Privacy
Last updated 28 July 2026
Written in plain language by the people who built this, not by a lawyer. It describes what the software actually does, which is the part we can state accurately. The marked passages need review before this processes data at any scale.
Who we are
ReBiz is operated by Yannick AST, 7 rue d’Altheim, 57720 Ormersviller, France. For anything in this document, including access and erasure requests, write to support@rebiz.app.
A data controller can be a person rather than a company, and at this stage that is what it is. Nothing in this document depends on that — the rights below are the same either way.
Add the SIREN to this line as soon as one is issued. Until then this document is complete without it — a natural person is a valid controller, and the identification the LCEN asks for is a name and a domicile, both of which are above.What we collect
Three separate things, with different sources and different reasons.
Business data. Publicly listed information about businesses: name, address, phone number, website, Google rating and review count, obtained through the Google Places API. Where a business publishes a contact email address on its own website, we record that address and which page it was found on.
Website technical metadata. For each business website we record measurable facts about the page: whether it loads, how quickly, whether it has a valid certificate, whether it is usable on a phone, whether analytics or advertising tags are present, and whether a contact form exists. We read the public page as any visitor would, we respect robots.txt, and we do not attempt to access anything that is not publicly served.
Account data. Your email address and authentication details, held by our identity provider (Clerk); your plan, scan quota and scan history; and, if you subscribe, a customer identifier from our payment provider (Stripe). We never see or store card numbers.
What we do not collect
No data about consumers or private individuals. We scan businesses, not people, and we do not build profiles of anyone’s customers. We do not use advertising cookies or third-party trackers on this site.
Some of what we collect is nonetheless personal data — a sole trader’s business is often their own name, and prenom.nom@entreprise.fr identifies a person. We treat that data as personal and everything below applies to it.
Why we are allowed to (legal basis)
For business contact data we rely on legitimate interest (GDPR Article 6(1)(f)): providing a business-to-business prospecting tool. The data is published by the businesses themselves for the purpose of being contacted about their trade, and the processing is limited to that context.
For your own account data the basis is performance of a contract — we cannot give you an account without it.
The legitimate-interest assessment should be written up and kept on file (a documented LIA is what makes this basis defensible if it is ever questioned). A lawyer should also confirm the balancing test for sole traders specifically, where the line between business and personal data is thinnest.When you export a list, you become the controller
This is the most important paragraph on the page. While data sits in ReBiz, we are the data controller. The moment you export a CSV or copy the contacts out, you become an independent controller of that copy — it is on your machine, under your control, and we have no further say in what happens to it.
From that point you are responsible for:
- having your own lawful basis for contacting those businesses
- honouring objections and erasure requests made to you directly
- complying with the marketing rules of the country you are contacting
- keeping the file secure and not passing it on
The terms cover the marketing rules in more detail, because they differ sharply between France and Germany.
How long we keep it
Scan results are kept while your account is open, so you can reopen a list without paying to run it again. Delete your account and we delete your scans, your saved lead statuses and your account record within 30 days, except where we are legally required to keep invoices for longer.
Waitlist entries are kept until you ask us to remove them, or until we have finished launching in your city and told you so.
Confirm the retention period against the French commercial-record requirement for invoices, which is longer than the rest of this and applies regardless.Your rights, and a business’s rights
You can ask for a copy of your data, correction of anything wrong, or deletion. Write to support@rebiz.app and we will respond within one month.
A business that appears in our data can ask us to remove it, and we will — without requiring a reason, and we will keep a note of the removal so a later scan does not simply re-add it. Ask at the same address.
You may also complain to your supervisory authority. In France that is the CNIL.
A removal is permanent rather than a one-off deletion. We keep the minimum needed to recognise the business — its listing identifier, and its domain where it has one — and every result, export and future scan is filtered against that record. If the business is rediscovered next month, or a different customer scans the same city, it stays out.
Who else processes it
- Clerk — authentication and account records
- Neon — the database, hosted in the EU
- Google Places API — the source of business listings
- Stripe — payments, if you subscribe
- Vercel — hosting the site
Cookies
One session cookie, so you stay signed in. No analytics or advertising cookies, which is why there is no cookie banner asking for your consent — there is nothing to consent to.
If product analytics are switched on later, this section and the cookie position both have to change.