Privacy policy

Version of 1 November 2026. In case of discrepancy, the French version prevails.

1. Data controller

Bruno Gavand E.I., sole proprietor trading as BG CONSEILS, 26 Chemin de la Forestière, 69130 Écully, France — contact@dudyweb.com (see the legal notice).

2. Data collected

Account: name, email address, organization, password (stored only as an irreversible hash), role, language, time zone, date of last login.
Members and invitations: accounts the person belongs to and their role in each, projects open to them, date of joining, number of logins; email address, role and projects of a pending invitation; for contributors and readers, a second irreversible hash of the password, used for their access to the previews.
Use of the service: conversations with the assistant, requests and their reports, files sent (images, PDF, voice messages), project content, usage, credits, caps, emails sent by the service.
Messenger (if the client uses it): Messenger identifier linked to the project, messages and attachments.
Phone (if the client uses it): linked phone number, irreversible hash of the personal code, call log (date, project, number of requests); requests are transcribed and kept as text in the console history; no recording of the call is kept.
Email assistant (if the client uses it): linked addresses and their verification date; messages received at and sent by dudemaster@dudyweb.com (headers, text, attachments, result of the sender authentication checks); requests are kept as text in the console history.
Security: IP address and attempts (login, signup, contact form) to limit abuse; log of sensitive actions.
Card payment: amount, date, status and references of the payment at Stripe, name and country entered on the payment page; card details are entered at Stripe and never received or stored by Bruno Gavand E.I.
Contact form: name, email address and message, sent by email to the DudyWeb.com team; only a trace (name, address, subject) is kept in the security log.

3. Purposes and legal bases

Providing the service and billing it (performance of the contract); security of the service and prevention of abuse (legitimate interest); accounting and tax obligations (legal obligation); answering contact requests (pre-contractual steps or legitimate interest). No data is sold, nor used for advertising.

4. Recipients and processors

Data is processed by Bruno Gavand E.I. on its server, and by the following processors only for what concerns them:

OVH SAS (France): hosting of the server. data center in Germany (Frankfurt); phone line of the assistant.
Anthropic (United States): artificial intelligence (Claude) that carries out the changes and answers questions about the site — requests and site content.
OpenAI (United States): conversational assistant, transcription of voice messages and of phone requests, voice of the answers — messages and voice recordings.
Google (United States): speech synthesis of voice replies — text of the reply.
LWS (Ligne Web Services, France): mailboxes of DudyWeb.com, including the email assistant's — messages received and sent.
Meta Platforms (Ireland / United States): Messenger, for clients who use it.
Stripe (Stripe Payments Europe, Ireland): card payment of dudies packs — email address, amount and card details, entered directly with Stripe and never received by Bruno Gavand E.I.

Transfers outside the European Union rely on the EU–US Data Privacy Framework for the certified companies, supplemented by the standard contractual clauses of the European Commission included in their contracts.

5. Retention periods

Account: as long as it is open; deleted after 3 years without login, after a warning email.
Project data (site, conversations, files, form data of the preview): until the project is deleted, which erases them immediately.
Invitations: 7 days at most (erased when accepted or cancelled); membership of an account: until the member is removed or the account is closed.
Credits, charges and payments: 10 years (accounting obligations).
Login sessions: 14 days; login and contact attempts: 24 hours; security log: 1 year.
Email assistant: full messages (raw message, text, attachments) 30 days; afterwards only a log line is kept (date, addresses, subject, decision), 1 year at most.
Conversations of the assistant (conversation memory): as long as the project exists; the RESET command starts a new, blank conversation, and deleting the project erases them.

6. Cookies and local storage

The site places no advertising or audience measurement tracker. It uses only:

dudyweb_session: login to the client area (14 days);
dudyweb_formulaire: protection of forms against robots (browser session);
dudyweb_langue: language chosen (1 year);
on project previews, the browser's local storage keeps the position of the assistant window, the language and the time zone.

These cookies are necessary for the service or keep a choice made by the user: they do not require consent.

7. Data of the visitors of clients' sites

For the forms and programs of their site, the client is the data controller; Bruno Gavand E.I. acts as processor on the preview (see the terms of use).

8. Security

Encrypted connections (HTTPS), hashed passwords and tokens, separation of projects on the server, access restricted to the persons concerned.

Your own servers (VPS) registered in your account: the SSH key of each server and the publication key of each project are created and kept by the portal (readable by it only), never displayed or passed to the sites' programs or to the assistant; the portal connects only to the servers you registered, after you have confirmed their fingerprint, and runs only its own versioned scripts there. When a site is removed from a server, its files and database are archived on that server for 30 days, then deleted.

9. Your rights

You have the right to access, rectify and erase your data, to restrict and object to its processing, and to data portability (download of your site with LIVRER, export of the history). To exercise them: contact@dudyweb.com. You can also lodge a complaint with the CNIL (cnil.fr).