This Privacy Policy describes how Olympe AI (SASU, 2 route de Cresnes, 60119 Hénonville, RCS Beauvais 102 023 496) ("Olympe AI", "we") collects and processes the personal data of users of its Services, in accordance with Regulation (EU) 2016/679 ("GDPR") and the amended French Data Protection Act No. 78-17 of 6 January 1978.
1. Data controller
The data controller is Olympe AI, represented by its Chairman, Mr Baptiste Decagny. Contact: privacy@olympe-ai.fr, 2 route de Cresnes, 60119 Hénonville, France.
Data Protection Officer (DPO): Olympe AI has not appointed a DPO to date, as appointment is not mandatory under Article 37 of the GDPR at its stage of activity. A dedicated contact point for data protection matters is available at the address above. (This will be reassessed, in particular in light of the volume and nature of the processing.)
2. Sovereignty and data localisation commitment
Olympe AI hosts all its Services and the data it processes in France, at the OVHcloud datacenters of Gravelines (GRA9 and GRA11). The third-party AI models used (in particular Qwen 2.5) are run locally on Olympe AI's infrastructure: no data is transmitted to a third-party model provider on that occasion.
The only exception to localisation in France concerns the payment provider, described in Article 7.
3. Data collected
We collect the following categories of data:
- Identification and account data: surname, first name, e-mail address, login credentials, and where applicable company name and role (professional customers).
- Billing and payment data: billing details, history of transactions and invoices. Full bank card data is processed directly by Stripe and is not stored by Olympe AI.
- Usage and technical data: connection logs, IP address, browser/device type, browsing data, usage statistics.
- User Content: video, image and sound files uploaded for processing by the Services. This content may include third-party personal data (for example, persons appearing in a video), see Article 5.
- Support and communication data: exchanges via support, messages, and where applicable data related to e-mail campaigns.
4. Purposes, legal bases and retention periods
| Purpose | Legal basis (Art. 6 GDPR) | Retention period |
|---|---|---|
| Account creation and management, provision of the Services | Performance of the contract | Account data kept for 3 years from the end of the contractual relationship (account closure / last activity) |
| Processing of User Content (editing) | Performance of the contract | Videos and User Content: maximum 1 year, then deletion |
| Invoicing, accounting, legal obligations | Legal obligation | 10 years (accounting and tax obligation) |
| Payment management | Performance of the contract | Duration of the relationship + legal periods (up to 10 years for accounting records) |
| Website audience, conversion and performance measurement (Umami) | Consent; no collection before the user's agreement | Raw data kept for no longer than 13 months, then deleted or aggregated |
| Prospecting / commercial communication by e-mail | Consent (prospects) or legitimate interest (customers) | Until consent is withdrawn / 3 years after last contact for prospects |
| Security, fraud prevention, technical logs | Legitimate interest / legal obligation | 12 months for connection logs (unless retention is needed for a security incident) |
| Handling of requests (GDPR rights, support) | Legal obligation / legitimate interest | Time needed to handle the request + limitation periods |
The active Umami database is purged daily so that no raw data is retained there beyond 13 months. Encrypted PostgreSQL dumps are created daily and retained for no longer than 14 days. Because a dump may temporarily contain rows already purged from the active database, every restore reapplies the 13-month purge before the service is brought back online.
General retention rule: data is kept for 10 years where a legal (accounting/tax) obligation requires it; otherwise, User Content is kept for 1 year and account data for 3 years.
5. Processing of content containing persons (faces)
User Content may contain images of identifiable natural persons (faces).
- This content is processed solely to perform the edit requested by the Customer. Processing by the AI models is strictly necessary to produce the edit: without it, no edit is possible.
- Olympe AI does not analyse faces in order to uniquely identify a person and creates no biometric template. The processing carried out therefore does not constitute processing of biometric data within the meaning of Article 9 of the GDPR, which covers data processed "for the purpose of uniquely identifying a natural person".
- Data resulting from this processing is not kept beyond what is necessary to produce the edit and is not reused for other purposes (in particular not for model training, except with the User's explicit opt-in).
- It is for the Customer to ensure that they hold the rights and authorisations (in particular image rights and, where applicable, the consent of filmed persons) over the content they upload (see ToU, Article 7).
6. AI model training
Olympe AI does not use User Content to train its artificial intelligence models, except where the User voluntarily and expressly takes part in a specific programme that explicitly states this (opt-in, based on consent). Consent may be withdrawn at any time without affecting access to the Services.
7. Recipients and processors
Your data is never sold. It may be shared with the following processors, acting on behalf of Olympe AI:
| Processor / recipient | Purpose | Location | Transfer outside the EU |
|---|---|---|---|
| OVH SAS (OVHcloud) | Hosting of the Website and data | France (Gravelines) | No |
| Stripe | Payment processing | EU (Stripe Payments Europe, Ireland) and United States | Yes, safeguarded (see 7.1) |
| Brevo | Sending e-mails (transactional and/or marketing) | European Union | No |
| Umami instance operated by Olympe AI | Website audience, conversion and Web performance measurement | France (Olympe AI's OVHcloud infrastructure) | No; no measurement data is sent to the Umami publisher |
| Qwen 2.5 model | AI processing of content | Run locally at Olympe AI (France) | No, no data transmitted to a third party |
Data may also be disclosed to administrative or judicial authorities where required by law.
7.1. Transfers outside the European Union
To date, the only processing involving a transfer of data outside the European Union is the payment service:
- Stripe: transfers to the United States are safeguarded by the European Commission's standard contractual clauses and/or Stripe's certification under the EU-U.S. Data Privacy Framework (DPF).
The Umami audience-measurement instance is self-hosted on Olympe AI's French infrastructure and its PostgreSQL database is not exposed publicly. It entails no transfer of measurement data outside the European Union or to the Umami publisher. The script is served from the Website domain and loads only after consent.
8. Security
Olympe AI implements appropriate technical and organisational measures to protect data against loss, unauthorised access, disclosure or alteration: sovereign hosting in France, encryption of data flows, access control, logging, and data minimisation. In the event of a data breach likely to result in a high risk to your rights, you will be informed in accordance with Articles 33 and 34 of the GDPR.
9. Your rights
In accordance with the GDPR, you have the following rights over your data:
- right of access;
- right of rectification;
- right to erasure ("right to be forgotten");
- right to restriction of processing;
- right to object (in particular to prospecting);
- right to portability;
- right to withdraw consent at any time, where processing is based on it;
- right to set instructions regarding the fate of your data after your death.
To exercise these rights, contact privacy@olympe-ai.fr. Proof of identity may be requested. We respond within one month (extendable by two months in complex cases).
You also have the right to lodge a complaint with the CNIL (French Data Protection Authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
10. Cookies
The use of cookies and trackers on the Website is described in the Cookie Policy.
11. Amendment
Olympe AI may amend this Policy. The applicable version is the one in force at the time of your use of the Services. Any substantial change will be notified by appropriate means.
12. Contact
For any question regarding the protection of your data: privacy@olympe-ai.fr, Olympe AI, 2 route de Cresnes, 60119 Hénonville, France.
Do you have a question about this document? Contact our team.