Privacy Policy
Last updated: April 12, 2026
1. Data Controller Identity
The data controller for personal data collected on the IgnitionRAG platform is:
- Company: IgnitionAI (sole proprietorship)
- Founder: Salim Laimeche
- Address: Troyes, France
- Email: sa.laimeche@ignitionai.fr
- Website: ignitionai.fr / ignitionrag.com
2. Data Collected and Purposes
2.1 Account and Identification Data
- Data: name, email address, hashed password (via Clerk)
- Purpose: account creation, management, and authentication
- Legal basis: contract performance (Terms of Service)
2.2 Billing Data
- Data: payment information (processed exclusively by Stripe), subscription history
- Purpose: subscription and payment management
- Legal basis: contract performance, legal obligation (10-year accounting retention)
2.3 Uploaded Documents and Content
- Data: files (PDF, DOCX, CSV, etc.) and their content, associated vector embeddings
- Purpose: powering the user's RAG engine, service operation
- Legal basis: contract performance
2.4 Usage and Navigation Data
- Data: usage logs, RAG queries (anonymized), performance metrics, IP address
- Purpose: service improvement, abuse detection, technical support
- Legal basis: legitimate interest (service improvement, security)
2.5 Communications
- Data: email address for transactional emails (account confirmation, invoices, alerts)
- Purpose: service-related communication
- Legal basis: contract performance, legitimate interest
3. AI configuration by deployment
The SaaS offering provides platform-managed AI configuration: users do not need to supply an AI key. Licensed deployments may use configuration managed by their operator under their contract. Consult the processing and provider information applicable to the deployment you use.
4. Retention Periods
| Category | Duration | Justification |
|---|---|---|
| Account data | Contract duration + 3 years | Contractual limitation period |
| Billing data | 10 years | Accounting and tax obligation |
| Uploaded documents | SaaS: read-only retention after cancellation, with no automatic deletion in this release | Continued access; licensed contracts follow their own terms |
| Technical logs | 12 months | Security and support |
| Navigation data | Maximum 13 months | CNIL recommendation |
5. Sub-processors and Data Transfers
| Sub-processor | Role | Location | Safeguards |
|---|---|---|---|
| Clerk | Authentication and session management | USA (AWS us-east-1) | EU–US SCCs, SOC 2 Type II |
| Stripe | Payment processing | USA / EU | SCCs, PCI DSS Level 1 |
| Resend | Transactional emails | USA (AWS) | EU–US SCCs |
| OVH / Cloud | Infrastructure hosting (DB, servers) | France 🇫🇷 | Servers in France |
Transfers outside the EU: For sub-processors based in the United States, Standard Contractual Clauses (SCCs) approved by the European Commission are in place, in accordance with GDPR Art. 46.
6. Your Rights (GDPR)
Under Regulation (EU) 2016/679 (GDPR), you have the following rights:
- Right of access (Art. 15): obtain confirmation of processing and a copy of your data
- Right to rectification (Art. 16): have inaccurate data corrected
- Right to erasure (Art. 17): request deletion of your data ("right to be forgotten")
- Right to restriction (Art. 18): temporarily restrict processing
- Right to portability (Art. 20): receive your data in a structured, machine-readable format
- Right to object (Art. 21): object to processing based on legitimate interest
- Withdrawal of consent: at any time, without affecting the lawfulness of prior processing
To exercise these rights, contact us at: sa.laimeche@ignitionai.fr. We will respond within 30 days (GDPR Art. 12).
You also have the right to lodge a complaint with the CNIL (French data protection authority): cnil.fr.
7. Data Protection Contact
Given the size of the organization, IgnitionAI is not required to formally appoint a DPO. The contact point for any data protection questions is:
- Contact: Salim Laimeche
- Email: sa.laimeche@ignitionai.fr
8. Cookies and Trackers
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
__session (Clerk) | Functional | Maintaining authenticated session | Session |
__clerk_db_jwt | Functional | Clerk authentication | 7 days |
locale | Functional | Language preference | 1 year |
ignition:analytics-consent (local storage) | Preference | Stores the audience measurement choice | Until withdrawal or browser storage is cleared |
ignition:analytics-visitor (local storage) | Audience measurement | Pseudonymous browser identifier created after consent | Until consent is withdrawn or browser storage is cleared |
ignition:analytics-session (session storage) | Audience measurement | Pseudonymous session identifier created after consent | For the session or until consent is withdrawn |
ignition:landing-funnel-attribution (app local storage) | Audience measurement | Pseudonymous id handed off from the landing after consent, to measure signup and first agent creation | Up to 90 days; can be removed in the app |
Strictly necessary cookies do not require consent (Art. 5§3 ePrivacy Directive). No advertising or third-party tracking cookies are used. Performance and conversion measurements are sent only after explicit consent. They contain the page, event name, date, pseudonymous identifiers and technical metadata, without form content or a retained IP address. Server-side events are deleted after no more than 90 days. The persistent “Audience preferences” button lets you change or withdraw that choice. The app also provides a “Stop signup measurement” button to remove its first-party attribution id.
9. Security
- Data in transit encrypted (TLS 1.3)
- Sensitive data encrypted at rest (AES-256-GCM)
- Strong authentication via Clerk (2FA available)
- Multi-tenant data isolation per organization
- Production data access restricted to authorized personnel
- Regular database backups
10. Policy Updates
This policy may be updated. For substantial changes, you will be notified by email at least 30 days before the changes take effect. Continued use of the service after that date constitutes acceptance.