Privacy policy
Last updated: October 26, 2026
This policy explains how DEEPFIRST SAS (“DeepFirst”, “we”, “us”) processes the personal data of users of the DeepFirst platform available at app.deepfirst.ai (the “Platform”). It supplements our Terms of Service, Terms of Use and Legal Notice. Our marketing website deepfirst.ai is not covered by this policy.
1. Who we are
The data controller is DEEPFIRST SAS, a French simplified joint-stock company with a share capital of €5,000, whose registered office is at 55 rue Grignan, 13006 Marseille, France, registered with the Marseille Trade and Companies Register under number 101 131 183.
For any question about your personal data, or to exercise your rights, write to support@deepfirst.ai or by post to our registered office, for the attention of Vincent Locanetto.
2. Our role: controller or processor
DeepFirst acts in two capacities:
- as controller for account management, billing, Platform security, support and product analytics. This policy describes that processing;
- as processor (Article 28 GDPR) for your organisation, for the content it configures in the Platform (brands, competitors, prompts…) and for the AI responses collected on its behalf. Your organisation is the controller of that data; we process it only to provide the service, on its instructions, under a data processing agreement (DPA) available on request.
If you are named in an AI response collected for one of our customers (for example because a brand carries your name), you can exercise your rights with that customer or write to us: we will forward your request to the customer concerned.
3. Data we process
- Account data: name, email address, profile picture, account ID, the organisations you belong to and your role (owner, admin or member), sign-in logs (IP address, browser, date and time). Your password is handled by our authentication provider and stored hashed; DeepFirst never has access to it.
- Organisation and team data: organisation name, members’ email addresses and roles, invitations sent.
- Brand and prompt configuration: brand name, website, description, aliases and domains, competitors, themes, scenarios, prompts, target countries and languages.
- Collected AI responses: text of the answers returned by the AI engines we query (ChatGPT, Gemini, Claude, Google AI Overview, Google AI Mode), cited sources, brand mentions and computed metrics (visibility, share of voice, sentiment). These answers are written by third parties and may mention individuals.
- Billing data: Stripe customer ID, plan and subscription status. Your name, billing address, VAT number, payment method and invoices are collected and kept by Stripe on our behalf; we never have access to your full card number. Stripe also receives your organisation’s internal ID and name and, where relevant, the internal ID of the brand being set up, to link the subscription. Older subscriptions carry the brand’s ID and name instead.
- Usage data: pages viewed, clicks and interactions, session recordings, browser console messages, errors, device and browser type, network request URLs and timings. This data is linked to your user ID, name, email, organisation, role and plan. IP addresses are not kept (see section 5).
- Support and feedback: the content of your emails and, for feedback sent from the built-in feedback tool, the title, description, a screenshot of the page (not masked: it can contain displayed data and form contents), URL, browser, window size, an HTML excerpt (at most 400 characters) of the selected element and, if available, a link to the session recording.
- Technical logs: server requests and errors and application logs, which may contain user or organisation IDs, query excerpts, generated prompt text and error details.
We do not ask for any special-category data (health, political or religious opinions, etc.). Please do not enter any in your prompts.
4. Purposes and legal bases
| Purpose | Legal basis (Article 6 GDPR) |
|---|---|
| Create and manage your account, authenticate you, manage organisations and invitations | Performance of the contract (6(1)(b)). For users invited by their organisation, the legitimate interest of DeepFirst and of the organisation in providing the subscribed service (6(1)(f)). |
| Provide the service: query AI engines with your prompts, analyse the responses, display dashboards and recommendations | Performance of the contract (6(1)(b)). DeepFirst then acts on behalf of your organisation (section 2). |
| Manage subscriptions, payments and invoicing | Performance of the contract (6(1)(b)) and legal obligation to keep accounting records (6(1)(c)). |
| Secure the Platform, prevent fraud and abuse, troubleshoot incidents | Legitimate interest in protecting the Platform and its users (6(1)(f)). |
| Measure usage and improve the Platform (product analytics, session recordings, heatmaps, error tracking) | Legitimate interest in understanding how the Platform is used and fixing it (6(1)(f)). You can object (section 5). |
| Answer your requests and handle your feedback | Legitimate interest (6(1)(f)), or performance of the contract when the request concerns the subscribed service (6(1)(b)). |
| Produce aggregated, anonymised statistics (Article 9 of the Terms of Use) | Legitimate interest in improving our services (6(1)(f)). |
| Comply with our legal obligations and answer requests from authorities | Legal obligation (6(1)(c)). |
None of this processing currently relies on your consent. If we ever set non-essential trackers or process your data for a purpose that requires consent, we will ask for it first, and you will be able to withdraw it at any time.
We make no decision based solely on automated processing that produces legal effects concerning you (Article 22 GDPR). We do not sell your data or use it for advertising.
5. Product analytics, session recordings and error tracking
To understand how the Platform is used, fix errors and improve the service, we use PostHog, hosted in the European Union (Frankfurt). When you are signed in, PostHog collects:
- the pages you view and your interactions (clicks, including to build heatmaps and spot clicks that have no effect);
- session recordings (currently enabled), i.e. a reconstruction of what is displayed on screen and of your interactions;
- browser console messages and technical errors;
- performance measurements, including network request URLs and timings (not their content).
The following safeguards apply:
- text typed into form fields is masked in recordings. Text displayed on screen (brand names, prompts, results) may, however, appear in them;
- you type your password on our authentication provider’s page, which is not recorded;
- IP addresses are discarded by a setting of our PostHog project, and PostHog stores no cookie or other data on your device (in-memory storage only);
- session recordings are deleted after 30 days;
- AI-call tracing omits raw inputs and outputs by default (only model, volume, cost and duration are tracked). Application logs, also sent to PostHog, can however contain query excerpts, generated prompt text and error details;
- this data is neither sold nor used for advertising.
This processing relies on our legitimate interest in providing a reliable Platform and improving it. You can submit an objection at any time to support@deepfirst.ai; we will respond within one month.
7. Recipients and subprocessors
Your data is accessible only to authorised DeepFirst staff and, depending on their role, to members of your organisation. We use the subprocessors below, which process data only on our instructions. The up-to-date list, with the data each one processes, is published on our Subprocessors page.
| Provider | Purpose | Location | Transfer safeguards |
|---|---|---|---|
| Microsoft AzureMicrosoft Ireland Operations Ltd | Hosting of the Platform and its collection worker, database, job queue, secrets management, technical logs and scheduled jobs. Sending of internal summary emails (Azure Communication Services Email). | European Union. Core infrastructure in the Azure “France Central” region (France). Internal summary emails via Azure Communication Services Email, “Europe” data location. | Governed by Microsoft’s DPA (Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework) for any access from a third country. |
| Azure AI Foundry (Azure OpenAI)Microsoft Ireland Operations Ltd | Website analysis when a brand is set up (including web search), prompt suggestions, analysis of collected AI responses (mentions, sentiment, sources), source categorisation and an internal daily operations summary. | Resource hosted in the “France Central” region. Depending on the model deployment type, inference may be processed in another Azure region, including outside the EU. Web searches go through Microsoft’s Bing service. | Governed by Microsoft’s DPA (Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework) for any access from a third country. |
| Oxylabs | Collection of Google search results (AI Overview, AI Mode) for the prompts you configure. | Lithuania (EU). Queries may be run from the target country. | Provider established in the EU. Any transfer is governed by its DPA. |
| OpenAI APIOpenAI | Querying OpenAI models (the “ChatGPT” surface), including web search, with the prompts you configure. | United States. | European Commission Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. |
| Anthropic APIAnthropic | Querying Anthropic models (the “Claude” surface), including web search, with the prompts you configure. | United States. | European Commission Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. |
| Google Gemini APIGoogle LLC | Querying Gemini models (the “Gemini” surface), grounded in Google Search, with the prompts you configure. | United States. | European Commission Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. |
| Auth0Okta, Inc. | Authentication, management of accounts, organisations and invitations, verification and invitation emails. | European Union (EU-hosted Auth0 tenant). | Data hosted in the EU. Access from the United States for support is governed by Okta’s DPA (Standard Contractual Clauses and, where applicable, the Data Privacy Framework). |
| StripeStripe Payments Europe, Ltd | Subscription payments, invoicing, VAT calculation and the billing portal. | Ireland (EU), with processing by other Stripe group entities, including in the United States. | European Commission Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. |
| PostHogPostHog, Inc. | Product analytics, session recordings, heatmaps, error tracking, application logs and technical monitoring of AI model calls. | European Union (PostHog EU Cloud, Frankfurt, Germany). | Data hosted in the EU. Access from a third country for support is governed by PostHog’s DPA (Standard Contractual Clauses, where applicable). |
| Microsoft 365Microsoft Ireland Operations Ltd | Email (the support@deepfirst.ai mailbox) and internal team chat that receives technical alerts. | European Union (Microsoft EU Data Boundary). | Governed by Microsoft’s DPA (Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework) for any access from a third country. |
| LinearLinear Orbit, Inc. | Tracking of feedback and bug reports sent from the Platform’s built-in feedback tool. | United States. | European Commission Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. |
We may also disclose data to authorities when the law requires it.
8. Transfers outside the European Union
The Platform and its database are hosted in the European Union (Azure “France Central” region). Some providers, however, process data outside the European Union, in particular in the United States: the AI model providers (OpenAI, Anthropic, Google), Azure AI Foundry depending on how the models are deployed, Stripe and Linear. Other providers may occasionally access data from outside the EU for support.
These transfers are governed by the Standard Contractual Clauses adopted by the European Commission and, where the provider participates in it, the EU-US Data Privacy Framework. You can obtain a copy of the applicable safeguards by writing to support@deepfirst.ai.
The AI providers used to simulate answers (OpenAI, Anthropic, Google) receive prompt text and scenario context, with target-country information where supported. Oxylabs receives prompt text as a search query, with the target country. Azure AI Foundry additionally receives brand information, collected responses, source information and aggregated operational metrics for analysis and service operation. We do not automatically attach account names, email addresses or account IDs to AI-provider requests. Submitted content and collected responses may nevertheless contain personal information.
9. How long we keep data
| Data | Retention period |
|---|---|
| Account and organisation data | For as long as your account exists. On request, deleted within 30 days. Deleting an organisation in the Platform (possible once its brands are deleted) erases its data from our database; deletion of the matching Auth0 organisation is then attempted. It does not erase your Auth0 user account or copies held by PostHog, Linear or Stripe, which we delete on request. |
| Brand and prompt configuration | Until an owner or admin of your organisation deletes it (immediate; a brand cannot be deleted while its subscription is active, trialing, past due or incomplete) or the account is closed. |
| Collected AI responses, analyses and citations | A daily job deletes analyses older than 90 days and the matching AI responses, with their citation records. Source-domain records are kept until the brand is deleted. |
| Database backups | 35 days (automatic rotation). Deleted data disappears from backups at the end of this period. |
| Invoices and accounting records | 10 years from the end of the financial year (Article L123-22 of the French Commercial Code), in Stripe and in our accounts. Cancellation ends the subscription but does not automatically erase the Stripe customer record; we can delete it on request, subject to the records the law requires us to keep. |
| Session recordings | 30 days. |
| Product analytics events and error reports | As long as our PostHog plan retains them, at most 7 years. You can ask us to delete them at any time. |
| Technical logs | Azure Log Analytics: 30 days. App Service HTTP logs: 7 days. Application logs sent to PostHog: PostHog’s retention period. |
| Support and feedback | As long as needed to handle your request, then at most 3 years after our last exchange. |
10. Security
We apply technical and organisational measures suited to the risks, including:
- hosting in the European Union on Microsoft Azure, with encryption of data at rest;
- the Platform supports HTTPS and sends HSTS headers; database connections require TLS;
- authentication delegated to Auth0: DeepFirst stores no passwords;
- secrets (API keys, database credentials) kept in Azure Key Vault;
- data separated by organisation, with access rights based on role (owner, admin, member);
- security headers (CSP, HSTS), API rate limiting and signature checks on payment notifications;
- automatic backups allowing point-in-time restore over 35 days;
- minimisation: no account name, email or ID is attached automatically to AI-provider requests, and IP addresses are not kept in product analytics.
If a personal data breach puts your rights at risk, we notify the CNIL and, where required, the people affected, as provided by the GDPR.
11. Your rights
Under the GDPR and the French Data Protection Act of 6 January 1978, you have the following rights:
- access to your data (Article 15 GDPR);
- rectification (Article 16);
- erasure (Article 17);
- restriction of processing (Article 18);
- data portability (Article 20);
- objection to processing based on our legitimate interest, including product analytics (Article 21);
- withdrawal of your consent where processing relies on it;
- setting instructions on what happens to your data after your death (Article 85 of the French Data Protection Act).
To exercise your rights, write to support@deepfirst.ai or by post to our registered office. If we have reasonable doubts about your identity, we may ask you to prove it. We answer within one month, which may be extended by two months for complex requests (Article 12 GDPR). For data we process on behalf of your organisation (section 2), we forward your request to that organisation and help it respond.
You can lodge a complaint at any time with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr, or with the supervisory authority of the EU country where you live or work.
12. Changes to this policy
We may update this policy to reflect changes to the Platform, our providers or the law. The date of the last update appears at the top of this page. If we make a significant change, we will tell you by email or in the Platform.