Demo request: first name, last name, email address, phone number and your store address. This is sent to us by email and is not kept in our database.
• User account: first name, last name, email address, role within the organisation, and password (stored hashed, never in clear text).
• Your store data: products, stock, orders, customers and addresses, read from your PrestaShop store at your request so we can display them and let you work on them.
• Chatbot, if you enable it on your store: the first name and email address a visitor enters before chatting, and the conversation itself.
• Cookie banner, if you enable it: proof of your visitors' choice — decision, accepted purposes, date, fingerprint of the text shown. This proof contains no IP address.
• Activity log: who did what in your workspace, so you can check it.

Why, and on what legal basis

Answering a demo request and getting back to you: our legitimate interest in handling a commercial enquiry you sent us.

Providing the service, managing your account and subscription: performance of our contract.

Keeping the service secure — rate limiting, activity log, backups: our legitimate interest in protecting the service and its users.

Meeting our accounting and legal obligations.

How long we keep it

• Demo request: for the duration of the exchange, and at most three years after the last contact.
• Account and store data: for the duration of your subscription. Data is deleted when the account is closed.
• Chatbot conversations: 90 days after the last activity, automatically.
• Support requests raised through the chatbot: one year.
• Cookie consent proofs: as long as needed to produce them in case of an audit.
• Accounting records: the statutory retention period.

Who else has access

We do not sell any data and do not use it for advertising. It is never used to train an artificial intelligence model.

We rely on a deliberately small number of providers: our host, located in France, and a transactional email service established in the United States, which only ever receives the recipient's address and the message body. That transfer is covered by the European Commission's standard contractual clauses.

When you enable an artificial intelligence feature, you connect your own account with the provider of your choice: your account, your contract, your bill. We hold no shared key, and requests never pass through an Altyxo account.

When you connect your store to a marketplace, the information you choose to publish there is sent to that platform under its own terms.

How we protect it

The credentials and access tokens you entrust to us — your store's API key, marketplace authorisations — are encrypted before being stored, with a key held outside the server's public directory.

Each organisation is isolated from the others at the database engine level: a query cannot reach another merchant's data, even in the event of a programming mistake.

Traffic to the site and the application is encrypted (HTTPS). The codebase undergoes regular security reviews, and a backup is taken before every update.

Cookies

This site sets no analytics or advertising cookies. The only cookies used keep you signed in to your workspace and protect forms: they are strictly necessary to operate the service and do not require consent.

The consent banner Altyxo offers is a module for our customers' own stores; it concerns their visitors, not this site.

Your rights

You have the right to access, rectify, erase and port your data, as well as to object to and restrict processing. You can exercise these rights by writing to info@qweb.fr. We reply within one month.

If data about you was collected by a store using Altyxo, please contact that store first: they are the controller. We assist them in answering your request.

You may also lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris — www.cnil.fr.

In case of an incident

In the event of a personal data breach, we notify the merchants concerned and, where required by law, the CNIL, within 72 hours of becoming aware of it.

Intellectual property

All content on this site — text, illustrations, code — is the property of QWEB unless stated otherwise. Reproduction without permission is prohibited.

Changes

This page is updated whenever our processing changes, and at least once a year. The date of the last update appears at the top of the page.