SimuChatThis English translation is provided for convenience. In case of any difference, the French version prevails.
1. Data controller
4iNTE, 22 allée des sarcelles — contact for any question or request about your data: contact@4inte.fr.
2. Data processed, purposes and legal bases
| Data | Why | Legal basis |
|---|---|---|
| Account: email, password (stored hashed, never in plain text), first name, gender (optional), sign-up and last activity dates, chosen language | Create and secure the account, personalise the simulations, send service emails (verification code, forgotten password) | Performance of the contract (art. 6.1.b GDPR) |
| Imported conversations, generated profiles, simulations, notes | Provide the Service: writing profiles and simulated replies | Performance of the contract |
| Messages and information of the Contacts present in these conversations (see article 3) | Write the contact’s writing profile and generate the simulated replies requested by the user | Legitimate interest (art. 6.1.f GDPR) of the user in having a simulation of their own exchanges, framed by the safeguards of article 3 and the Contact’s right to object |
| Credits and payments: balance, history of amounts, Stripe payment identifiers (never card numbers) | Sell credits, keep the accounts, handle refunds | Performance of the contract; legal obligation (accounting) |
| Proof of consent: acceptance of the Terms of Use/Terms of Sale, request for immediate access to credits (date, version, IP address) | Prove the agreement given | Legal obligation and legitimate interest (proof) |
| Security: IP address, technical log (logins, sign-ups, errors) | Limit login attempts and mass sign-ups, block disposable addresses, detect abuse | Legitimate interest (security of the Service and fraud prevention) |
No decision producing legal effects is taken solely on the basis of automated processing. No data is used for advertising or sold. The Service is reserved for adults: the Publisher does not knowingly collect data about minor users.
3. The people in your conversations
The conversations you import contain messages and information about other people (your “Contacts”), who do not necessarily use SimuChat. This data is processed only to provide your simulations, with the following safeguards:
- it is encrypted on the server and accessible only from your account;
- it is never published, cross-referenced with other accounts, or used for any other purpose;
- conversations and profiles written by the AI may contain sensitive information (health, love or sex life, beliefs, opinions) when it appears in the exchanges: it is used only to make the simulation faithful; passwords, codes, card or phone numbers and postal addresses are excluded from profiles;
- it is deleted as soon as you delete the contact or your account;
- minimisation: only the necessary exchanges are sent to the AI providers, as excerpts at the time of each reply; profiles only retain the way of writing and the elements useful for the simulation;
- simulating deceased people is prohibited by the Terms of Use.
Contacts’ right to object. Anyone can object to their messages being used to simulate them. The Terms of Use prohibit users from importing the conversations of a person who has objected, and require them to delete the contact at that person’s request. For a minor, the request may also be made by their legal representatives.
As it is impossible for the Publisher to inform each Contact individually, since it does not have their contact details (article 14.5.b GDPR), this policy is public. If you think your messages have been imported by a user, you can write to contact@4inte.fr: the Publisher will pass your deletion request on to the account concerned if it can identify it from the information provided. The Terms of Use require users to delete a contact at the request of the person concerned.
4. Recipients and processors
Your data is only accessible to the Publisher, for the needs of the Service, and to the following providers, each for its own task:
| Provider | Role and data | Location and safeguards |
|---|---|---|
| Host: Hostinger International Ltd. | Storage of the site and data | 61 Lordou Vironos Street Larnaca 6023 Cyprus |
| Anthropic PBC (Claude models) | Conversation excerpts, profile and notes sent with each simulated reply, suggestion, portrait or test | United States — European Commission standard contractual clauses (Anthropic's data processing agreement). Data not used to train the models; deleted within 30 days, except content flagged by its safety systems (up to 2 years). |
| Google LLC (Gemini models, paid tier) | Conversation of the free contact, sent once to write their profile | United States — EU–US Data Privacy Framework and standard contractual clauses. Data not used to train the models; kept 55 days for abuse detection. |
| Stripe Payments Europe | Payment: email, amount; bank details entered directly on Stripe | Ireland (EU); any transfers governed by Stripe (Data Privacy Framework, standard contractual clauses) |
| Email sending: o2switch | Email address, first name, content of service emails | Depending on the provider |
The Publisher may disclose data to the authorities when required by law.
5. Retention periods
- Account, conversations, profiles and simulations: as long as the account exists. Deleted immediately if you delete a contact or your account.
- Account whose address was never confirmed: deleted after 7 days.
- Inactive account (no login for 3 years) without credits: deleted, after a warning email sent one month beforehand. An account that still has credits is kept.
- Verification codes and “forgot password” links: 30 minutes and 1 hour.
- Technical log (IP addresses, logins): 12 months.
- Proof of consent: lifetime of the account, then 5 years (limitation period).
- Payment data and accounting records: 10 years (legal obligation), in the form of transaction identifiers; Stripe applies its own retention periods.
6. Security
Encrypted connection (HTTPS). Hashed passwords (bcrypt), protected session cookie, limited login attempts, verified email addresses, data encrypted on the server. Each account is isolated: a user cannot access another user's data.
7. Your rights
You have the right of access, rectification, erasure, restriction, objection (for processing based on legitimate interest), portability, and the right to set instructions for what happens to your data after your death.
- Directly in the Service: change your first name (⚙ Settings), download all your data (⚙ Settings → backup, JSON format), delete a contact, delete your account (⚙ Settings → “Delete my account”).
- By email: contact@4inte.fr, from your account's address. Answer within one month at most.
If you consider that your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr/fr/plaintes), or with the authority of your country of residence.
8. Cookies and local storage
The site only uses:
- a
simuchat_sessioncookie, required to stay logged in (duration: 60 days, or until you log out); - a
sc_langcookie, which remembers the language chosen in the menu (duration: 1 year); - browser local storage (
prefs) that remembers your display settings (automatic reply, delay), and never leaves your device.
These trackers are strictly necessary for the Service requested: they do not require your consent (article 82 of the French Data Protection Act). No advertising, social network or audience measurement cookies are used.
9. Changes
This policy may change. In the event of a significant change, the new version is shown to you the next time you log in.