1. Data controller

The controller responsible for processing personal data collected via ConcordIA can be reached at dpo@concord-ia.net.

2. Data collected

• Account data: email address, and authentication data (managed by our infrastructure provider, Supabase).
• Case data: the facts, exchanges, documents, and information that you and the other parties enter as part of an Action (dispute) on ConcordIA.
• Human-validation request form: name, email address, phone number (optional), company (optional), and message (optional), when you request that your case be reviewed by a legal professional.
• Technical data: connection logs necessary for the proper functioning and security of the service.

3. Purposes of processing

• Providing the AI-assisted dispute-resolution service;
• Enabling authentication and management of your account;
• Handling human-validation requests, including contacting you back by email;
• Ensuring security and preventing fraudulent use of the service.

4. Legal basis

Processing is based on the performance of the contract binding you to ConcordIA (provision of the requested service) and, for the human-validation request, on your explicit consent given when submitting the form.

5. Retention period

Case data is retained for the duration of its active use, then for a reasonable period necessary for the purposes pursued, unless a longer legal retention obligation applies. You may delete your case and its associated data at any time from the Settings page.

6. Recipients of data

Your data is processed by ConcordIA and by the following technical subprocessors:

• Supabase Inc., database hosting and authentication;
• Vercel Inc., application hosting;
• Resend, sending emails related to your case (e.g. human-validation request notification);
• Groq Inc., provider of the AI model used to generate ConcordIA's rephrasing and opinions (processing of your exchanges' content necessary for this generation).

7. Your rights

In accordance with the GDPR, you have a right of access, rectification, erasure, restriction, and objection with respect to your data, as well as the right to lodge a complaint with the CNIL (cnil.fr). To exercise these rights, contact us at dpo@concord-ia.net.

8. Cookies and trackers

ConcordIA sets cookies that are strictly necessary for the service to function (authentication, session), which do not require consent. Audience-measurement and marketing cookies are only set after your explicit, category-by-category agreement, and you may change or withdraw this choice at any time via the "Manage cookies" link in the footer.

9. Security

ConcordIA implements reasonable technical and organizational measures (access control, case isolation through the database's security rules) to protect your data against unauthorized access.

10. Contact

For any question about this policy: dpo@concord-ia.net