Legal Privacy Policy

Privacy Policy

arkanecloud.com website and Customer Console

Last updated: October 7, 2026

1. Scope

This policy describes the processing of personal data carried out by Arkane Cloud as controller for its own purposes in connection with the use of the following websites and applications (together, hereinafter the "Site") and the management of the business relationship:

arkanecloud.com, corporate website;
console.arkanecloud.com, customer application (hereinafter the "Customer Console");
lp.arkanecloud.com, advertising landing pages;
meeting.arkanecloud.com, sales meeting scheduling.

The "Customer Console" means the web interface and the administration API made available by Arkane Cloud, enabling Arkane Cloud's customers and their authorized users, according to their access permissions, to administer their account, their access and the cloud services subscribed to.

Data relating to accounts, users, access permissions, billing, support, security and platform administration are processed by Arkane Cloud for the aforementioned purposes, as the case may be as controller.

However, where Arkane Cloud processes, on behalf of a customer and on its documented instructions, the data that such customer inputs, stores, uses or has processed in connection with the cloud services (training data, inference data, files, content or data of its own users, etc.), Arkane Cloud acts as processor within the meaning of Article 28 of the General Data Protection Regulation (GDPR). Such processing is governed by the Data Processing Agreement ("DPA") entered into with the customer, who remains the controller.

2. Controller

The controller is ARKANE, a French single-member limited liability company (EURL) with a share capital of EUR 1,000, registered with the Lyon Trade and Companies Register (RCS) under number 888 755 766, EU VAT number FR 83 888 755 766, whose registered office is located at 55 ter avenue René Cassin, 69009 Lyon, France, doing business under the trade name "Arkane Cloud".

The Data Protection Officer (DPO) is Julien Gauthier.

He can be contacted at the following address: [email protected]

3. Data That May Be Collected

Depending on the purposes pursued, Arkane Cloud may process the following categories of data:

Identification and contact data: last name, first name, title, business contact details, email address, telephone number, postal address and job title;
Account and access data: account identifiers, information relating to the creation and administration of the account, user profiles, access permissions, access rights and data necessary for authentication;
Data relating to the contractual relationship and the services subscribed to: information concerning the contract, the services subscribed to, customer accounts, authorized users, requests for quotes or demonstrations, as well as communications relating to the business relationship;
Billing, payment and accounting data: billing details, invoice references, payment information, amounts due, due dates, data necessary for debt collection and accounting information;
Data relating to requests, support and complaints: contact requests, assistance requests, communications with support, reported incidents, complaints, responses provided and information necessary for the follow-up of requests or disputes;
Technical data and connection data: IP addresses, technical identifiers, connection and access logs, connection dates and times, data relating to the use, consumption, operation, availability and performance of the services, as well as data necessary for security, the prevention of fraud and abuse, maintenance, incident diagnosis and the improvement of the services;
Business prospecting data: business contact details, job title, company, contact history and information relating to sales solicitations, objections and consents, where applicable;
Browsing data and data relating to trackers: data collected by the trackers used on the Site, according to the choices expressed by the user;
Job application data: information contained in applications, curriculum vitae, cover letter, contact details, professional background, education, skills and communications exchanged in the context of recruitment;
Data relating to the exercise of rights: information necessary to process requests to exercise rights, communications with the data subject and, where necessary and proportionate in the event of reasonable doubt as to the data subject's identity, additional information making it possible to verify such identity.

Arkane Cloud only collects and processes data that are relevant and necessary in light of the purposes pursued.

Whether data are mandatory or optional, as well as the possible consequences of failing to provide them, are specified at the time of their collection.

Data input, stored or processed by customers in connection with the cloud services are processed by Arkane Cloud as processor, under the conditions set out in the DPA entered into with the customer.

Data that customers input, store, use or have processed in connection with the cloud services, including prompts and the outputs generated, are not used by Arkane Cloud to train models.

They may be processed to the extent strictly necessary for the provision, security, maintenance, measurement and billing of the services, under the conditions set out in the DPA entered into with the customer.

4. Processing Carried Out, Purposes, Legal Bases and Retention Periods

Processing Purpose Legal basis Retention period Customer account management Creation and administration of the Account, provision of the services, support Performance of the contract Term of the contract. The account is considered inactive and deleted upon expiry of a period of 2 years from the user's last action. Upon expiry of the contract, the data strictly necessary for the establishment, exercise or defense of Arkane Cloud's rights are retained in intermediate archiving for the applicable limitation period (5 years), where such retention is necessary. Billing and accounting Issuance and retention of invoices, Performance of the contract for the data necessary for billing; Legal obligation for the retention of accounting records Term of the contract; 10 years (accounting records) from the close of the financial year Billing and accounting Collection of amounts due under the contract Legitimate interest Duration of the collection procedure, then intermediate archiving until expiry of the applicable limitation period (5 years) B2B prospecting Sales information intended for professionals Legitimate interest (development of Arkane Cloud's business activity) with the right to object at any time; Consent where required by applicable regulations 3 years from collection or from the last contact initiated by the prospect; where the processing is based on consent, until consent is withdrawn Audience measurement Producing traffic statistics for the site Legitimate interest (assessment of the site's audience) where the trackers benefit from the consent exemption; Consent otherwise 13 months for the trackers; 25 months for the information collected through them Contact, quote and demo requests Receipt and handling of requests, organization of exchanges, preparation of offers and follow-up of relationships with prospects Performance of pre-contractual measures (where the request comes from the prospective customer); Legitimate interest (response to solicitations received and business development) in other cases Period necessary to handle the request and, where the person qualifies as a prospect, 3 years from collection or from the last contact initiated by the prospect Support, assistance and request management Answering questions and assistance requests relating to the account, access and use of the services Performance of the contract; Legitimate interest (proof of requests received and responses provided) for intermediate archiving Period necessary to handle the request. Upon completion of the handling, the data necessary to prove the request and the response are retained in intermediate archiving for the applicable limitation period (5 years), where such retention is necessary. Provision, maintenance and measurement of the services Providing, maintaining and measuring the services, in particular their use, consumption and performance Performance of the contract, Term of the contract; then intermediate archiving of only the data necessary to prove or defend rights, for the applicable limitation period (5 years) Service improvement Improving the services and producing statistics, performance indicators and capacity analyses Legitimate interest Period necessary to achieve the purpose Complaints, pre-litigation and litigation Handling complaints, managing disputes and preserving information useful for the defense of Arkane Cloud's rights Legitimate interest (establishment, exercise or defense of Arkane Cloud's rights in court) Period necessary for the handling (+ applicable limitation period of 5 years). Where proceedings have been initiated, until all avenues of appeal have been exhausted Security and technical logs Security of the platforms, prevention of fraud and abuse Legitimate interest (security of information systems and prevention of fraud and abuse) / legal obligation where the law requires specific retention 12 months (technical logs), specific statutory periods where applicable, or the period strictly necessary to manage an incident or to defend the rights of Arkane Connection data (French Law on Confidence in the Digital Economy, LCEN) Retention of data enabling the identification of content creators Legal obligation 12 months Job applications Recruitment management Legitimate interest (selection of candidates); Pre-contractual measures where the processing aims to prepare the hiring of the selected candidate 2 years after the last contact

5. Recipients

The data are intended for the authorized departments of Arkane Cloud, to the extent necessary for the performance of their duties, in particular the teams in charge of account management, customer relations, support, security, billing, accounting, debt collection, prospecting and recruitment.

They may also be disclosed, to the extent strictly necessary, to the service providers and processors engaged by Arkane Cloud for the purposes described in this policy, in particular for the hosting of the Site, customer relationship management, prospecting, support, payment and accounting.

Service providers acting on behalf of Arkane Cloud as processors are subject to confidentiality and security obligations. Other recipients, where they themselves determine the purposes and means of the processing, are treated as separate controllers.

The main service providers identified are:

Hosting and infrastructure: OVH Cloud (hosting of the corporate website and console), Cloudflare (delivery and security of the Site), Stape (hosting of the server-side measurement infrastructure, in the European Union); IONOS SARL (Grafana hosting)
Customer relations, prospecting and support: HubSpot (CRM, marketing, meeting scheduling, landing pages and customer service), Microsoft 365 (email), Ringover (telephony) and Ringover Empower (recording and analysis of sales calls), Slack (internal messaging);
Outsourced prospecting and prospecting data: Lytup (business prospecting services and supply of prospect data), Cognism (enrichment of professional data), Lemlist (automation of prospecting campaigns by email and on LinkedIn, and enrichment of professional data, synchronized with HubSpot);
Billing, payment and accounting: Pennylane (billing and accounting), GoCardless (SEPA direct debits), Stripe (card payments on the Customer Console);
Customer Console: PostHog (analysis of the use of the Console, including recording of browsing sessions), Grafana (measurement of service consumption), Google (authentication via a Google account, at the user's choice), Cookiebot (consent management);
Audience measurement and advertising: Google (Google Tag Manager, Google Analytics, Google Ads), Microsoft (Clarity), LinkedIn, Reddit. These services are described in the Cookie Policy;
Internal artificial intelligence tools: Anthropic (Claude assistant, used by Arkane Cloud's teams for the analysis and administration of its sales management, audience measurement and advertising tools);
Recruitment: Ashby (management of job applications).

Summary by service provider:

Service provider Use Processing OVH Cloud Hosting of the corporate website and console Security and technical logs; Connection data (LCEN) IONOS SARL Grafana hosting Monitoring Cloudflare Delivery and security of the Site Security and technical logs; Audience measurement Stape Server-side measurement (EU) Audience measurement; B2B prospecting HubSpot CRM, marketing, meetings, landing pages, support B2B prospecting; Contact, quote and demo requests; Support; Customer account management Microsoft 365 Email B2B prospecting; Support; Exercise of rights Ringover Sales telephony B2B prospecting Ringover Empower Recording and analysis of calls Recording and analysis of sales calls Slack Internal messaging (notifications) Debt collection; Support Lytup Outsourced prospecting, prospect files B2B prospecting Cognism Enrichment of professional data B2B prospecting Lemlist Email and LinkedIn campaigns, HubSpot sync B2B prospecting Pennylane Billing and accounting Billing and accounting; Debt collection GoCardless SEPA direct debits Billing and accounting; Debt collection Stripe Card payments on the Console Billing and accounting; Customer account management PostHog Analysis of the Console, session recording Service improvement, Analysis of the user journey in the Console Grafana Consumption measurement Provision, maintenance and measurement of the services Google (authentication) Login to the Console with a Google account Customer account management Cookiebot Consent on the Console Audience measurement Google (GTM, Analytics, Ads) Audience measurement and advertising Audience measurement; B2B prospecting Microsoft (Clarity) Audience measurement Audience measurement LinkedIn Measurement and advertising Audience measurement; B2B prospecting Reddit Measurement and advertising Audience measurement; B2B prospecting Anthropic Internal AI assistant Cross-cutting (prospecting, audience measurement, service improvement) Ashby Management of job applications Job applications Numbr Chartered accounting firm Billing

The data may also be disclosed to third parties, in particular administrative or judicial authorities or legally authorized bodies, where such disclosure is required by law, a regulatory provision or a court decision, or is necessary for the establishment, exercise or defense of Arkane Cloud's rights.

Finally, the data may be disclosed to any third party concerned by a transaction affecting the structure or assets of Arkane Cloud, in particular a sale, a partial contribution of assets, a merger or a transfer of all or part of its business, as well as to the advisors involved in such transaction, to the extent strictly necessary for its preparation and completion. The transferee is then required to process the data in accordance with this policy.

Lastly, certain browsing data may be collected directly on the Site by third parties placing trackers, in particular Google, Microsoft, LinkedIn and Reddit. Such placement only takes place, apart from strictly necessary trackers, according to the choices you express by means of the cookie banner, under the conditions described in the Cookie Policy, to which reference is made for the identity of these third parties and the purposes pursued.

Arkane Cloud may transmit personal data of its customers or prospects to business partners in order to enable them to carry out their own business prospecting. Such sharing will be subject to informed consent at the time of collection and only in the context of co-marketing operations. Data subjects are informed, at the time of collection, of the categories or identity of the partners concerned.

6. Location and Transfers

The data are hosted in the European Union.

The data of Arkane Cloud's HubSpot account are hosted in the European Union (Germany), on Amazon Web Services infrastructure.

However, even where data are hosted in the European Union, certain processing operations continue to be carried out by HubSpot, Inc. in the United States (in particular analytics functions, customer support, product development).

These transfers are based on Commission Implementing Decision (EU) 2023/1795 of July 10, 2023, which finds that the United States ensures an adequate level of protection for personal data transferred to organizations certified under the EU-U.S. Data Privacy Framework. HubSpot, Inc. is certified under this framework. The list of certified organizations can be consulted at https://www.dataprivacyframework.gov.

HubSpot, Inc. uses sub-processors, including certain companies of its group, established in the European Union and in third countries. The list of these sub-processors, their purpose and their country of establishment is published and kept up to date by HubSpot at the following address: https://legal.hubspot.com/sub-processors-page.

HubSpot remains bound, under the data processing agreement entered into with Arkane Cloud, not to carry out any transfer to a country or recipient that does not provide an adequate level of protection without having first implemented the safeguards required by Chapter V of the GDPR.

With regard to the artificial intelligence features of the HubSpot platform (Breeze): for accounts hosted in the European Union data center, such as Arkane Cloud's account, the processing of data by the AI features takes place entirely in regions of the European Economic Area or in Switzerland, a country recognized as ensuring an adequate level of protection. HubSpot states that it does not authorize the third-party model providers it uses (such as OpenAI or Google) to use its customers' data to train their models, and that it requires these providers, wherever possible, not to retain the data.

Arkane Cloud has furthermore disabled the use of its data by HubSpot for training HubSpot's internal models.

Certain third parties placing trackers on the Site, identified in the Cookie Policy, are established or process data in the United States. These transfers are governed by the aforementioned Implementing Decision (EU) 2023/1795 for companies certified under the EU-U.S. Data Privacy Framework or, failing that, by the Standard Contractual Clauses (SCCs) adopted by the European Commission.

Service provider Country of establishment Anthropic United States Ashby United States Slack United States Cloudflare United States Stripe Ireland, with transfers to the United States Cognism United Kingdom

7. Data Subjects' Rights

Every data subject has the rights of access, rectification, erasure, restriction, objection and portability, under the conditions of Articles 15 to 22 of the GDPR, as well as the right to set out instructions regarding the fate of their data after their death.

These rights may be exercised by sending a request:

by email to the following address: [email protected];
by post to the following address: Arkane, 55 ter avenue René Cassin, 69009 Lyon, France

Arkane Cloud responds to any request within one (1) month of its receipt. This period may be extended by two (2) months where the request is complex or where the number of requests to be processed is high. Arkane Cloud then informs the data subject of such extension and of the reasons for the delay within one month of receipt of the request.

Where necessary and proportionate, in particular in the event of reasonable doubt as to the identity of the requester, Arkane Cloud may request additional information in order to verify such identity.

Where the processing is based on consent, the data subject may withdraw such consent at any time, without such withdrawal affecting the lawfulness of the processing carried out before such withdrawal.

Every data subject also has the right to lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), the French Data Protection Authority, in particular via its website www.cnil.fr.

8. Security

Arkane Cloud implements appropriate technical and organizational measures to protect the data against destruction, loss, alteration and unauthorized access.

9. Updates

This policy may be updated, in particular to reflect changes in Arkane Cloud's practices or to ensure compliance with the regulations in force.

The version in force, identified by its date, is permanently published on the site.

In the event of a substantial change, Arkane Cloud may, where appropriate, draw users' attention to the new version by means of a message or an information mechanism on the site.