Last updated: 22 October 2026
This English translation is provided for information. Only the French version is legally binding.
ConciergeOS, published by Matthieu de La Selle, sole trader (SIREN 107 023 830), who also runs the MAT Agency agency, contact: contact.conciergeos@gmail.com, is the controller of the personal data described below, in accordance with Regulation (EU) 2016/679 (GDPR). The postal address of the head office is given in our legal notice. ConciergeOS has not appointed a data protection officer: for any question, write to contact.conciergeos@gmail.com.
Depending on the type of data processed, ConciergeOS acts in two different capacities within the meaning of the GDPR:
| Why | Legal basis | Data | Retention |
|---|---|---|---|
| Providing the service to our clients (accounts, set-up, support) | Performance of the contract | Users' name, email, phone, company, role | Duration of the contract, then deletion within 3 months |
| Billing and accounting | Legal obligation | Client identity and contact details, quotes and their online signature data, invoices, payments (via Stripe; invoices issued with Tiime) | 10 years from the end of the financial year |
| Answering requests for a demo, an audit, a ConciergeOS Studio video or our message templates, then presenting ConciergeOS to you | Legitimate interest: answering those who contact us | Name, email, phone, company, message; IP address, used only to limit abuse | 3 years after the last contact |
| Sales prospecting of concierge services | Legitimate interest: making our service known to professionals in the sector | Company and manager name, business contact details, portfolio size, business social media accounts, public reviews, information from the French national business register (SIREN, address, manager), notes taken during our exchanges and sales qualification details; taken from your website, your business listing, professional directories, the national business register and our exchanges | 3 years after the last contact, or until you object |
| Prospecting local providers (restaurants, activities, transport, wellbeing…) for our partner network | Legitimate interest: building our partner network | Business name, activity, town, manager's name, SIRET and address of the establishment, website, business email and phone, published on your website, your business listing or the national business register; they may pre-fill an application, which you review and correct before anything is sent | 3 years after the last contact, or until you object |
| Contacting partners listed by our clients (section 2) | Legitimate interest: building our partner network | Business name, activity, area, business phone and email | 3 years after the last contact, or until you object |
| Managing the partners in our network (contract, statements, commissions) | Performance of the contract | Identity, SIRET, contact details, bookings and declared amounts | Duration of the contract, then 10 years for accounting records |
| The “Alice” chatbot on the home page | Legitimate interest: answering visitors' questions | Messages you write in the chat; IP address, used only to limit abuse | Messages: not kept in our database; IP address: 24 hours at most |
| Website audience measurement | Legitimate interest: knowing how often our pages are visited | Page visited, referring site, truncated IP address (never the full address) | 12 months; you can object in one click on the Cookies page |
| Electronic signature of quotes and partner contracts (proof of agreement) | Performance of the contract; legitimate interest: proving acceptance | Signatory's name and position, date and time, IP address, browser type, fingerprint of the signed document | 10 years from signature |
| Recording some prospecting calls, to improve our exchanges | Legitimate interest: training our team; you are told at the start of the call and can refuse | Voice and words exchanged during the call, transcript, assessment note of the exchange | Audio recording deleted as soon as the note is written; transcript: 6 months at most; note: with the prospect record |
| Website security and abuse prevention (anti-bot) | Legitimate interest: protecting the service | IP address, browser type (Cloudflare Turnstile) | Duration of the verification |
The fields marked as required in our forms are needed to handle your request or provide the service; without them, we cannot follow up.
ConciergeOS automatically classifies and prioritises incoming messages (urgency, category) and drafts replies using an artificial intelligence model. People who interact with the AI are informed by a notice in the conversation. This processing is never a fully automated decision producing legal effects within the meaning of article 22 of the GDPR: a member of the client's team can take over a conversation at any time, turn off the AI for a property or a conversation, and correct any reply before it is sent. No data is used to train artificial intelligence models. Anthropic, which provides the model, deletes the messages sent to it within 30 days; those its safety systems flag as breaching its usage policy may be kept for up to 2 years.
Your data is accessible only to ConciergeOS and to the following providers, who process it on our behalf:
When a guest books a service, their first name, dates and needs are passed to the partner concerned so that it can welcome them. No data is sold or shared for advertising purposes.
Several of our providers are established in the United States (see section 5). These transfers rely on the European Commission's adequacy decision on the EU–US Data Privacy Framework where the provider is certified and, failing that, on the standard contractual clauses adopted by the European Commission (decision 2021/914), included in these providers' terms. Application data (accounts, conversations, properties) is hosted in the European Union, in Germany. You can obtain a copy of these safeguards by writing to us.
You have the right to access, rectify, erase and restrict your data, to object (including to prospecting, at any time and without giving a reason) and to data portability. To exercise them, write to contact.conciergeos@gmail.com. We reply within one month, which may be extended by two months for a complex request, free of charge. We may ask you to prove your identity in case of reasonable doubt. You can also set instructions for the retention, erasure and communication of your data after your death (article 85 of the French Data Protection Act).
If your request concerns data processed by ConciergeOS as a processor (see section 2), it will be passed on to the concierge service concerned, which alone is entitled to answer it.
You can lodge a complaint with the CNIL (the French data protection authority): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at cnil.fr.
This website sets no advertising, social media or third-party audience measurement cookies. The trackers it uses (internal audience measurement, conversation with Alice, login session, display preferences, anti-bot verification on login pages) are strictly necessary or exempt from consent: no banner is therefore shown to you. Their full list, their duration and how to object to audience measurement are given in our cookie policy.
Exchanges are encrypted, each concierge service's data is partitioned at database level, and access to the application is restricted to authenticated users, according to their role.
We may change this policy. The date of the last update is shown at the top of the page; in case of a significant change, our clients are informed by email.