This policy describes how Freelance OS processes your personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable national laws.

Data controller

MEIZ (EURL) (RCS Paris 854 034 683), publisher of Freelance OS, represented by Jean Saunie. GDPR contact: contact@freelance-os.fr.

No Data Protection Officer (DPO) is currently designated. The GDPR contact is the official channel for any data-related question.

Scope

This policy covers:

The public site freelance-os.fr and its sub-pages
The Kernel SaaS (kernel.freelance-os.fr) and the member app (app.freelance-os.fr and workspace subdomains *.freelance-os.fr)

When you use a workspace administered by a third party (e.g. solodevagency.fr), Freelance OS acts as a processor under GDPR for the data entered in that workspace. The third party remains the controller for its own end users. See /en/dpa.

Data collected

Identity and account data

Email, first name, last name (optional)
Hashed password (never stored in clear, via Supabase Auth)
Internal UUID
Role and workspace membership

Billing data

Billing email, postal address, business name, VAT number
Stripe customer ID
Payment method identifiers (never the full card number, which stays at Stripe)
Invoice and subscription history

User content

Drafts and content created in Studio (drafts, ideas, scripts)
Voice configs, briefs, AI prompts
Counsel documents (quotes, contracts, invoices)
Presentations, published web pages, knowledge base items
Bookings and external invitee data (name, email, timezone)
Support threads and multi-channel conversations (DM, email)

Third-party integration tokens

OAuth tokens (AES-256-GCM encrypted, isolated per workspace) for Google, Google Ads, YouTube, TikTok, TikTok Marketing API, Instagram, LinkedIn, LinkedIn Advertising API, Meta, Meta Ads, WhatsApp Business, Stripe Connect
Connection metadata (account/advertiser id, granted scopes, expiration)
Tokens are deleted immediately when you disconnect an integration from the UI

Data retrieved via advertising APIs

When you connect an ads account (Meta Ads, Google Ads, TikTok Marketing API, LinkedIn Advertising API), Freelance OS periodically queries those APIs to sync:

Ad accounts you authorize (id, name, currency, timezone)
Campaigns, ad groups, ads you create or view from Kernel (objective, budget, status, targeting, creatives)
Aggregated performance metrics (impressions, clicks, conversions, spend, CPM, CPC, CPA, ROAS) per campaign, ad group, ad, day, demographic
Custom audiences you configure (estimated size, source, status). PII hashes optionally uploaded (SHA-256 hashed emails) are transmitted to platforms but never stored in cleartext on Freelance OS
Product catalogs and DPA feeds (for dynamic ads)
Pixel events and server-side conversions (CAPI) you send to platforms, Freelance OS acts as a gateway
Leads collected via Lead Ads (form fields, timestamp) returned to you in Kernel

This data is stored in the EU region (Supabase Frankfurt) and associated exclusively with your workspace. It is deleted 30 days after integration disconnection or account closure.

Google user data (Analytics and Search Console)

When you connect your Google Analytics or Google Search Console account to Freelance OS, we access your own data read-only (Google Analytics reports: sessions, pageviews, traffic sources; Search Console data: search performance, the sites and domains you have verified), solely to display it in your Freelance OS dashboard. This information is only used to show those statistics back to you, the user who connected the account.

Freelance OS's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained from Google APIs is not sold, is not used for advertising, is not used to train artificial-intelligence models, and is not transferred to third parties except as strictly necessary to provide or improve this feature, for security purposes, or to comply with the law. You can revoke this access at any time by disconnecting the integration from Analytics > Connexions.

Technical and telemetry data

IP address (for security and auth logs)
User agent, browser, OS
Pages visited, analytics events (if consented)
Audit logs (super_admin actions, sensitive operations)

Public form submissions

Waitlist and webinar signups: email, first name, phone (optional), country
UTM, referer, locale, user agent at submission time

Purposes and legal basis

Purpose	GDPR legal basis
Account creation and management	Contract performance (art. 6.1.b)
Billing, payment, accounting	Contract + legal obligation (art. 6.1.b and c)
Provision of SaaS features (Studio, Counsel, etc.)	Contract performance
Cross-platform ad campaign management (Meta Ads, Google Ads, TikTok Marketing API, LinkedIn Advertising API)	Contract performance
AI content generation (Anthropic, Gemini, OpenAI)	Contract performance
Transactional emails (Resend)	Contract performance
Security, fraud prevention, audit logs	Legitimate interest (art. 6.1.f)
Audience measurement (Google Analytics 4)	Consent (art. 6.1.a)
Waitlist, webinar, newsletter signups	Consent
Responding to GDPR requests and support	Legal obligation + legitimate interest
Running the partner program (application, attribution, commissions, payouts)	Performance of the contract + legal obligation (art. 6.1.b and c)

Partner program

If you apply to or take part in the partner program (partners.freelance-os.fr), we additionally process: your application data (channels and profiles such as LinkedIn, TikTok, Instagram, YouTube, X, newsletter, website, audience size, country), your referral code, the referrals tracked through your link via a 60-day attribution cookie, and your commissions. Payout data (identity, bank details, tax information) is collected and processed by Stripe via Stripe Connect. Details are in the partner program privacy policy.

Recipients and sub-processors

Your data is accessible to authorized Freelance OS staff and contractors, and to the technical sub-processors listed at /en/subprocessors (hosting, payment, email, AI, OAuth, analytics).

Your data is never sold nor transferred for advertising purposes.

Transfers outside the European Union

Some sub-processors are located in the United States or operate US infrastructure. Transfers are made under Standard Contractual Clauses approved by the European Commission (decision 2021/914), complemented by technical measures (TLS 1.3 in transit, AES-256 at rest, tenant isolation).

Sub-processors involved in non-EU transfers:

Stripe (payments, US)
Anthropic, Google Gemini, OpenAI (generative AI, US)
Apify (LinkedIn scraping, US)
Fathom (meeting transcripts, US)
Vercel (hosting, US)
Meta, Meta Ads (Pixel, Conversions API, Marketing API, US)
Google Ads (Marketing API, US)
TikTok Marketing API (US/SG)
LinkedIn Advertising API (US)
Resend (transactional email, US/EU)

See /en/subprocessors for the exhaustive list and associated safeguards.

Retention

Data	Duration
Active account	Duration of the account
Closed account	Deletion within 30 days of closure
Counsel documents (quotes, contracts, invoices)	10 years from issuance (Art. L123-22 French Commercial Code)
Audit and security logs	12 months
Authentication IPs	12 months (French LCEN)
Waitlist email without follow-up	24 months max
Analytics cookies (GA4)	13 months max
Commercial prospection data	3 years from last contact (CNIL)

Your rights

Under GDPR articles 15 to 22, you have the following rights:

Access to a copy of your data
Rectification of inaccurate information
Erasure ("right to be forgotten")
Restriction of processing
Objection to processing based on legitimate interest
Portability of your data in a structured, machine-readable format
Not to be subject to automated decision-making with legal effects
Withdrawal of consent at any time (without retroactive effect)
Post-mortem directives about your data

To exercise these rights: contact@freelance-os.fr or via /en/data-deletion. Response within 30 days maximum.

Privacy policy