Your data

Privacy policy

What we collect, why, who else sees it and how long we keep it. Written to be read, not to be survived.

Last updated: 20 August 2026GDPR, French Data Protection Act

The short version

We never sell your data, and we never use the content of your websites to advertise to anyone.
We ask for an email address, we bill you if you publish, and we host what you create. That is the whole story.
Card numbers never reach our servers: Stripe handles payment.
The websites you build are yours. On them, you are the data controller and we only act on your instructions.
You can access, export or delete your data at any time by writing to jeremy@webevolutis.com.

Who is responsible

Personal data collected on communik.io and through the Communik service is processed by Webevolutis, a French SARL registered under RCS Bordeaux 480 535 251, whose registered office is 5 allée des Douves, 33470 Gujan-Mestras, France. Webevolutis is the data controller for that processing.

Given our size and our activity, we are not required to appoint a data protection officer and we have not appointed one. Privacy questions go to jeremy@webevolutis.com and are answered by the company management.

What we collect

Account data: Email address, name, password (stored hashed) or the identifier of the third-party account you sign in with, plus your language and interface preferences.
Billing data: Billing name and address, VAT number, plan, invoice history. Card details are entered on Stripe pages and never stored by us.
Content you create: Pages, texts, images, files, collections and settings of the sites you build, together with the data collected by those sites (form submissions, members, comments).
Usage and technical data: Connection logs, IP address, browser and device, pages viewed, errors, and the actions performed in the editor. Audience statistics on communik.io are measured with our own first-party tool.
Support and marketing: Messages you send us through the contact form or the chat, and the page or campaign that brought you to us when you sign up.

Why, and on what legal basis

Running the service, hosting your sites: Performance of the contract between you and us.
Billing, invoicing and accounting: Legal obligation, and performance of the contract.
Security, fraud and abuse prevention, and improving the product: Our legitimate interest in keeping a service that works and is not abused.
Support conversations: Performance of the contract, or our legitimate interest in answering you.
Product news and commercial emails: Your consent, which you can withdraw in one click from any of those emails.
AI assistance in the editor: Performance of the contract, when you ask the assistant to write or modify something. Your prompt and the content concerned are sent to the AI provider selected for the request; they are not used to train third-party models.

We take no decision producing legal effects about you on a purely automated basis, and we do not profile you.

Who processes data for us

We use a small number of providers, each bound by a data processing agreement and acting only on our instructions. The current list:

OVHcloud, France: Hosting of the platform, the databases and the published sites. European Union.
Cloudflare, United States and worldwide: Content delivery network, protection against attacks, media storage.
Stripe, Ireland and United States: Payments and subscription management. Stripe is the controller for the payment data it collects.
Postmark, United States: Transactional emails, such as sign-up confirmations and notifications.
Brevo, France: Newsletters and product emails, when you have subscribed.
Crisp, France: The chat on communik.io, when you open a conversation.
Iconify, United Kingdom: Icon delivery on communik.io. Your IP address is visible to that service when an icon loads.
Google, United States: Only if you choose to sign in with a Google account.
AI providers: Anthropic, OpenAI, Google or Mistral, depending on the model used, and only for the requests you send to the assistant.

We also disclose data when the law requires it, for instance to answer a valid request from a court or an authority. We do not sell personal data, and we do not share it with advertising networks.

Transfers outside the European Union

Your account data and your sites are hosted in the European Union. Some of the providers listed above are established outside the EU or may process data there. Those transfers are covered by the European Commission standard contractual clauses, and where applicable by the EU to US Data Privacy Framework, together with the technical measures each provider documents.

How long we keep it

Account and sites: For as long as your account is open, then deleted within 30 days of closure. Backups are overwritten within 90 days.
Invoices and accounting records: 10 years, as required by French commercial law.
Connection logs: 12 months at most, then deleted.
Support conversations: 3 years after our last exchange.
Marketing consent: 3 years after your last interaction with us, or until you unsubscribe.
Audience statistics: 25 months, in aggregated form.

Your rights

Under the GDPR and the French Data Protection Act, you may ask us for access to your data, its correction, its deletion, a copy in a portable format, the restriction of a processing, and you may object to a processing based on our legitimate interest. Where a processing rests on your consent, you may withdraw it at any time, without affecting what was done before. You may also give instructions on what should happen to your data after your death.

Write to jeremy@webevolutis.com. We answer within one month, and we may ask for proof of identity if the request is unclear about who is making it. If our answer does not satisfy you, you can lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or with the supervisory authority of the country you live in.

Security

Traffic is encrypted in transit, passwords are hashed, access to production is restricted and logged, and data is backed up regularly. No system is perfect: if a breach were to affect your rights, we would notify the CNIL within 72 hours and tell you directly when the risk is high.

The sites you build with Communik

On your own website, you decide what is collected and why: you are the data controller, and Communik is your processor. We process that data only to run your site and only on your instructions, we keep it inside the same hosting arrangements described above, and we give you the tools to export it, delete it and manage consent.

This section, together with the terms of service, forms the data processing agreement required by article 28 of the GDPR between you and Webevolutis. Ask us at jeremy@webevolutis.com if you need it as a separate signed document, or if you want to be notified of any change in the list of providers above.

Children, and changes to this policy

The service is not intended for people under 15. If you believe a child has created an account, tell us and we will close it.

We update this policy when the service changes. The date at the top always reflects the current version, and any significant change is announced by email or in the editor before it takes effect.