Privacy policy
Version 1 — 2026-09-21. Courtesy translation. The French version (`politique-de-confidentialite.md`) is the only authoritative one; in case of divergence, it prevails.
1. Who processes your data
DEEVX, a French simplified joint-stock company with share capital of €10, registered with the Paris trade register under number 103 200 085, with its registered office at 60 rue François 1er, 75008 Paris, publisher of the Distripedia service ("the service"), is the data controller.
For any question or request about your data: contact@deevx.com. No data protection officer has been appointed; requests are handled at that address.
2. What the service does, in two lines
Distripedia is a professional service. It helps a spirits producer prepare its entry into the French market — structuring its brand and references, computing value chains, publishing a members-only showcase — and lets distributors receive introduction requests there. It is not intended for consumers or minors.
3. What we process, why, and on what basis
| What we process | Why | Legal basis | Retention |
|---|---|---|---|
| Account: e-mail address, password (hashed, never readable by us), name, company, profile type (producer or distributor), website | Create and maintain your account, authenticate you | Contract — Art. 6(1)(b) | Until the account is deleted |
| Profile and brands: house, brands, references, ex-works prices, logistics, presentation texts, visuals | Provide the service you subscribed to | Contract — Art. 6(1)(b) | Until the listing or the account is deleted |
| Uploaded documents (tech sheets, price lists, catalogues…) and the proposals extracted from them | Fill in your file without re-typing | Contract — Art. 6(1)(b); for people named in those documents, legitimate interest — Art. 6(1)(f) (§ 5) | Deleted with the brand, files included |
| Introductions: requests sent, accepted or declined, and their messages | Enable introductions between brands and distributors | Contract — Art. 6(1)(b) | Until the account is deleted |
| Payments: passes bought, transaction identifiers. Card details are entered at Stripe and never pass through our servers | Sell and invoice the pass | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) for accounting records | Invoices and accounting records: 10 years (French Commercial Code, Art. L123-22) |
| Distributor register: company name, SIREN, region, website, brand portfolio, from public sources (INSEE, company websites) | Build a professional register useful to producers | Legitimate interest — Art. 6(1)(f) | Until the listing is updated or withdrawn |
| Technical logs: security and usage events, account identifier, timestamp. They contain no name, no e-mail address and no document content | Security, abuse prevention, usage limits | Legitimate interest — Art. 6(1)(f) | 90 days |
| Messages sent to us through the contact form | To answer you | Legitimate interest — Art. 6(1)(f) | 1 year |
| Commercial communications, if you consent to them | Tell you about changes to the service | Consent — Art. 6(1)(a) | Until consent is withdrawn |
The distributor register concerns legal persons. Where a listing would designate a natural person — a sole trader, whose business and person are one — it is not published without its own legal basis.
4. Automated decisions and artificial intelligence
- The service's computations — completeness, value chains, distributor ranking — are deterministic: rules applied to data you entered and to reference figures set by the publisher. They are not artificial intelligence systems.
- Some features call a language model: reading your documents, pre-filling from your website, translation, drafting a pitch. Every result is labelled as AI-produced, with the model used and the date, and nothing enters your file unless you accept it. You can correct, reject or report any result.
- No decision producing legal effects or similarly significantly affecting you is taken solely by automated means (Art. 22 GDPR).
5. People named in uploaded documents
A commercial document sometimes names a person: a contact, a signatory, a technician. We read the text to extract commercial facts; those names are neither sought nor used.
- E-mail addresses and telephone numbers are masked before anything reaches the model.
- No personal data can become a value in your file: the system refuses it.
- A supporting excerpt of at most 500 characters is kept beside each proposal; it may quote a name.
- Everything disappears with the brand, files included.
This processing rests on legitimate interest (Art. 6(1)(f)); the balancing test that provision requires is documented and available on request. You may object at any time (§ 8).
If you upload documents, you are responsible for what you send us and, where applicable, for informing the people they name (Art. 14 GDPR).
6. Who receives your data
We sell no data and disclose none for advertising. Our processors, each bound by a contract meeting Article 28:
| Provider | Role | Where the data sits |
|---|---|---|
| Supabase (Supabase Pte. Ltd.) | Database, authentication, file storage | Infrastructure in the European Union; any transfer outside the EU covered by standard contractual clauses |
| Vercel (Vercel Inc.) | Hosting and site delivery | US company; transfers covered by standard contractual clauses |
| Stripe | Payment and invoicing | European Union; transfers covered |
| OpenAI Ireland Limited | Reading documents and other AI features | Processor for European data under a signed data-processing agreement (Art. 28). Calls are addressed to OpenAI's European endpoint. Content is not used to train models. It may be kept for up to thirty days solely to detect abuse, then deleted. Any transfer to group companies outside the European Economic Area is covered by the standard contractual clauses |
Your data may also be disclosed to an authority where the law requires it.
What another user sees. A brand is visible only to the distributors you chose, and only once published. Every piece of information carries its own visibility level — members, pass, introduction, on consent, or you alone. Your uploaded documents are never visible to a distributor.
7. Cookies and analytics
The service sets only the cookies necessary for it to work: your authentication session and your language choice. They are not used to track you.
No analytics tool is active today. If we enable one, it will only start after your explicit consent, which you will be able to withdraw as easily as you gave it.
8. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability. Two of them are exercised directly from your account, without writing to us:
- Portability: "Account settings" → export your data as JSON.
- Erasure: "Account settings" → delete a listing, or the whole account. Deletion removes your brands, references, documents and their files, your introductions and your account. Accounting records are kept for 10 years, as the law requires.
For the other rights, or if you prefer to write: contact@deevx.com. We answer within one month.
You may lodge a complaint with the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — or with the supervisory authority of your country of residence.
9. Security
Data is hosted in the European Union, encrypted in transit and at rest. Access is partitioned at database level: each row is readable only by its owner, or by the recipient you authorised. Administration accounts are protected by two-factor authentication. Security logs contain no personal data.
10. Changes
Any change to this policy will be published on this page with a new version date. A substantial change will be signalled to you inside the service.