Privacy Policy
Last updated: Oct 14, 2026
This policy describes the personal data that Flopix collects, why it collects it, how long it keeps it and how to exercise your rights. It complements our legal notice, which identify the site's publisher and host, and our terms and conditions of sale.
1. Data controller
The data controller is Vincent PIERNOT, operating the sole proprietorship Flopix, 3 rue Amiral Guépratte, 57070 Metz, registered with the Metz Trade and Companies Register under number 928 185 420. Their full contact details appear in Article 1 of the legal notice. For any question about your data, write to us via the contact form.
2. Data collected and purposes
Flopix collects only the data necessary for the service. No data is sold, rented or transferred to third parties for commercial purposes.
| Data | Why | Legal basis |
|---|---|---|
| Name, email address, password | Create and secure your account, let you log in | Performance of the contract |
| Billing address, VAT number, payment history | Issue invoices and manage subscriptions | Performance of the contract and legal obligation |
| Content of created sites (texts, photos, logo, contact details) | Publish your site at the address you chose | Performance of the contract |
| Bank details for paying affiliate commissions | Pay you the commissions due | Performance of the contract |
| Messages sent via the contact form | Respond to your request and follow up on it | Legitimate interest |
| Email address used to sign up for the newsletter | Send you our news, with one click unsubscribe | Consent |
| Activity log of your account: pages of the client area viewed and actions (site creation, payment...), date and time, IP address, device type and country | Secure your account (detect abnormal access or a bot), assist you in case of a problem and understand where a journey gets stuck. Kept 90 days | Legitimate interest |
| Server technical logs: pages and files requested on flopix.fr, date and time, IP address, browser and device type, referring page and country. No cookie is used | Site security (detection of bots and attacks), support and understanding of user journeys, including before account creation. Accessible only to Flopix administration. Kept 90 days | Legitimate interest |
| Messages exchanged with the Flopia AI assistant, and the information needed to answer you | Answering your questions, creating or editing your site with you, helping you when something goes wrong. Kept for 90 days. See Article 5 ter | Performance of the requested service and legitimate interest |
2 bis. Prospecting of professionals
Flopix may offer its service to professionals (retailers, craftspeople, self employed persons, companies) by preparing a site preview for them, built from information they have themselves made public (online business listing, directory, professional site). The only data processed for this purpose is professional and public information: trade name, activity, address, professional contact details (phone, email address) and public content of the business.
| Data | Purpose | Legal basis |
|---|---|---|
| Public professional contact details and business information | Present our service and offer a site preview (business to business outreach) | Legitimate interest |
This processing is based on our legitimate interest (Article 6.1.f of the GDPR) in making our offer known to a professional audience. The preview is not published publicly until it has been claimed, and receiving it entails no obligation: no contract, no payment, no subscription results from merely sending an invitation.
You may object at any time to this prospecting and request the erasure of the data concerning you, without having to give reasons, through the contact form or by declining the invitation received. Each prospecting message sent electronically (email or SMS) includes a simple way to stop receiving them. If no account is created following an invitation, the preview and the associated prospecting data are deleted within a reasonable time.
3. Login via Google, Facebook or Apple
You can create your account and log in with a Google, Facebook or Apple account. In this case, the chosen provider transmits to us only your name, your email address and a technical identifier specific to that provider, which we use to recognize your account on subsequent logins.
Flopix receives neither your password, nor your contact list, nor any other data from your profile, and never publishes anything in your name. You can withdraw access at any time from the security settings of the provider concerned. This withdrawal prevents you from logging back in this way but does not delete your Flopix account: for that, see the deleting your data page.
4. Retention periods
In accordance with the storage limitation principle (Article 5.1.e of the GDPR), your data is not kept indefinitely. These periods are applied automatically by the Platform, without any action on your part.
- Active client account: for the entire duration of the contractual relationship, that is, as long as you have a site or an ongoing subscription.
- Account with no active site or subscription: 3 years from your last login. At the end of this period, the account is automatically anonymized: name, email address, billing address and bank details are permanently erased.
- Site created but never paid for: automatically deleted 3 days after its creation, together with all files attached to it.
- Newsletter subscribers without an account: 3 years from sign up, unless you unsubscribe earlier, which is possible at any time from each email.
- Messages sent via the contact form: 3 years from their receipt.
- Conversations with the AI assistant: 90 days from each message, then automatic deletion.
- Accounting records (invoices, amounts, billing address): 10 years, in accordance with Article L123-22 of the French Commercial Code. This retention meets a legal obligation within the meaning of Article 17.3.b of the GDPR: it therefore continues even after your account is deleted and cannot be the subject of an erasure request. These records are kept separately and are used only for accounting and tax purposes.
5. Subprocessors and recipients
Flopix uses a deliberately limited number of providers, each for a specific purpose:
- Hosting: the servers that store the site and its database. See Article 2 of the legal notice.
- Stripe: payment processing and invoice issuance. Your bank details are entered directly with Stripe and never pass through our servers.
- Sending emails: transactional messages (confirmation, verification code, invoice) and newsletter.
- Google, Facebook, Apple: only if you choose to log in through them, and within the limits described in Article 3.
- Google reCAPTCHA: only on the "Contact us" page, to distinguish a message written by a person from an automated submission. See Article 5 bis below.
- Anthropic, PBC (United States): operation of the Flopia AI assistant, with the Claude model. See Article 5 ter below.
- DeepL SE (Germany): only for the English version of customer sites that have turned on this option. The public text of the site is sent to it for automatic translation. The pages of flopix.fr, for their part, are translated by hand.
None of these providers is authorized to use your data for their own purposes beyond the purpose for which they act.
5 bis. Protection of the contact form (reCAPTCHA)
The "Contact us" form is protected by Google reCAPTCHA v3, a service that automatically assesses whether a submission comes from a person or a program. Without it, the contact address would quickly be swamped with automated messages, to the point of losing genuine requests.
This service is loaded only on this page, and on no other page of the site. Viewing the home page, the blog, your dashboard or a site created with Flopix triggers no connection to reCAPTCHA.
When active, reCAPTCHA collects your IP address as well as information about your browser and the way you interact with the page, in order to calculate a score. Flopix receives only this score: neither the analyzed data nor its detail. This processing is based on our legitimate interest in protecting our means of contact against abuse.
reCAPTCHA is provided by Google Ireland Limited and may involve a transfer of data outside the European Union, governed by the European Commission's standard contractual clauses and by the EU US Data Privacy Framework. Google's terms can be viewed at policies.google.com/privacy.
If you prefer not to go through this service, you can write to us directly at [email protected] : no such processing then takes place.
5 ter. "Flopia" AI assistant
Flopix offers a conversational assistant, Flopia, powered by artificial intelligence: the Claude model, provided by Anthropic, PBC (San Francisco, United States). It answers your questions about Flopix, guides you through creating your site (it fills in the form from what you write to it), writes some of the form texts at your request, helps you edit your site and assists you when something goes wrong with your account. Visitors can ask it questions; creating or editing a site with it requires being logged in.
You know you are talking to an AI: the assistant introduces itself as such, and its answers are generated automatically. They may contain mistakes: check important information. No change to your site is saved without your approval (confirmation button or form submission), and the assistant makes no decision on your behalf.
Data sent to Anthropic
To produce an answer, Flopix sends Anthropic your messages and the latest exchanges of the conversation, the assistant's instructions and the excerpts from the Flopix help pages relevant to the question. Depending on your request, the information needed to answer you is added: the details you give for your site (name, business, contact details, opening hours, texts) or, if you are logged in and your question is about your account, a summary of it (your name and email address, your sites and the status of their subscription, the account's recent errors and events).
Never sent: your password, your bank or payment details, or your IP address.
What Flopix keeps
- The conversation (your messages and the assistant's answers) is saved on the Flopix servers, linked to your account if you are logged in, or to your IP address otherwise. It is used to follow up on support, to correct the assistant's mistakes and to improve it. Only the Flopix administration has access to it. It is automatically deleted after 90 days.
- A usage record (date, amount of text processed and estimated cost, without the content of the messages) is used to apply usage limits and prevent abuse. After 90 days, it is detached from your account and your IP address: only the overall figures are kept.
- If you ask the assistant to open a support request, it is handled like a contact form message and kept for 3 years.
- In your browser, the current conversation is kept for a few days (local storage) so you can find it again from one page to the next. See Article 6.
At Anthropic
Anthropic acts as a processor for Flopix. Under its commercial terms, data sent through its API is not used to train its models by default. Anthropic keeps it for a limited period, in particular for security and abuse detection, then deletes it.
This data is processed in the United States, that is, outside the European Union. This transfer is governed by the safeguards provided for by the GDPR: the European Commission's standard contractual clauses, included in Anthropic's Data Processing Addendum. Anthropic's terms are available at anthropic.com/legal/commercial-terms and anthropic.com/legal/privacy.
Legal basis and advice
This processing is based on the performance of the service you request (creating or editing your site, getting help with your account) and, for questions asked without an account as well as for following up on and improving the assistant, on our legitimate interest in informing you and offering you a reliable assistant. The assistant is optional: you can always fill in the form yourself, or write to us via the contact form, which also lets you request access to your conversations or their deletion before that period ends.
Advice: do not write sensitive information to the assistant (health, opinions, bank card number, password, identity document), nor personal data about third parties that your site does not need.
6. Cookies
Flopix places two categories of cookies, subject to different rules. No advertising cookie, no retargeting cookie and no third party data reseller operates on the Platform.
Essential cookies, without consent
They are strictly necessary for the operation of the service. In accordance with Article 82 of the French Data Protection Act and the CNIL's guidelines, they are exempt from consent: without them, the requested service cannot be provided.
| Cookie | Role | Duration |
|---|---|---|
__Host-PHPSESSID |
Keeping your session once logged in | Browser closing |
| Anti-CSRF token | Protecting your forms against fraud | Duration of the session |
flopix_consentement_mesure |
Remembering your choice below, so we do not ask you again | 6 months |
flopia_v1_…, flopia, aia_durees |
Local browser storage for the AI assistant: keeping the current conversation (and the images you give it for your site) from one page to the next, and estimating the response time. This data stays in your browser | 3 days for the conversation |
Audience measurement, subject to your agreement
Flopix uses Google Analytics 4 to understand which pages are viewed and to improve the service. This tool places cookies and transmits data to Google, which also processes it for its own purposes: it therefore does not fall under the consent exemption, and nothing is loaded until you have clicked "Accept".
| Cookie | Role | Duration |
|---|---|---|
_ga |
Distinguishing visitors from one another | 13 months |
_ga_<identifiant> |
Keeping the state of the current visit | 13 months |
flopix_vid |
Anonymous identifier for your browser, to link the pages of your journey on Flopix (and to your account if you sign up) | 6 months |
flopix_source |
Remembering where you came from on your first visit (search engine, social network, link, campaign) | 30 days |
Journey tracking on Flopix (only if you have accepted): the pages you view, the buttons and links you click (never the content of what you type), the time spent per page, your device type and your country. This information stays with Flopix (no third party), serves to understand where a journey gets stuck and to help you, and is deleted after 90 days. You can withdraw your agreement at any time via "Manage my cookies" at the bottom of the page.
For Google Analytics, the IP address is anonymized. This data serves neither advertising nor individual profiling, and is never resold. The recipient is Google Ireland Limited, with a possible transfer to the United States governed by the European Commission's standard contractual clauses.
Refusing deprives you of nothing: the service works identically. You can change your choice at any time via the link Manage my cookies, present at the bottom of each page. Your decision is kept for 6 months, after which the question is asked again.
The sites created by our customers
Audience measurement concerns only flopix.fr. The sites published by our customers load no measurement tool, no external font and no third party script: their visitors are never measured, neither by Flopix nor by Google.
You can also configure your browser to refuse all or part of the cookies. Refusing strictly necessary cookies, however, prevents logging in to your personal account area.
7. The sites created by our customers
Each site published via Flopix is operated by the customer who created it: it is they, not Flopix, who decides the content they publish there and who answers for the personal data they include. Flopix acts as the technical host of these sites.
Customer sites load no audience measurement tool and no external font, and place no cookie other than those needed to display them. If you notice illegal content on one of them, report it via our contact form.
8. Your rights
In accordance with the GDPR, you have a right of access, rectification, erasure, portability, restriction and objection regarding your personal data. You may also set instructions regarding their fate after your death.
- Access and rectification: most of your data can be viewed and modified directly from your Settings.
- Erasure: see the deleting your data page, which details the procedure to follow and the time frames.
- Other rights: write to us via the contact form. We respond within 30 days at most.
You also have the right to lodge a complaint with the CNIL if you believe that the processing of your data does not comply with the applicable regulations.
9. Changes to this policy
This policy may change, in particular if Flopix adds a service or a provider. Any substantial change will be indicated to you on the site, and the last updated date shown at the top of this page will be updated.