Privacy and cookie policy

Last updated: October 10, 2026

This is a convenience translation; the French version (Politique de confidentialité) prevails. It meets Articles 13 and 14 of the GDPR.

1. Controller

Sole proprietorship “Baptiste Belleville (XTablo)”, Baptiste Jules Enzo Belleville, SIREN 939 327 664, 71 chemin de Bessonnet, Vieugy, 74600 Annecy, France. Contact: baptiste@xtablo.com. No DPO appointed [to be confirmed].

2. Two situations

• Website visitors, prospects and XTablo customers (agencies): we are the controller.
• Agencies’ clients invited to a portal, and content uploaded to a workspace: the agency is the controller; XTablo acts as its processor. Please contact the agency first to exercise your rights.

3. What we collect and why

• Account: name, email, agency name, hashed password, portal settings – to provide the service (contract) – kept for the contract term, then [30] days.
• Billing: billing details and payment history (card data handled by Stripe) – contract and legal obligation – invoices kept 10 years.
• Technical logs: IP address, device, timestamps – security (legitimate interest) – [12 months].
• Demo from a website: website address, its public content, generated project – to answer your demo request (legitimate interest) – deleted after 7 days if not converted.
• “Not ready?”: email address – used only to send one email with your demo resume link (valid 7 days) – [deleted after 7 days].
• Contact, booking, chat: name, email, phone, message – pre-contractual steps – 3 years after last contact.
• B2B email prospecting: business email – legitimate interest, opt-out anytime – 3 years after last contact.
• Analytics (PostHog): pages, usage, device – consent (anonymous cookieless counting without it) – [13 months max].
• Meta advertising (website and app): cookie ID, pages, events (sign-up, trial, subscription), email in hashed form on sign-up – consent only, sent from your browser or our servers only after you accept – 13 months max. Your choice (cookie « xt_consent ») covers the website and the app and is kept 6 months.

No automated decision-making with legal effect. We do not sell your data.

Data from tools connected in the “Reporting” app is described in section 5.

4. AI

When you request a demo from your website address, the public content of that site is sent to Anthropic (Claude) to generate a sample project.

5. Connected tools (“Reporting” app)

The “Reporting” app lets an agency connect its client’s tools to show figures in the client portal.

Who is responsible

For this data, the agency is the controller. XTablo acts as its processor, on its instructions (see section 2). The agency chooses which tools to connect and must have its client’s permission to do so.

Google Analytics 4 and Google Search Console

• Connection: the agency signs in with a Google account (OAuth). We only request read-only access:
  • https://www.googleapis.com/auth/analytics.readonly (Google Analytics);
  • https://www.googleapis.com/auth/webmasters.readonly (Google Search Console).
• Data we read: daily aggregated statistics, only for the property or site the agency selects:
  • Google Analytics: active users, sessions, page views, top pages;
  • Google Search Console: clicks, impressions, average position, top queries.
• No individual data: we do not read any personal data about the site’s visitors (no identifiers, no IP addresses, no individual journeys).
• Why: to show these figures in the client portal report. Nothing else.
• Storage: aggregated figures are stored in the XTablo database (see providers in section 6). The Google refresh token is encrypted (AES-256-GCM).
• Frequency: figures are refreshed every 6 hours.
• Disconnecting: the agency can disconnect Google at any time from the Reporting app. The token is then deleted. Figures already imported stay in the report until the agency deletes them. Access can also be revoked at any time at https://myaccount.google.com/permissions.

Gmail (sending from the agency’s address)

Set up in Settings, not in the Reporting app. For these e-mails, the agency is the controller and XTablo acts as its processor.

• Connection: a member of the agency signs in with a Google account (OAuth). We only request https://www.googleapis.com/auth/gmail.send: permission to send e-mails.
• What we do: send the e-mails the agency writes or approves in XTablo (for example a message to a client, or a test e-mail), from the agency’s own Gmail address. XTablo never sends an e-mail without a click from the agency.
• What we never do: we cannot read, search, change or delete the agency’s mailbox, and we do not ask for that access.
• Storage: the Google refresh token is encrypted (AES-256-GCM). The e-mails sent are kept in XTablo as part of the project history.
• Disconnecting: the agency can disconnect Gmail at any time in Settings. The token is then deleted. Access can also be revoked at https://myaccount.google.com/permissions.

Google Calendar

Set up in Settings, by each member for their own calendar.

• Connection: the member signs in with a Google account (OAuth). We only request read-only access: https://www.googleapis.com/auth/calendar.events.readonly.
• Data we read: the events of the member’s calendars, from yesterday to 14 days ahead: title, start and end time, all-day flag, guests’ e-mail addresses, video meeting link. Refreshed every 15 minutes.
• Why: to show the member’s meetings in the XTablo calendar and today’s calls in « Your day », where XTablo’s AI assistant (Anthropic Claude, see section 4) uses them to prepare the member’s day. We never create, change or delete an event.
• Storage: the events of that window are stored in the XTablo database; the Google refresh token is encrypted (AES-256-GCM).
• Disconnecting: the member can disconnect Google Calendar at any time in Settings. The token and the stored events are then deleted. Access can also be revoked at https://myaccount.google.com/permissions.

Google Limited Use disclosure. XTablo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, for data received from Google:

• we do not sell it;
• we do not use it for advertising;
• we do not use it to train general-purpose artificial intelligence models;
• no XTablo staff member reads it, except with the agency’s permission (for support), for security purposes (investigating abuse or a vulnerability), or to comply with the law.

Shopify, WooCommerce and Breakcold

• Connection: the agency pastes a read-only API key:
  • Shopify: Admin API, read orders and products;
  • WooCommerce: read-only REST key;
  • Breakcold: read contacts.
• Data we keep: aggregated figures only (for example a number of orders or revenue over a period). We do not keep individual customer or contact records.
• Security: keys are encrypted.
• Disconnecting: the agency can remove a key at any time from the Reporting app. We also recommend revoking it in the tool itself.

Instagram

When this connection is offered, the agency will be able to connect an Instagram professional account. We will only read that account’s statistics, under the same terms: aggregated figures, encrypted token, disconnection at any time.

Reading a website’s home page

To suggest a logo, colors and tools to connect, XTablo may read the public home page of the website the agency provides. Only that public page is read.

Retention

Imported figures are kept until the agency deletes them, and at most for the contract term, then [30] days [to be confirmed]. Tokens and keys are deleted as soon as the tool is disconnected.

6. Recipients and sub-processors

Cloudflare, Inc. (website hosting, CDN – 101 Townsend St, San Francisco, CA 94107, USA); Render Services, Inc. (application hosting – 525 Brannan St, Suite 300, San Francisco, CA 94107, USA – servers in Frankfurt, Germany, EU); Neon (database – servers in London, United Kingdom); Stripe (payment); Resend (emails); PostHog (analytics); Meta (advertising, after consent); Anthropic (demo generation); Cal.com (booking); Heyo (chat, US site); WhatsApp (contact, FR site). [Legal entities, addresses and data locations – to be completed.]

7. Transfers outside the EU

Transfers to the US rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses. [To be verified for each provider.]

8. Your rights

Access, rectification, erasure, restriction, portability, objection (including to marketing, at any time), withdrawal of consent, and post-mortem instructions. Write to baptiste@xtablo.com; we answer within one month. You may lodge a complaint with the CNIL (www.cnil.fr).

9. Cookies

• Strictly necessary (no consent): application session cookies, [consent choice cookie, Cloudflare security cookies – to be confirmed].
• Consent-based: Meta pixel, set only if you click “Accept”. PostHog: without your OK, visits are counted with no cookie, no profile and no recording; if you click “Accept”, PostHog sets a cookie on xtablo.com (13 months max), records your browsing (input fields masked), keeps the email you give us on your profile and links it to your account if you sign up. Third-party tools (Cal.com, Heyo, WhatsApp) may set their own cookies when used.

“Accept” and “Refuse” are equally easy; refusing does not block the site. You can change your choice at any time [via a “Manage cookies” link – to be confirmed].

10. Changes

The date above shows the latest version. Material changes will be notified.

Last updated: October 9, 2026