Privacy policy
Last updated 26 July 2026. Written to be read, not to protect us.
Who processes your data
Heurix is operated by Alexis Flahaut, sole trader, 22 rue Mélingue, 75019 Paris, France — SIRET 107 681 900 00018. For any question about your data: contact@heurix.fr.
There is no data protection officer: the business does not meet the thresholds requiring one. Your requests reach one person, who answers them personally.
Two distinct situations, not to be confused
When you use Heurix as a customer, we are the data controller for your account: your email address, company name, billing details, and how you use the console.
When your visitors search your catalogue, we are a processor acting on your behalf. Their search queries pass through our engine, and you remain the controller. This distinction matters: it determines who answers if one of your visitors exercises their rights.
What we process, and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email, password (hashed), company name | Your account and sign-in | Performance of the contract | Until you close your account |
| Product catalogues you index | Serving search results | Performance of the contract | Until you delete them |
| Search queries from your visitors | Your analytics: top terms, zero-result searches | Processing on your behalf | 90 days |
| Error logs | Diagnosis and security | Legitimate interest | 365 days |
| Billing details | Invoicing and legal accounting obligations | Legal obligation | 10 years |
What we do not do
We do not sell your data. We do not share it for advertising purposes. We do not mine your catalogues for anything other than serving you. Your data is not used to improve the service for other customers.
The showcase site drops no tracker before your explicit consent — see the “Trackers and cookies” section below.
Something you should be aware of
Your visitors' search queries are recorded so we can show you your analytics. Most of the time these are product names. But a search box is a free-text field: a visitor may type an email address, a phone number, anything.
We do not filter this content — we cannot reliably tell a product reference from personal data. It is therefore your responsibility, on your own site, to inform your visitors that their queries are recorded, and to collect any consent required. Heurix cannot do this on your behalf, because we never see your visitors.
Who else is involved
| Provider | Role | Location |
|---|---|---|
| OVHcloud | Server hosting | France (Gravelines) |
| Stripe | Payment processing | Ireland / United States |
| Brevo | Transactional email | France |
| GitHub Pages | Hosting of this site | United States |
Transfers to the United States (Stripe, GitHub) rely on the European Commission's standard contractual clauses.
Trackers and cookies
We distinguish three categories. Only the first works without your agreement, because it is essential to the service you are asking for.
| Name | Purpose | Duration | Consent |
|---|---|---|---|
heurix_session |
Keeps you signed in to the client area | Session | Not required — strictly necessary |
heurix_catalogue_actif, heurix_env_explique, heurix_org_hint_vu, heurix_tuto_editeur_vu |
Remember your display preferences in the console and which help messages you have already seen | Until your browser clears them | Not required — preferences of a signed-in user |
heurix_consentement |
Stores your choice on this matter, so we do not ask again | 6 months | Not required — it stores your refusal precisely |
| Google Tag Manager (GTM-PGLPLKDP) | Traffic measurement and, where applicable, campaign performance | Depends on the tags enabled in the container | Required — loads only after your agreement |
What we fixed. Until 26 July 2026, Google Tag Manager loaded as soon as you arrived on the site, without prior consent, and this page wrongly stated that no traffic-measurement tracker was used. That is no longer the case: no non-essential tracker loads before your explicit choice. We mention it because a privacy policy that hides its past corrections is not worth much.
Refusing has no consequence. The site and the client area work exactly the same. You can change your mind at any time through the “Manage cookies” link at the bottom of every page.
Two external libraries are loaded from cdnjs.cloudflare.com to render charts and generate PDF exports in your console. They set no trackers, but loading them exposes your IP address to Cloudflare, as any request to a third-party server does.
Your rights
You may request access to your data, correct it, have it erased, obtain it in a portable format, or object to its processing. Write to contact@heurix.fr; we answer within one month.
Erasure has one limit: invoices must be kept for ten years under accounting law. We can delete your account and catalogues, not your invoices.
Security
Traffic is encrypted in transit (TLS). Passwords are hashed, never stored in plain text. API keys are compared in constant time. Databases are backed up daily with integrity verification. Sign-in is rate-limited against brute-force attempts.
We state what is in place, not what is planned.
Complaints
If our answer does not satisfy you, you may lodge a complaint with the CNIL, the French data protection authority — cnil.fr — or with the supervisory authority of your own country of residence.
Changes
Any substantial change is announced by email to account holders. Minor updates are reflected in the date at the top of this page.