← Back to ApreshAI

Privacy Policy

Last updated: October 2026

SASU BLOWBACK CIE ("we", "us", "ApreshAI") respects your privacy. This policy explains how we collect, use, and protect your personal data in compliance with the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

🏢 Data Controller

SASU BLOWBACK CIE

10 rue de Penthièvre, 75008 Paris, France

Contact: contact form

📋 Data We Collect

Information you provide:

  • Email address (account creation)
  • Business context information (website URL, business model, goals)
  • Chat conversations with the AI
  • Payment information (processed by Stripe, we don't store card details)

Information collected automatically:

  • IP address and browser type
  • Usage data (features used, session duration)
  • Device information

How We Use Your Data

  • Service delivery: Provide personalized SEO recommendations
  • Account management: Authentication, subscription management
  • Communication: Service updates, support responses
  • Improvement: Analyze usage to improve our AI and features
  • Legal compliance: Fraud prevention, legal obligations

⚖️ Legal Basis (GDPR)

  • Contract: Processing necessary to provide the service you subscribed to
  • Legitimate interest: Service improvement, fraud prevention
  • Legal obligation: Tax and accounting requirements
  • Consent: Marketing communications (if opted-in)

🔗 Third-Party Services

We share data with trusted service providers:

  • Stripe (USA) - Payment processing
  • Supabase (USA) - Database and authentication
  • Vercel (USA) - Hosting
  • Mistral AI (France) - AI processing
  • Google (USA) - Search Console and Google Analytics, only if you connect them (see below)
  • DataForSEO (Estonia, EU) - Live Google data read on demand when you ask: rankings for your keywords, search volumes, backlink comparisons with competitors and Google Business Profile reviews. Only keywords, domains and business names are sent, never your account details

These providers are contractually bound to protect your data. Data transfers to the USA are covered by Standard Contractual Clauses (SCCs).

🔐 Google User Data (Search Console & Google Analytics)

You can choose to connect your Google Search Console and/or Google Analytics 4 account. Nothing is accessed until you click "Connect" and grant access on Google's own consent screen.

What we access

  • Google Search Console (scope webmasters.readonly, read-only): the list of your verified properties, and search performance data for the property you select (queries, pages, clicks, impressions, CTR, average position, device, sitemaps).
  • Google Analytics 4 (scope analytics.readonly, read-only): the list of your GA4 properties, and aggregated reports for the property you select (sessions, engaged sessions, engagement rate, key events and revenue by channel, landing page and week).

We never write, change or delete anything in your Google accounts. We do not access user-level or personally identifiable data about your website visitors: only aggregated reports.

How we use it

  • Only to provide the features you use: answering your SEO questions with your real data, building your SEO strategy and diagnostics, and the exports you request.
  • To generate an answer, the relevant figures are sent to our AI provider (Mistral AI) solely to produce that answer for you.
  • We do not use Google user data to develop, improve or train generalized AI or machine-learning models.
  • We do not sell it, use it for advertising, or share it with anyone other than the service providers listed above, which process it only on our behalf to run the service.
  • No human at ApreshAI reads it, unless you ask us to for support, it is needed for security or legal reasons, or it has been aggregated and anonymized.

How we store and protect it

  • Google access tokens are encrypted at rest (AES-256) and never sent to your browser, to the AI model or to logs.
  • Search Console data you sync, and Google Analytics per-page aggregates (sessions, key events, revenue), are stored in our database so your strategy can use them, in an account only you can access.
  • All transfers use HTTPS.

How to remove it

  • Click "Disconnect" in the Context menu: we revoke our access with Google and delete the stored token and the data imported from that account.
  • You can also revoke access at any time from your Google Account (Security, Third-party connections). Closing your ApreshAI account deletes all of it.

ApreshAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

🗓️ Data Retention

  • Account data: Duration of your account + 3 years
  • Conversation history: Until you delete it or close your account
  • Payment records: 10 years (French legal requirement)
  • Usage logs: 12 months

✋ Your Rights

GDPR Rights (EU residents):

  • Access: Request a copy of your data
  • Rectification: Correct inaccurate data
  • Erasure: Request deletion of your data
  • Portability: Receive your data in a portable format
  • Restriction: Limit how we use your data
  • Objection: Object to certain processing

CCPA Rights (California residents):

  • Know what personal information is collected
  • Request deletion of personal information
  • Opt-out of the sale of personal information (we do not sell data)
  • Non-discrimination for exercising your rights

To exercise your rights, contact us. We will respond within 30 days.

🍪 Cookies

We use essential cookies for:

  • Authentication (keeping you logged in)
  • Security (preventing fraud)
  • Preferences (storing your settings)

We do not use advertising or tracking cookies.

🔒 Security

We implement industry-standard security measures including encryption in transit (HTTPS), secure authentication, and regular security audits. Payment data is handled entirely by Stripe (PCI-DSS certified).

👶 Children's Privacy

ApreshAI is not intended for users under 16 years of age. We do not knowingly collect data from children.

Policy Changes

We may update this policy periodically. Material changes will be notified via email. The "last updated" date will reflect the latest revision.

📧 Contact & Complaints

For privacy-related questions or to exercise your rights:

Email: contact form

EU residents may also lodge a complaint with your local data protection authority. In France: CNIL.