Privacy Policy

Last updated: October 15, 2026

1. Data controller

This website and the CPX AI Platform are operated by CPX CONSULTING, a limited liability company registered with the Nancy Trade and Companies Register under number 849 906 979.

The publisher's full contact details are provided in the website's Legal Notice.

For any question relating to the protection of personal data, you may contact CPX CONSULTING using the contact details provided in the Legal Notice.

2. Data collected

In connection with the use of the website and the CPX AI Platform, we may collect the following categories of data:

• identity (first name, last name);
• professional contact details (email, phone, company);
• login information;
• IP address and technical logs;
• billing data;
• information relating to subscriptions taken out;
• content submitted to the platform;
• support tickets and exchanges with our teams;
• access tokens for the third-party services you connect, stored on a server with restricted access revoked when you disconnect the service and deleted on request;
• platform usage data.

3. Purposes of processing

Data is processed in order to:

• create and manage client accounts;
• perform contracts and subscriptions;
• ensure billing and payment tracking;
• provide the artificial intelligence services offered;
• manage support requests;
• ensure the security of the platform;
• produce usage statistics;
• comply with our legal and regulatory obligations.

4. Legal bases

Processing is based on:

• the performance of a contract;
• compliance with legal obligations;
• CPX CONSULTING's legitimate interest;
• consent, where required.

5. Data recipients

Data may be transmitted to service providers involved in operating the service, in particular:

• Stripe (payment);
• Brevo (transactional emails, text messages and notifications);
• Anthropic (artificial intelligence services);
• HeyGen (video generation, when the module is used);
• LinkedIn (publishing to your LinkedIn Page, when you connect it and approve a post);
• OVHcloud (hosting);
• Qdrant (document indexing).

These service providers only access data to the extent necessary for the performance of their services.

6. Data retention

Data is retained for the period necessary to perform the contract and comply with legal obligations.

Billing data may be retained for up to ten years in accordance with applicable regulations.

Technical and security logs are retained for a period appropriate to security and audit needs.

7. International transfers

Some subcontractors may be located outside the European Union.

Where necessary, transfers are governed by the mechanisms provided for by the GDPR, in particular the European Commission's standard contractual clauses.

8. Security

CPX CONSULTING implements technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, or disclosure.

9. Your rights

In accordance with the GDPR, you have the following rights:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction;
• right to object;
• right to portability;
• right to withdraw your consent where it constitutes the basis of the processing.

You may exercise these rights by contacting CPX CONSULTING.

10. Complaint

You have the right to lodge a complaint with the CNIL (www.cnil.fr) if you believe that your rights are not being respected.

11. Amendment of this policy

CPX CONSULTING reserves the right to amend this policy to take into account legal, regulatory, or technical developments.

12. Data obtained through Google APIs (Gmail and YouTube)

CPX CONSULTING uses Google APIs to automate certain operations on its own behalf: sending and reading messages through Gmail, and publishing and managing videos through YouTube. This access is granted by the holder of the Google account concerned, who may revoke it at any time at myaccount.google.com/permissions.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. This data is never sold, never used for advertising purposes and never disclosed to third parties, except where necessary to operate the service, to comply with a legal obligation or for security purposes.

Google data is retained only for as long as the relevant operation requires. Access tokens are stored on a server controlled by CPX CONSULTING with restricted access. Revoking the authorisation in the Google account immediately terminates all access; any retained Google data may be deleted upon request to CPX CONSULTING.

13. Data obtained through TikTok APIs

CPX CONSULTING uses the TikTok for Developers APIs to publish videos to its own TikTok account and to track their publication status. This access is granted by the holder of the TikTok account concerned, who may revoke it at any time from the TikTok settings, under Manage app permissions.

The data processed for this purpose is limited to the account identifier, the access and refresh tokens, and the metadata of published videos (title, publication status). CPX CONSULTING collects neither the videos themselves, nor data about other TikTok users, nor any personally identifiable audience data.

This data is never sold, never used for advertising purposes and never disclosed to third parties, except where necessary to operate the service, to comply with a legal obligation or for security purposes. Tokens are stored on a server controlled by CPX CONSULTING with restricted access and retained only for as long as publication requires; revoking the authorisation in the TikTok account immediately terminates all access. TikTok's own processing of personal data is governed by the TikTok privacy policy.

14. Data obtained through Meta platforms (Facebook and Instagram)

At the client's request, CPX CONSULTING may connect to Meta services on the client's behalf in order to publish the content approved by the client on the Facebook Pages and Instagram professional accounts the client has selected and, where the subscribed service provides for it, to track the statistics associated with those publications.

The connection to Meta services is made with the client's authorization. The client selects the Pages and accounts concerned and may revoke this authorization at any time from their Meta account settings. For Instagram, only the features and professional accounts eligible for the programming interfaces used by CPX CONSULTING are concerned.

In this context, CPX CONSULTING may process, in particular, the technical identifiers of the Pages and accounts concerned, the access tokens required for the integration to work, the content prepared or published on the client's behalf, and the data or statistics required for the subscribed service to work.

Where the subscribed service includes the inbox, CPX CONSULTING may also read, on the client's behalf, the comments posted by third parties under the publications distributed by the service on the client's pages and accounts, for the sole purpose of displaying them to the client in their space. Only the text of the comment, its date and the public username of its author are kept; no user identifier and no profile picture are kept. These comments are read without ever being modified or deleted on the platform, are visible only to the client concerned, are kept for no more than 90 days from their publication date and then deleted automatically, and a comment deleted on the platform is removed at the next collection. This comment data is not transmitted to any artificial intelligence service as part of this feature.

When the client enables comment replies, CPX CONSULTING may, on the client's behalf, detect public comments on the client's pages and accounts that contain a keyword chosen by the client, reply to their author with a single private message whose text is set by the client, and record that author as a contact in the client's customer relationship management (CRM) space. For this feature only, the following are kept: the identifier assigned by Meta to the author for the page or account concerned, their public name, the text of the comment, its date and the post concerned, in order to send the reply, avoid any duplicate message and link the contact to the original post. Only one private message is sent per comment, and no other automatic message is sent to the person unless they reply. Neither the comment nor the message is sent to an artificial intelligence service. The person concerned may object to this processing at any time by contacting the client or CPX CONSULTING; no further automatic message is then sent to them. Detection data is kept for no more than twelve months and then deleted automatically; the contact recorded in the client's space follows the client's own retention rules.

CPX CONSULTING does not seek or deliberately collect personal data of Facebook or Instagram users that is not necessary for the service to work. Data received from Meta is used only for the purposes described in this policy and to perform the service requested by the client.

Where CPX CONSULTING acts on the client's behalf, the client remains responsible for determining the purposes of, and the instructions for, the processing of the data concerned. CPX CONSULTING then acts as a processor within the meaning of the GDPR, within the limits set by the contract and, where applicable, by the applicable data processing agreement.

Data obtained from Meta platforms is not sold, not used for CPX CONSULTING's own advertising purposes, and not used for any other client. It is not disclosed to third parties, except where necessary to perform the service, for the involvement of authorized processors, to comply with a legal obligation, or for the security of the service.

Access tokens are protected by appropriate security measures and kept only for as long as necessary for the integration to work, subject to legal obligations or legitimate security and evidence requirements.

Revoking the Meta authorization ends CPX CONSULTING's future access to the Pages and accounts concerned. Data already held by CPX CONSULTING is then handled in accordance with the applicable retention and deletion rules.

The client or any data subject may request the deletion of the personal data obtained by CPX CONSULTING through the Meta integration by sending a request entitled "Meta data deletion" to the contact details given in the Legal Notice. Deletion requests are handled in accordance with the GDPR, applicable legal obligations and the requirements of Meta platform policies. Data processing carried out directly by Meta is governed by Meta's privacy policy and the terms applicable to Meta services.

15. Text messages (SMS)

When you tick the dedicated box on the demo request form or on the AI Diagnostic, CPX CONSULTING may send you marketing information by text message (offers, invitations, follow-up on your request). This box is optional and is never ticked by default. In the course of an ongoing business relationship, service text messages may also be sent to you (appointment reminders, a link to sign a quote).

Marketing text messages are based on your consent; service text messages are based on the performance of the contract or of pre-contractual steps taken at your request. Text messages are delivered by our service provider Brevo.

You may withdraw your consent at any time by following the STOP instruction included in every marketing text message, or by writing to support@cpx-consulting.com. Your objection is then recorded so that no further marketing text messages are sent to you.

Proof of your consent (accepted wording, date, page and IP address) is kept for three years from your last contact with CPX CONSULTING. The phone number held in the sending log is erased after twelve months. The objection list is kept for as long as necessary to respect your refusal.

16. AI phone agent (Receptionist AI)

When a client company activates Receptionist AI, calls received on its line may be handled by a conversational agent speaking with the cloned voice of one of its staff members. The agent always announces, at the start of the call, that it is an artificial intelligence assistant. For calls from its correspondents, the client company is the data controller and CPX CONSULTING acts as a processor.

• Twilio (phone call routing);
• Deepgram (speech recognition, processed in the European Union);
• ElevenLabs (synthesis of the cloned voice);
• Anthropic (language model that formulates the answers).

Data processed: caller's number, date, duration and routing of the call; the conversation is transcribed in real time in order to be understood, but no transcript and no audio recording of the call is kept. The cloned voice is created only with the recorded consent of the person whose voice it is, after verification by CPX CONSULTING; its samples and the recording of the consent are deleted as soon as the voice is created or the request is refused. The providers above take part in this service, some of them outside the European Union under the framework described in section 7.

Retention periods: the caller's number is erased after twelve months; the technical details of a call after 90 days; the cloned voice is deleted from the provider as soon as the client company revokes it, at any time from its client area, or when its account is erased. The person whose voice was cloned may request its deletion at support@cpx-consulting.com.