Privacy policy

This page is a translation; the French version is authoritative.

Version of 19 October 2026.

Data controller

Ghislain Levrat, sole trader, SIREN 999 243 322, 48 rue Centrale, 69960 Corbas. Contact: contact@escouade.io.

This page covers the escouade.io website, the Escouade account (compte.escouade.io), the billing of the Escouade family and the Escouade mobile app: for this processing, the publisher is the data controller. What an organisation puts into Escouade online is processed on its behalf, the publisher acting as a processor: the data processing agreement and the list of subprocessors apply to it.

Your demo request

The form collects your name and your email address, as well as your company and your message if you fill them in. This information is used to reply to your request, organise a demo and prepare a proposal. The processing is based on the pre-contractual steps you ask for. No newsletter subscription is created.

When you click “Book my demo”, the fields are sent to Escouade’s server and then to Scaleway’s Transactional Email service, in the Paris region, in order to forward your request to the publisher. A message on the page confirms that the message has been accepted for sending, or reports an error. It does not guarantee that the recipient has read the message.

Recipients and retention

Ghislain Levrat receives your request in his business mailbox. The hosting, delivery and email providers are involved in routing and protecting the request. The website’s server keeps no copy of the fields, neither in a database nor in its application logs.

Business correspondence is kept in the business mailbox while your request is being handled, then for at most three years after your last contact, unless there is a legal obligation or a need to keep evidence relating to a contractual relationship. You can ask for it to be deleted at any time.

The Escouade account

The account processes each person’s email address, organisation and role; the organisation’s company name, SIREN number and address, checked at sign-up against the public company register, whose government Recherche d’entreprises API receives the name or SIREN searched for; the two-factor secret, if enabled; the IP address and browser of sessions and sign-in codes; the operations log, which records who did what; and the consumption of the usage allowance and of credits.

This data is used to open and secure the account, to check the company and grant only one trial per SIREN number and per domain, to apply the chosen plan, to meter usage and to invoice. The legal basis is the performance of the contract; for the log and protection against abuse, the publisher’s legitimate interest in securing the service; for invoices, a legal obligation.

Sign-in codes are sent through Scaleway’s Transactional Email service, in Paris. The account is served by the publisher’s server, in France, behind Cloudflare, which encrypts the connection and therefore sees the addresses and codes entered.

Sign-in codes, requests and tokens are deleted one day after they expire; a session lasts fourteen days. The log is kept for twelve months; consumption, for thirteen months in detail, then as monthly totals. The email address of a sign-up is kept for twelve months, its SIREN number and domain for three years, to limit the trial. When a size is full, the sign-up request goes on the waiting list: the company’s name and SIREN number, the email address proved by a code and the size chosen, so that you are invited in order of arrival; it is deleted twelve months after its last change, or as soon as you ask. A person with no organisation, or who has not signed in for three years, is deleted, after a notice email sent one month before; a member is deleted when they leave the organisation. Credit purchases and invoices are kept for ten years, as accounting records. A deletion reaches the backups at most fourteen days later.

Payment and billing

Payments go through Mollie B.V., a payment institution in Amsterdam, the Netherlands. Mollie receives the organisation’s name, the billing email address, the amount and the purpose of the payment, and processes the means of payment on its own behalf, as a controller, under its own terms. The publisher neither receives nor keeps card or account numbers. Invoices show the organisation’s company name, SIREN number and address; they are kept for ten years (article L123-22 of the French Commercial Code).

Your organisation’s content

What an organisation puts into Escouade online, its records, emails, documents, meetings and posts, is processed on its behalf: it is the controller, and the publisher its processor. Data subjects exercise their rights with the organisation; a request received by the publisher is forwarded to it.

When a user connects a Gmail mailbox or a Google calendar, Escouade reads the data Google sends it for the user-facing features only: filing their emails and linking them to their files, answering their questions, preparing their drafts and their meetings. Escouade’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This data is not sold, not used for advertising, not used to train an AI model, and not read by a human, except with the user’s explicit consent, for security purposes or to comply with the law.

Audience measurement

When audience measurement is active, the website uses Google Analytics 4, for statistical purposes: knowing how many people visit it and which pages they read. This measurement only starts with your consent. On your first visit, a banner lets you accept or decline; declining takes the same effort as accepting and nothing is pre-ticked. As long as you have not accepted, no request is sent to Google and no measurement cookie is set.

If you accept, Google sets the “_ga” and “_ga_…” cookies in your browser, limited to escouade.io, for thirteen months at most; they make it possible to tell visits apart without identifying you. Google receives the address of the page viewed, without parameters or fragment, its title, the language and the type of device, as well as your IP address, from which it infers an approximate geographical area without keeping it in the reports. The legal basis for this processing is your consent. No advertising feature and no Google signals are enabled, no user identifier is sent, and the audience reports are not cross-referenced with the requests received through the form.

The processor is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the United States; this transfer is governed by the EU–US Data Privacy Framework, to which Google LLC has signed up, and by the standard contractual clauses. Audience data is kept for at most fourteen months in Google Analytics.

Your choice is kept for six months in the “consentement_mesure” cookie, set by the website itself. You can withdraw or change it at any time through the “Manage cookies” link in the footer: withdrawing stops the measurement and deletes the “_ga” cookies.

Search engines

The website’s ownership is declared to Google Search Console, which shows the search queries leading to escouade.io. Search Console provides aggregated statistics to the publisher, sets no cookie on this website and receives no data about your browsing.

Browsing and protection against abuse

Apart from the audience measurement described above, the website shows no advertising and does not keep the form’s fields in your browser’s local storage. The interactive demo on the home page runs entirely in the page: what you type in it is neither sent nor kept. The IP addresses used to limit sending are kept temporarily in memory, for about an hour; the content of requests is not associated with these counters.

Cloudflare and the hosting provider may process technical information, including the IP address and HTTP requests, to ensure the website’s delivery and security. Cloudflare may process data outside the European Union under its terms and contractual safeguards. The providers are identified in the legal notice.

The Escouade mobile app

The Escouade app for iPhone, iPad and Android connects to your company’s Escouade installation, whose address you enter on first launch. It creates no account: yours is opened by your company’s administrator. Sign-in happens in the browser; the app never sees your password and keeps on the device only the installation’s address and the session cookie.

What you view and send through the app, chat questions and answers, documents, attached photos, records and emails, is read and stored on that installation’s server, as from the browser. The client company is responsible for it; the publisher acts on its behalf when it hosts its workspace, online. The AI providers are those set on the installation.

The microphone only opens at your request. Dictation is transcribed by Apple’s or Google’s speech recognition, depending on the device. The chat’s voice mode, when your company has enabled it, sends your voice, for the duration of the conversation, to ElevenLabs, which transcribes it and speaks the answer; the transcript of each exchange is saved in the conversation, on the installation. The camera is only used to attach the photo you take.

When your company enables notifications, they are delivered to your device by Apple’s notification service or by Google’s Firebase Cloud Messaging. Their text only states the kind and severity of an alert, never the title of a document, an address or a name.

The app contains no advertising, no audience measurement and no tracking tool.

Transfers outside the European Union

The account, the workspaces and the default AI models stay in the European Union. The following may process data outside the Union: Cloudflare, in the United States, for delivery and security; Google, for the audience measurement you have accepted and for Android notifications; Apple, for iOS notifications; and, for the functions that use them, the providers named on the subprocessors page, each with the safeguard that governs the transfer.

Your rights and your contact

For any request for access, rectification, erasure, objection, restriction or portability concerning your data, or to set instructions on what happens to it after your death, write to dpo@escouade.io. You can also lodge a complaint with the CNIL, the French data protection authority.

This page concerns the escouade.io website, the Escouade account, billing and the Escouade mobile app. The content of workspaces is covered by the data processing agreement; the public data that Prescriptio publishes is covered by the privacy policy of prescriptio.fr. In Escouade hub, installed on a company’s own server, the sources and AI providers are defined with that company.