1. Data controller
Christopher Lafay EI, a sole proprietorship trading as CLOUD MIND LINK SOLUTIONS (CMLS), is the data controller for the public website, demo requests and the Genipy platform processing described here. For data stored in a customer’s tools, CMLS acts as a processor on that customer’s behalf.
- Address
- 13 rue Roger Courtois, 25200 Montbéliard, France
- SIREN
- 791 669 401
- SIRET
- 791 669 401 00022
- EU VAT number
- FR75 791 669 401
- Privacy contact
- hey@genipy.com
2. Data involved
When you visit the website, we process technical data needed for its operation and security, such as technical logs and request information. When you book a demo in the calendar on the demo page, the booking goes through Cal.com: we receive your name, email address, the time slot and time zone you choose, any optional details you add (notes, guests) and any campaign parameters in the page address.
When a workspace administrator connects an account to an integration (for example Google Workspace, Microsoft 365, Slack, HubSpot, Salesforce, Airtable, SendGrid, a mail server or an AI provider such as Anthropic or OpenAI), Genipy stores the account label and its encrypted credentials, OAuth tokens or API keys. For a Google account, depending on the permissions the administrator approves and the feature an authorized application uses, Genipy may access Google Drive files, Docs, Sheets, Slides, Calendar events, Gmail messages, Forms and responses, contacts, tasks, Chat spaces and messages, or Google Meet space metadata.
3. Purposes and legal bases
- Answering a demo request
- Steps taken at your request before entering into a contract, and management of our business relationship.
- Securing the website and preventing abuse
- Our legitimate interest in protecting the website, its visitors and our services.
- Managing a contract or invoice
- Performance of a contract and compliance with legal and accounting obligations.
- Providing a feature of a connected integration
- Performance of the customer relationship and the administrator’s request to connect the selected account.
- Separate marketing
- Only where the required legal basis, including consent where applicable, has been obtained for that purpose.
Booking a demo does not, by itself, subscribe you to a separate marketing list.
4. Data from connected integrations
Genipy accesses the data of a connected integration, Google Workspace included, only when an authorized workspace administrator connects an account and an authorized application invokes a visible user-facing feature. The connection is used to perform the requested operation, such as reading or updating a document, scheduling an event, sending an email, creating a presentation, form, task, Chat message or Meet space. It is not used for advertising, sale of data, credit decisions or unrelated profiling.
OAuth credentials are encrypted at rest and used server-side; they are never supplied to a Genipy application or an agent. Genipy does not keep a separate catalog of the content returned by these services. A customer application may process a response only within the feature and permissions the customer has configured; the customer remains responsible for its own application data and any third-party service it expressly connects.
Genipy’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We do not allow CMLS personnel to read content from a connected integration unless the customer specifically asks for support on that content, or access is necessary for security, legal compliance or investigation of abuse. We do not sell this data, Google user data included, or use it to serve advertising. Any transfer is limited to providing the requested user-facing feature with the customer’s instruction, protecting the service or complying with law.
An administrator can disconnect an account in Genipy’s Integrations area at any time; this removes the stored credentials and application authorizations in Genipy. For a Google account, the administrator can also revoke Genipy’s access from the Google Account permissions page. Disconnecting does not erase data that a customer application has independently stored under the customer’s own configuration.
5. Recipients and transfers
Your data is available to authorized CMLS personnel and processors involved in operating the website and handling your request, including Cloudflare for hosting the website and its security, Microsoft Azure for hosting the Genipy service and the tools built on it, Shipmail for email, Cal.com for demo bookings, and HubSpot for request follow-up. We do not sell your data.
Some providers may process data outside the European Economic Area. Where required, those transfers are covered by safeguards recognized by applicable law, such as an adequacy decision or standard contractual clauses.
6. Retention
Demo requests and prospect conversations are retained for no more than three years after the last active contact. Data needed to perform a contract is retained during the contractual relationship and then for the applicable statutory periods, including accounting requirements. Technical security data is retained only for a period proportionate to its purpose and, unless an incident requires longer retention, for no more than 12 months.
7. Your rights
You may request access to, correction, deletion, restriction or portability of your data, and object to processing based on our legitimate interests. You may withdraw consent at any time where processing relies on consent.
To exercise these rights, email hey@genipy.com. We may ask for information needed to verify your identity. You may also lodge a complaint with the French data protection authority (CNIL).
8. Security and updates
We use technical and organizational measures appropriate to the risk. We may update this policy to reflect a change in our processing or in the legal framework; the “Last updated” date at the top will change. For trackers, see our Cookie notice.