Privacy policy
Version 6 — 2026-11-05. Courtesy translation. The French version (`politique-de-confidentialite.md`) is the only authoritative one; in case of divergence, it prevails.
1. Who processes your data
DEEVX, a French simplified joint-stock company with share capital of €10, registered with the Paris trade register under number 103 200 085, with its registered office at 60 rue François 1er, 75008 Paris, publisher of the Distripedia service ("the service"), is the data controller.
For any question or request about your data: contact@deevx.com. No data protection officer has been appointed; requests are handled at that address.
2. What the service does, in two lines
Distripedia is a professional service. It helps a spirits producer prepare its entry into the French market — structuring its brand and references, computing value chains, publishing a members-only showcase — and lets distributors receive introduction requests there. It is not intended for consumers or minors.
3. What we process, why, and on what basis
| What we process | Why | Legal basis | Retention |
|---|---|---|---|
| Account: e-mail address, password (hashed, never readable by us), name, company, profile type (producer or distributor), website, and the version of the terms accepted at sign-up | Create and maintain your account, authenticate you, keep the proof of the contract | Contract — Art. 6(1)(b) | Until the account is deleted. An account with no sign-in for 24 months is deleted, after a warning by e-mail one month before |
| Profile and brands: house, brands, references, ex-works prices, logistics, presentation texts, visuals | Provide the service you subscribed to | Contract — Art. 6(1)(b) | Until the listing or the account is deleted |
| Uploaded documents (tech sheets, price lists, catalogues…) and the proposals extracted from them | Fill in your file without re-typing | Contract — Art. 6(1)(b); for people named in those documents, legitimate interest — Art. 6(1)(f) (§ 5) | Deleted with the brand, files included |
| Introductions: requests sent, accepted or declined, and their messages | Enable introductions between brands and distributors | Contract — Art. 6(1)(b) | Until the account is deleted |
| File views: when a distribution company opens a brand's file — the company and the date of the first and the last view, never the person | Tell the producer, for the distributors it chose, that its file was seen | Legitimate interest — Art. 6(1)(f): a producer knows whether its approach is read; the distributor is a legal person and the data is reduced to the date | Deleted with the brand or with the distributor's listing |
| Payments: passes bought, transaction identifiers. Card details are entered at Stripe and never pass through our servers | Sell and invoice the pass | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) for accounting records | Invoices and accounting records: 10 years (French Commercial Code, Art. Your customer record and invoices therefore stay at Stripe for that period. L123-22) |
| Distributor register: company name, SIREN, region, website, brand portfolio, from public sources (INSEE, company websites) | Build a professional register useful to producers | Legitimate interest — Art. 6(1)(f) | Until the listing is updated or withdrawn |
| Technical logs: security and usage events, account identifier, timestamp. They contain no name, no e-mail address and no document content | Security, abuse prevention, usage limits | Legitimate interest — Art. 6(1)(f) | 90 days |
| Messages sent to us through the contact form | To answer you | Legitimate interest — Art. 6(1)(f) | 1 year |
| Commercial communications, if you consent to them | Tell you about changes to the service | Consent — Art. 6(1)(a) | Until consent is withdrawn |
The distributor register concerns legal persons. Where a listing would designate a natural person — a sole trader, whose business and person are one — it is not published without its own legal basis.
4. Automated decisions and artificial intelligence
- The service's computations — completeness, value chains, distributor ranking — are deterministic: rules applied to data you entered and to reference figures set by the publisher. They are not artificial intelligence systems.
- Some features call an artificial intelligence model: reading your documents and images, pre-filling from your website, translation, drafting a pitch, assessing how attractive the file is. Every result is labelled as AI-produced, and no proposed value enters your file unless you accept it. You can correct, reject or report any result. A machine translation is labelled as such to its reader, and you can correct it.
- No decision producing legal effects or similarly significantly affecting you is taken solely by automated means (Art. 22 GDPR).
5. People named in uploaded documents
A commercial document sometimes names a person: a contact, a signatory, a technician. We read the document to extract commercial facts; those names are neither sought nor used.
- Where the document holds text, e-mail addresses and telephone numbers are masked before anything reaches the model.
- A scanned document or an image is sent as it is: it cannot be masked. The model is instructed not to describe or identify any person.
- No personal data can become a value in your file: the system refuses it.
- A supporting excerpt of at most 500 characters is kept beside each proposal; it may quote a name.
- Everything disappears with the brand, files included.
This processing rests on legitimate interest (Art. 6(1)(f)); the balancing test that provision requires is documented and available on request. You may object at any time (§ 8).
If you upload documents, you are responsible for what you send us and, where applicable, for informing the people they name (Art. 14 GDPR).
6. Who receives your data
We sell no data and disclose none for advertising. Our processors, each bound by a contract meeting Article 28:
| Provider | Role | Where the data sits |
|---|---|---|
| Supabase (Supabase Pte. Ltd.) | Database, authentication, file storage | Infrastructure in the European Union; any transfer outside the EU covered by standard contractual clauses |
| Vercel (Vercel Inc.) | Hosting and site delivery | US company; transfers covered by standard contractual clauses |
| Stripe | Payment and invoicing | European Union; transfers covered |
| Google Cloud France (Google Cloud) | Reading documents and images, and other AI features | Processor under Google Cloud's data processing addendum, incorporated into DEEVX's agreement (Art. 28). The model processes requests in the European Union. Content is not used to train models and is not kept beyond the processing of the request, with one exception: a request flagged by Google's automated safety controls may be kept for up to ninety days, in the European Union, solely to detect abuse. Any transfer to group companies outside the European Economic Area is covered by the standard contractual clauses |
| Resend (Resend, Inc.) | Sending the service's e-mails: sign-up confirmation, connections, the warning before an inactive account is deleted | European Union for sending; a US company, any transfer framed by the standard contractual clauses |
Your data may also be disclosed to an authority where the law requires it.
What another user sees. A brand is visible only to the distributors you chose, and only once published. Every piece of information carries its own visibility level — members, pass, introduction, on consent, or you alone. Your uploaded documents are never visible to a distributor.
7. Cookies and analytics
The service sets only the cookies necessary for it to work: your authentication session and your language choice. They are not used to track you.
No analytics tool is active today. If we enable one, it will only start after your explicit consent, which you will be able to withdraw as easily as you gave it.
8. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability. Two of them are exercised directly from your account, without writing to us:
- Portability: "Account settings" → export your data as JSON.
- Erasure: "Account settings" → delete a listing, or the whole account. Deletion removes your brands, references, documents and their files, your introductions and your account. Accounting records are kept for 10 years, as the law requires: your customer record and invoices therefore stay at Stripe for that period.
For the other rights, or if you prefer to write: contact@deevx.com. We answer within one month.
You may lodge a complaint with the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — or with the supervisory authority of your country of residence.
9. Security
Data is hosted in the European Union, encrypted in transit and at rest. Access is partitioned at database level: each row is readable only by its owner, or by the recipient you authorised. Administration accounts are protected by two-factor authentication. Security logs contain no personal data.
10. Changes
Any change to this policy will be published on this page with a new version date. A substantial change will be signalled to you inside the service.