Privacy notice

Who is responsible

Atelier Source Clair is a research collective that studies how AI engines cite and attribute French business sources. For the purposes of the General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés), the controller of the personal data described below is Atelier Source Clair, operator of the site aicitationsfrance.com. For any privacy question or to exercise a right, write to hello@aicitationsfrance.com.

What is collected

When you send a citation case through the contact form, Atelier Source Clair receives:

• Your name and email — to reply to you by name.
• The text you write in the case fields: the prompt, the answer excerpt, the cited page, the suspected original source and any additional notes — only what you decide to share.

This data is used only to review the citation case you sent. You are not added to any mailing list, and your data is not shared with third parties (with the exception of the payment processor described below, where applicable). Atelier Source Clair also keeps the date and time the form was submitted, together with a SHA-256 hash of your IP address plus a salt — this protects the form against automated submissions. The IP address itself is never recorded, nor are browser fingerprints or device metadata.

What is not collected

• No tracking cookies are used. The analytics tool runs without cookies and stores no per-user identifier.
• No remarketing pixels, marketing-automation tags, or ad-network trackers are enabled.
• There is no automated profiling, and no automated decision producing legal effects on you.
• Personal data is neither sold nor transferred to commercial partners. That is not the lab's purpose.

Legal basis for processing

Citation cases sent through the form are processed on the basis of Article 6(1)(f) of the GDPR (legitimate interest in reviewing public-evidence citation cases relevant to the lab's research). The IP hash, which protects the form against abuse, relies on the same legitimate-interest basis. Payment status data, where it exists, is processed on the contractual basis.

How long data is kept

• Citation cases: kept for the duration of the related review plus 24 months, to preserve the context of the source trail; after that, they are deleted. Cases that do not lead to review are kept for 12 months and then deleted.
• Payment records: kept for the period required by applicable tax and accounting law, then deleted.
• IP hashes: kept for 90 days — long enough for abuse protection — then deleted.
• Email exchanges: kept while the exchange is active, or for 24 months after the last contact — whichever is longer.

Your rights

Under the GDPR and the French Data Protection Act, you can request access to your data, its rectification, erasure, portability, restriction of processing, or object to it. For any of these requests, write to hello@aicitationsfrance.com. A reply follows within one month. If you believe the processing does not comply with the law, you have the right to lodge a complaint with the CNIL (the French data protection authority), or with the supervisory authority of your country of residence.

International transfers

The infrastructure that serves this site is located in European Union (Germany). Where additional processors (email provider) operate outside the European Union, those transfers rely on standard contractual clauses and on the safeguards published by the recipient.

Changes to this notice

This notice is updated when data-processing practices change significantly. The "Updated" date at the top of the page marks the version in force. Substantive changes stay flagged on the site's home page for 30 days, so they are visible to returning visitors.