Privacy policy

This English version is provided for convenience. In case of any discrepancy, the French version prevails.

This page explains what personal data Richa collects when you use richa.fr, why, how long it is kept and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR, EU regulation 2016/679) and the French Data Protection Act (loi Informatique et Libertés).

1. Data controller

Controller: Thierry Richa, sole trader (entrepreneur individuel, EI)
Address: 15 rue Guilloud, 69003 Lyon, France
SIRET: 939 437 745 00010
Contact: [email protected]

2. Data collected

Depending on how you use the site, the following data is collected:

• Booking a call: your name, email address and the information you provide when you book a free call.
• Emails and contact form: your first name, email address and message, if you write to [email protected] or use the contact form on the Médias page.
• Newsletter: your email address (and your first name if you give it) when you sign up, as well as email opens and clicks on their links.
• AI diagnostic: your company’s website, your first name, your work email address, your sector, your headcount, your main tools, the task that takes you the most time and the time you spend on it, given in the form on the AI diagnostic page. To prepare the diagnostic, an agent also reads the public pages of that website.
• Technical data: IP address, browser, pages requested and date of visit, logged by the server and by Cloudflare to run and protect the site. On the AI diagnostic page, Cloudflare Turnstile also analyses technical signals from your browser to check that the form is filled in by a person and not a bot.
• Audience measurement: if you accept it, Google Analytics records your visit (pages viewed, duration, traffic source, device type, approximate city) using cookies.
• Browsing analysis: if you accept it, Microsoft Clarity records how you use the pages (clicks, scrolling, mouse movements) to produce heatmaps and session recordings. Displayed text and anything you type are masked.

If you become a client, the data related to your quote, contract and invoices is also kept.

3. Purposes and legal bases

Purpose	Legal basis (GDPR)
Organising and holding the call you booked	Pre-contractual measures (art. 6(1)(b))
Replying to your emails and to messages sent through the contact form	Legitimate interest and pre-contractual measures (art. 6(1)(f) and (b))
Delivering the service ordered	Performance of a contract (art. 6(1)(b))
Invoicing and bookkeeping	Legal obligation (art. 6(1)(c))
Preparing your AI diagnostic, emailing it to you and contacting you about it	Consent (art. 6(1)(a))
Prioritising diagnostic requests (company size, sector, time reported)	Legitimate interest: organising follow-up (art. 6(1)(f))
Protecting the AI diagnostic form from bots (Cloudflare Turnstile)	Legitimate interest: security (art. 6(1)(f))
Sending the newsletter and measuring opens	Consent (art. 6(1)(a))
Measuring site audience (Google Analytics)	Consent (art. 6(1)(a))
Analysing browsing to improve the pages (Microsoft Clarity)	Consent (art. 6(1)(a))
Running the site and protecting it from attacks	Legitimate interest: security (art. 6(1)(f))

Your data is never sold or rented. To date, it is not used for any advertising.

4. Recipients and processors

Only Thierry Richa has access to your data. It also goes through the following providers, only as far as their service requires:

• Brevo (Sendinblue SAS, France): call booking, newsletter delivery, delivery of contact form messages, delivery of the AI diagnostic report and keeping track of people who write to me. You only get the newsletter if you sign up for it.
• Google (Google Meet): the video call.
• Google (Gmail): receiving contact form messages.
• OVH SAS (France): the [email protected] mailbox and the domain name.
• Cloudflare, Inc. (United States): routing and protection of the site’s traffic, and bot check on the AI diagnostic form (Turnstile).
• OpenAI (United States): analysis by an artificial intelligence model of your answers to the AI diagnostic form and of your website’s public text, to write your report.
• Telegram: internal notification sent to Thierry Richa when a diagnostic request arrives: request number, priority level, sector, headcount and source, without your name, email address, website or description.
• Google Ireland Ltd and Google LLC (United States): audience measurement with Google Analytics, only if you accept it.
• Microsoft Corporation (United States): browsing analysis with Microsoft Clarity, only if you accept it.

The site itself runs on a server operated by Richa, in France. Cloudflare, Google and Microsoft may process data outside the European Union, notably in the United States. These transfers are covered by the EU–US Data Privacy Framework and by the European Commission’s standard contractual clauses. OpenAI and Telegram may also process data outside the European Union.

5. Retention periods

• Bookings, emails and contact form messages: 3 years after the last contact.
• AI diagnostic: your answers and your report are kept for 3 years after the last contact, then deleted.
• Contracts, quotes and invoices: 10 years (legal accounting obligation).
• Server logs: 14 days, then automatically deleted.
• Newsletter: until you unsubscribe, then deleted.
• Audience measurement: 13 months maximum for cookies, 14 months for the related data in Google Analytics.
• Browsing analysis: 13 months maximum for Clarity cookies; session recordings are kept for 30 days by Microsoft.

6. Cookies

The site sets two types of cookies:

• Technical cookies: essential for the site to work and stay secure. They do not require your consent.
• Audience measurement cookies (Google Analytics and Microsoft Clarity): set only if you accept them in the banner shown on your first visit.

Declining is as easy as accepting, and your choice is kept for 6 months. You can change it at any time with the “Manage cookies” link at the bottom of the page. Once you consent, Microsoft Clarity also sets cookies on its own domains (clarity.ms, bing.com), including the MUID identifier: they are governed by Microsoft’s privacy policy, and the site cannot delete them itself if you change your mind; you can remove them from your browser. The site currently sets no advertising cookies, and its fonts are hosted on its own server. The booking page is hosted by Brevo, which applies its own cookie policy.

7. Your rights

Under the GDPR, you have the following rights over your data:

• the right of access, rectification and erasure;
• the right to restrict and to object to processing;
• the right to data portability;
• the right to withdraw your consent at any time (AI diagnostic, newsletter, audience measurement, browsing analysis), without affecting what was done before;
• the right to set instructions on what happens to your data after your death.

To exercise them, write to [email protected]. You will get a reply within one month. Proof of identity may be requested if there is reasonable doubt.

If, after contacting us, you feel your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority: cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

8. Security

The site is served over HTTPS only, administration is restricted to Thierry Richa and protected against repeated login attempts, and the server is not directly exposed to the Internet: it can only be reached through Cloudflare’s network.

9. Changes

This policy may change to stay compliant with regulations or to reflect changes to the site. The date of the last update is shown at the top of the page.

In particular, Richa may in the future sell products or services online, or run and measure advertising (for example with Google Ads or Meta). In that case, this policy will be updated before launch: order and billing data, payment providers, advertising cookies. Advertising cookies will only be set with your consent, given in the banner.