This policy describes how Ethan Morisset, as data controller, collects and uses your personal data when you use the Maestro Deck Service, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi Informatique et Libertés).
1. Data controller
- Ethan Morisset — 107 rue Ambroise Croizat, 94800 Villejuif, France
- SIREN: 105 136 501 — SIRET: 105 136 501 00019
- Contact: contact@maestrodeck.cloud
2. Data collected, purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Account creation and management | Email, name (sign-in with Apple, Google or GitHub), phone number (phone sign-in), Firebase identifier, authentication method | Performance of the contract |
| Billing and payment | Email, order history, payment provider identifiers (Stripe or Stancer depending on your country); banking details are processed directly by the payment provider and never pass through our servers | Performance of the contract / legal obligation (accounting) |
| Running Maestro tests | Uploaded files, test scripts, run results and logs | Performance of the contract |
| Security and fraud prevention | IP address, access logs, signals of abnormal use | Legitimate interest |
| Answering support requests | Email and content of the exchanges | Legitimate interest |
| Billy assistant in the iOS app (written and spoken answers) | Written questions, voice recordings and conversation history; when you ask Billy about a run: the report, steps, flows, end of the logs and screenshot of that run only | Consent (collected in the app before first use, can be withdrawn at any time in Account → Settings) |
| iOS app usage analytics | Screens and features used, Billy usage events (without the content of questions or runs), Firebase account identifier, device model and iOS version | Consent (collected in the app, can be withdrawn at any time in Account → Settings) |
| Audience measurement for maestrodeck.cloud | Pages visited, browsing path, interactions, pseudonymized technical identifier, truncated IP address | Consent (collected through the cookie banner) |
3. Retention periods
- Account data: until the user deletes their account, followed by any legally required archiving;
- Billing data: 10 years (accounting obligation, article L123-22 of the French Commercial Code);
- Uploaded files (applications, binaries) and generated artifacts (screenshots, videos, detailed logs): 30 days from the end of the run, deleted automatically by the hosting provider;
- Run metadata (identifier, status, duration, timestamp, pack used), excluding user content: kept for the lifetime of the account to maintain usage and billing history;
- Questions, voice recordings and answers from the Billy assistant: not kept by Maestro Deck beyond processing the request; they may be kept temporarily by Mistral AI under its own terms;
- Technical and security logs: 12 months maximum.
4. Processors
Data is processed by the following processors, bound by contracts compliant with article 28 of the GDPR:
Scaleway SAS (French hosting provider) — runs on iOS / macOS runners. Data is hosted in France.
Google Ireland Limited (GCP contracting entity for the EU) — runs on Android runners, hosting of the application infrastructure (dashboard) and authentication (Firebase Authentication). Data is physically stored in the europe-west1 region (St. Ghislain, Belgium). Some technical transfers to the United States may occur (platform administration, support), covered by the European Commission's standard contractual clauses and the Data Privacy Framework.
Stripe Payments Europe, Ltd. — payment processing for customers located outside the European Union. Stripe acts as an independent controller for its fraud prevention and financial compliance obligations. See stripe.com/privacy.
Stancer (ILIAD 78, SAS) — payment processing for customers located in the European Union. Payment institution authorized by the ACPR (CIB code 11758), registered with the Paris Trade and Companies Register under number 834 315 673, registered office 16 rue de la Ville l'Évêque, 75008 Paris. Banking details are processed directly by Stancer (PCI-DSS compliant) and never pass through our servers. Stancer acts as an independent controller for its regulatory obligations. See stancer.com.
PostHog (PostHog Ireland Ltd) — website audience measurement and iOS app usage analytics, only after consent. Data is hosted and processed exclusively in the European Union (EU Cloud region, Frankfurt). See posthog.com/eu-cloud and posthog.com/privacy.
Mistral AI SAS (French company, Paris) — operation of the Billy assistant in the iOS app: generating answers, transcribing spoken questions and reading answers aloud, only after your consent. Mistral AI receives the content of your questions (and, where applicable, the data of the run you submit), but not your name, email address or account identifiers. See mistral.ai/terms.
5. Transfers outside the EU
Ethan Morisset does not transfer any data outside the EU directly. Payments from European Union customers are processed by Stancer, a French payment institution, within the EU. Transfers may occur through our other processors (in particular Stripe for customers outside the EU and for financial compliance); these transfers are covered by appropriate safeguards (standard contractual clauses, Data Privacy Framework).
6. Your rights
Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability of your data, as well as the right to set instructions regarding what happens to it after your death. You can exercise these rights by writing to contact@maestrodeck.cloud. You also have the right to lodge a complaint with the CNIL (cnil.fr), the French data protection authority.
7. Security
Ethan Morisset implements reasonable technical and organizational measures to protect data: encryption in transit (TLS), encryption at rest on the Scaleway and GCP infrastructure, access control with strong authentication, access logging, and isolation of execution environments.
8. Cookies
The use of cookies, including the PostHog audience measurement cookie that requires your consent, is detailed in the cookie policy.
9. Changes
This policy may be updated. The date of the last update is shown at the top of the page. Substantial changes are notified in advance.