Privacy Policy

Who is responsible

The data controller for the causalit.fr website and for customer accounts is FI-DATA, a simplified joint-stock company (SAS) under French law with a share capital of €1,500, registered with the Auch Trade and Companies Register under number 900 033 622, whose registered office is at 80 rue Jean Jaurès, 32500 Fleurance, France. We have not appointed a data protection officer; the contact point for every privacy matter is contact@causalit.fr.

For the audience measurement our customers run on their own websites, the customer is the controller and we act as processor on their instructions (see “Visitors of sites measured with causalIT” below, and the Data Processing Agreement).

Two situations, two roles

• You are a customer or a visitor of causalit.fr: we decide why and how your data is processed — we are the controller.
• You visit a website that uses causalIT: the owner of that site decides to measure its audience — they are the controller, and we only process the measurement data on their behalf.

Data we process as a controller

We never see card numbers: payment happens on Stripe's hosted pages and Stripe only sends us the status of the subscription.

Why we process it and on what legal basis

• Performance of the contract (GDPR art. 6.1.b): creating your account, providing the service, sending the e-mails the service needs, billing.
• Legal obligations (art. 6.1.c): keeping invoices and accounting records, answering lawful requests from authorities.
• Our legitimate interests (art. 6.1.f): securing accounts and the platform, preventing abuse, keeping a trace of significant actions, measuring the use of our own product with a method that identifies nobody.
• Your consent (art. 6.1.a): only for the optional third-party services listed in the Cookie Policy, should we activate one — none is active today.

Visitors of sites measured with causalIT

When you browse a website that uses causalIT, the tag (or the site's server) sends us the page viewed, the referrer, the browser family, the screen size and the time of the visit. Personal data is kept to the minimum:

• No cookie and no storage is read or written on your device, so the site does not need your consent to measure its audience in this default mode.
• Your IP address is used only in memory, for two things: deriving a non-reversible daily identifier — a hash of a global secret, a per-site secret, the day, the IP address and the browser — and looking up an approximate location (country, region, city) in a database hosted on our own servers. The IP address itself is never stored and never leaves our infrastructure.
• The identifier changes every day and differs from one site to another: we cannot follow you across days or across sites, and we cannot identify you.
• Query strings are stripped from page addresses before storage, and customers are contractually forbidden from putting personal data in the paths or custom properties they send.
• A customer using our backend SDK may enable an “identified mode” and send an already-hashed identifier of their own users. That pseudonymised data belongs to the customer, who must have a legal basis and inform their users; we re-hash it per site and never receive the original value.

For these measurements the site owner is the controller: exercise your rights with them. We help them answer you, as our Data Processing Agreement requires.

Behavior measurement (heatmaps)

Some site owners also enable behavior measurement — heatmaps of clicks, hovers, scroll depth and attention — to understand how their pages are used. It is off by default, opt-in per site, and adds nothing an ordinary page view does not already disclose:

• The site owner turns it on in their settings and chooses a sample rate; the tag stays silent — no listener, no observer — on sites that did not opt in.
• What is measured: which elements of a page a visitor saw, for how long, clicked or hovered, plus scroll depth and attention by 5% band of the page.
• What is never collected: no mouse trail, no session replay, no screenshot, no form value, no paragraph text (only its position under the nearest heading) — and no visitor or session identifier of any kind.
• The recorded time is rounded to the hour and the rows cannot be tied to one person even by us: there is no query that replays an individual visit.
• Whether a page view is included is decided from the same daily fingerprint described above, then the fingerprint is discarded — it is never stored alongside behavior data.

Retention and roles are the same as for audience events (see “How long we keep it” below): the site owner is the controller for this data too, and we act as processor on their instructions.

Who receives the data

Our team accesses data only when operations or support require it. The following providers process data on our behalf, under a contract:

Transactional e-mails are sent from our own mail server: no third-party e-mail provider sees them. Geolocation uses a MaxMind GeoLite2 database copied onto our servers: no request is sent to MaxMind. We do not sell personal data and do not share it with advertisers.

We may disclose data when the law requires it, or to a successor in the event of a merger or sale of the business, under the same commitments.

Where the data is hosted

Our servers, databases and backups are hosted in France. The only transfer outside the European Union concerns the payment data handled by Stripe, described above.

How long we keep it

Your rights

Under the GDPR and the French Data Protection Act you may access your data, rectify it, have it erased, restrict or object to its processing, receive it in a portable format, and give instructions about what happens to it after your death.

• Most rights are self-service: in Account settings you can edit your profile, change your e-mail address, download a JSON export of your personal data, revoke sessions and delete your account — which immediately deletes the organisations and sites you were the sole owner of, together with their audience data.
• For anything else, write to contact@causalit.fr. We answer within one month; we may ask you to prove your identity when there is a reasonable doubt.
• You may lodge a complaint with the supervisory authority — in France, the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

If your request concerns a website measured with causalIT, it must be addressed to the owner of that site, who is the controller; we will assist them.

Security

Passwords are hashed with scrypt; API keys and tokens are stored as SHA-256 hashes; every connection is encrypted (TLS); the administration area is restricted and every administrator action on an account — including impersonation for support — is logged; servers are hardened and patched automatically; the account database is backed up daily. No system is infallible: if a breach affects your data, we will notify you and the CNIL as the law requires.

Children

The service is intended for professionals and is not directed at children under 15. We do not knowingly collect their data.

Changes

We update this policy when the service or the law changes. Significant changes are announced by e-mail to account holders or by a notice in the application; the version in force is the one published on this page, with its date.