Privacy Policy

Who is responsible

The data controller is Dylan Merigaud EI, a French sole proprietorship (entrepreneur individuel) registered under SIREN 834 511 768, 173 rue de Courcelles, 75017 Paris, France. It runs Praxtrust and the business outreach described below. For anything in this policy, including the rights listed below, write to hello@praxtrust.com; a person answers.

What is collected, why, and on what legal basis

What is on this site. Praxtrust has no accounts and no forms: nothing you type or submit is stored here. Every button opens an email to hello@praxtrust.com in your own mail client.

Visiting the site. Vercel serves the pages and, like any web host, processes your IP address and browser details to deliver them and keep the site secure. Legal basis: our legitimate interest in running a working, secure site (Article 6(1)(f) GDPR).

Audience counts. Vercel Web Analytics counts pageviews without any cookie: a visit is recognized by a hash of the request that is discarded after 24 hours. Legal basis: our legitimate interest in knowing which pages are read (Article 6(1)(f)).

Product analytics. PostHog records pageviews, interaction events and error reports, and screen recordings of visits to the public pages only. In the European Union, the EEA and the United Kingdom, a banner asks first: if you accept, PostHog sets its cookie on the basis of your consent (Article 6(1)(a)), which you can withdraw at any time from the Cookie settings link on the site; if you decline, it counts the visit with a rotating hash and no cookie, on the basis of our legitimate interest (Article 6(1)(f)). Everywhere else, PostHog sets its own first-party cookie from your first visit, on the basis of our legitimate interest (Article 6(1)(f)). It never follows you across other sites.

Buying. If you buy Praxtrust, payment is taken by Stripe on its own checkout page; your card number never reaches us. We receive your name, email address, billing address and country, what you bought and the amount, and we use them to deliver what you bought and to issue your invoice. Legal basis: the contract you enter into (Article 6(1)(b)) and, for the invoice and its accounting record, our legal obligation (Article 6(1)(c)).

Writing to us. Mail sent to hello@praxtrust.com is received by Cloudflare Email Routing and forwarded to our Google Workspace mailbox, where a person reads and answers it. Legal basis: our legitimate interest in answering you (Article 6(1)(f)), or the contract when you write about a purchase (Article 6(1)(b)).

Nothing is sold or rented, and nothing is used to build advertising profiles. There are no third-party ad trackers on this site.

If we contacted you

Dylan Merigaud EI writes to businesses by email to offer its products, Praxtrust among them. If you received one of these messages, this section is for you.

Where your details came from. Your name, job title, company and business email address come from public sources: the SEC's public register of investment advisers (Form ADV) and the registers of the state securities regulators, your company's own website and business directories. Some addresses come from the B2B contact databases Prospeo and Apollo.io. Before a first message, an address no source had verified is checked with an email verification service (Reoon Email Verifier, or the checks built into Prospeo and Apollo.io), so that we do not write to a mailbox that does not exist. We do not write to an address guessed from a naming pattern.

What we hold. Your name, job title, company and business email address, the result of its verification, your company's public details (website, location, and the public record that made it relevant to us), and the dates and content of the messages we exchanged.

Legal basis. Our legitimate interest in offering a business a product related to its activity (Article 6(1)(f) GDPR). We write to you about your professional role only, in a short sequence that any reply ends.

Your right to object. You can object at any time, without giving a reason: reply to any of our messages or write to hello@praxtrust.com. We stop writing to you, and your address goes on our suppression list, which every later message is checked against.

How long. Your record is kept 3 years after our last contact with you, then deleted. If you object, we keep only your address on the suppression list, so that the objection holds.

Who handles it for us. Neon (our database), Google Workspace (the mailboxes our messages leave from and replies arrive in), Prospeo, Apollo.io and Reoon (finding and verifying addresses), GitHub (a private backup of our records), OVHcloud (the server that runs our tools), Anthropic (the Claude AI assistant that helps us draft messages and read replies) and Telegram (a notification on our own phone when a reply asks for something). Where each one is, and how a transfer outside the EU is covered, is in the next section.

Who receives it, and transfers outside the EU

The controller is in France. These services receive the data described above, each holding only what its task needs.

Vercel Inc. (hosting and audience counts, United States): certified under the EU-US Data Privacy Framework, with standard contractual clauses in its data processing terms.

PostHog, Inc. (product analytics, United States): certified under the Data Privacy Framework, with standard contractual clauses.

Stripe Payments Europe, Limited (payments, Ireland), which relies on Stripe, LLC in the United States: certified under the Data Privacy Framework, with standard contractual clauses.

Cloudflare, Inc. (receives and forwards mail sent to our address, United States): certified under the Data Privacy Framework, with standard contractual clauses.

Google Cloud France SARL (Google Workspace mailboxes), which relies on Google LLC in the United States: certified under the Data Privacy Framework, with standard contractual clauses.

Databricks, Inc., which runs Neon (the database of our outreach records, United States): certified under the Data Privacy Framework, with standard contractual clauses.

ZenLeads Inc., doing business as Apollo.io (B2B contact data, United States): certified under the Data Privacy Framework, with standard contractual clauses.

Defastra Tech Inc., which runs Prospeo (B2B contact data, Canada): Canada is covered by an EU adequacy decision.

GitHub, Inc. (a private backup of our records, United States): certified under the Data Privacy Framework.

OVH US LLC (the server that runs our tools, hosted in London): the United Kingdom is covered by an EU adequacy decision, and OVH US is certified under the Data Privacy Framework.

Reoon Technology (email verification): receives an email address alone and keeps the result 15 days. It is not certified under the Data Privacy Framework and publishes no data processing terms.

Anthropic (the Claude AI assistant, United States), used under its subscription terms, which include no data processing agreement; it is not certified under the Data Privacy Framework.

Telegram Messenger Inc. (notifications on our own phone; data of European users is stored in the Netherlands): it is not certified under the Data Privacy Framework and publishes no data processing terms.

How long it is kept

Audience counts: Vercel Web Analytics keeps them 1 month on our plan.

Product analytics: PostHog keeps events 1 year and screen recordings 1 month on our plan.

Customers: for as long as the contract runs.

Invoices and accounting records: 10 years, as the French Commercial Code requires (article L123-22).

Prospects: 3 years after our last contact, then deleted; an objection keeps only the address on the suppression list.

Messages sent to our address: kept with the customer or prospect record they belong to, for the same period.

Your rights

You can ask for access to the data held about you and a copy of it, its rectification, its erasure, the restriction of its processing, and its portability (a copy in a reusable format). You can object at any time to processing based on our legitimate interest, the outreach described above included. Where processing rests on your consent, you can withdraw it at any time, without affecting what was done before. Under French law, you can also give directions on what happens to your data after your death.

To exercise any of these rights, write to hello@praxtrust.com; we answer within one month. You can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07), or with the supervisory authority of the country where you live or work.