1. Controller and contact
The controller is MATOUG Abdelaziz — nom commercial Arsenal Communication, whose business address is 113 Faubourg Lacapelle, 82000 Montauban, France. Questions and rights requests may be sent to contact@arsenal-communication.com or through the contact form. No data-protection officer is required at the present scale of processing.
2. Data collected
- account identity, email and authentication identifiers;
- professional status confirmation, terms version, consent timestamps and order evidence;
- membership status, Stripe customer, checkout and subscription identifiers, invoice status and renewal date, without L’Arsenal storing complete card details;
- support messages and information supplied voluntarily;
- Arsenal Assistant usage counters, aggregate token volumes and the text submitted during the current browser conversation;
- first-party audience events, visited page, session and pseudonymous visitor identifiers, source, campaign, device, browser and approximate country or city supplied by the hosting network, without storing the raw IP address;
- security and technical logs required to operate and protect the service.
3. Purposes and legal bases
- Contract: create the account, take payment, activate and administer membership, supply resources and support;
- Legal obligations: invoicing, accounting, evidence and responses to lawful requests;
- Legitimate interests: secure the service, prevent abuse, diagnose incidents, measure aggregate use and improve the professional offer;
- Consent: Google Analytics 4, if configured, and any non-essential measurement requiring consent.
4. Processors and recipients
Data is accessible only to the publisher and providers needed for the relevant operation: OpenAI Sites and Cloudflare for hosting and delivery, Supabase for authentication, Stripe for payments and billing, Resend for transactional email, OpenAI for Arsenal Assistant generation, and Google only if GA4 is configured and consented to. OVHcloud operates domain and professional-email services. Data is not sold or rented.
5. International transfers
Some providers may process data outside the European Economic Area. Where this occurs, transfers rely on an adequacy decision, the European Commission’s standard contractual clauses or another valid mechanism made available by the provider. The customer may request further information from L’Arsenal.
6. Arsenal Assistant
The user’s message, recent conversation and the relevant playbook context are sent to OpenAI’s API solely to generate the requested response. API response storage is disabled in the request. The visible conversation is kept in the current browser session; L’Arsenal records only the subject’s pseudonymous or account usage counter and aggregate token volumes. Users must not enter unnecessary personal, sensitive, confidential or legally protected information.
7. Retention
- active account and membership data: for the contractual relationship, then up to five years for evidence and dispute management;
- invoices and accounting documents: ten years from the end of the relevant financial year;
- terms acceptance and checkout evidence: five years from the order or end of the contract where required for evidence;
- support and prospect messages: while handled, then up to three years after the last substantive contact, unless a dispute requires longer retention;
- audience events and sessions: no more than twenty-five months;
- first-party visitor identifier: no more than thirteen months and not automatically extended;
- AI usage counters: current period plus up to twelve months for abuse prevention and cost reconciliation;
- security logs: ordinarily up to twelve months, unless an incident or legal obligation requires longer retention.
8. Rights
Subject to the applicable conditions, data subjects may request access, rectification, erasure, restriction and portability and may object to legitimate-interest processing. Consent can be withdrawn at any time without affecting earlier lawful processing. A request should identify the account concerned; proof of identity is requested only where reasonably necessary. A response is normally provided within one month. A complaint may be lodged with the CNIL at cnil.fr.
9. Audience measurement and storage
L’Arsenal’s first-party measurement is used exclusively by the publisher for aggregate audience, performance and conversion analysis. It does not store raw IP addresses, request GPS location, identify real-time visitors by name or follow them across websites. Country, region and city are approximate network-derived indicators. Administration routes, authenticated administrator accounts, technical calls, robots and automated checks are excluded. Do Not Track and Global Privacy Control are respected. Authentication, security and session storage are technically necessary. GA4 remains optional and is loaded only after explicit consent. Choices can be changed below at any time.
Manage my audience-measurement choices
10. Security and changes
Server-side authorisation, encrypted HTTPS transport, restricted administration, provider security controls and payment through Stripe protect the service. No system is absolutely secure. Material policy changes are dated and, where they affect the contract or user choices, notified through the service or by email.
Last updated 25 August 2026. The French version prevails if translations differ.