Last updated: [to be completed]
This is a translation provided for convenience; the French version prevails.
This policy explains what data Goslyn processes, why, for how long, who it is shared with and how to exercise your rights. It applies to the service available at https://goslyn.wiibee.fr and in the messaging apps where the assistant is present.
1. Data controller
[to be completed], [to be completed], [to be completed] — [to be completed].
Contact for any question about your data: [to be completed].
2. Data processed
| Category | Data | Source |
|---|---|---|
| Account | displayed first name or name, organization, role, language, time zone, recovery email address if you give one | you, the organization |
| Messaging | identifier of your messaging account (phone number or account identifier), conversation name | the messaging app |
| Conversations | messages exchanged with the assistant, attachments (images, documents), history summaries | you |
| Voice notes | transcribed to be understood; neither the audio nor the transcription is kept | you |
| Desk robot camera | video of the room filmed by your robot, only at your confirmed request ("confirmer"); the robot shows that it is filming | you |
| Memory | what the assistant remembers about you to help you better (preferences, habits), readable and erasable from your personal page | the assistant, from the conversations |
| Everyday organization | reminders, scheduled tasks, followed matters | you |
| Connected services | email or calendar credentials you configure, web pages you have published | you |
| Usage and payment | use of the service in credits, purchases, amounts; never your bank details, which the payment provider handles | the service, the payment provider |
| Service quality | reactions (thumbs up or down) left on answers, incident reports you confirmed, technical indicators of degraded answers (agent, model, cause — no content) | you, the service |
Technical logs do not contain the content of your messages.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service: answering, acting on request, scheduling, following your matters | performance of the contract |
| Managing credits, purchases and accounting | performance of the contract; legal accounting and tax obligations |
| Securing the service, preventing abuse | legitimate interest |
| Improving the service from reactions, incident reports and technical indicators | legitimate interest |
| Sending you the messages the service requires (low balance, purchase confirmation, security) | performance of the contract |
Goslyn does not use your data to train artificial intelligence models, does not sell it and does not advertise. It makes no decision producing legal effects concerning you based solely on automated processing: sensitive actions always await your confirmation.
4. Recipients
Your data is accessible to the publisher, within the limits of what its tasks require. It is passed on to the following processors, each for its role:
- [to be completed]
To answer, the assistant sends an artificial intelligence provider the content needed for the current request: your message and the relevant part of the conversation and memory. Messaging apps (WhatsApp, Signal, Discord…) process your messages under their own terms, as separate controllers.
Within an organization, the other members see what is shared with them: group conversations and group memory, never your private conversations or your personal memory.
5. Google account data
If you connect your Google account (Gmail):
- Access requested. Access to your Gmail mailbox (the
https://mail.google.com/scope), needed to read your emails and send on your behalf through the mail protocols (IMAP and SMTP), as well as your account's email address (theopenidandemailscopes), used as the login identifier for the mailbox. - Use. Only for the features you enable: detecting new emails, sorting them and pointing out what matters according to your instructions, searching and reading an email at your request, and drafting emails and replies, which are only sent after your "confirmer". A feature you disable (reading or sending) no longer uses the corresponding access.
- Retention. Goslyn does not copy your emails into its database: it reads them when it needs them. It keeps your Google access tokens, encrypted, and a marker of the last email processed. What the assistant tells you about an email in the conversation is part of the conversation history (see section 7).
- Sharing. The content of an email is sent to the artificial intelligence provider only when it is needed to handle your current request. Data from your Google account is not sold, not used for advertising, and not used to train or improve artificial intelligence models. No person reads it, except with your consent (for example when you report an incident), for security purposes or to comply with the law.
- Commitment. Goslyn's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- Revocation. You can disconnect your Google account at any time from your personal page ("Email" tab), which erases the access tokens, or remove access from your Google account settings (myaccount.google.com/permissions).
6. Transfers outside the European Union
The service's data is hosted in [to be completed]. Some processors, notably artificial intelligence providers, are established outside the European Union. These transfers rely on an adequacy decision (including the EU–US Data Privacy Framework, for certified companies) or, failing that, on the European Commission's standard contractual clauses. You may obtain a copy from the contact address.
7. Retention periods
| Data | Period |
|---|---|
| Account, private conversations, personal memory, reminders, matters | as long as your account is active; erased at your request or when the organization is deleted |
| Voice notes | not kept |
| Desk robot camera videos | never kept: assembled, sent to your messaging app, then erased |
| Incident reports and improvement analyses | 6 months |
| Technical indicators of degraded answers | 30 days |
| Purchases and usage | 10 years (accounting obligation); dissociated from your identity once your data is erased |
| Backups | continuously renewed; erased data disappears from backups as they rotate |
Group conversations belong to all their participants: they are not erased with one person's data.
8. Security
Conversation content, memory, reminders and incident reports are encrypted at rest; credentials for connected services are sealed and never displayed again. Access to your personal page goes through single-use links valid for a few minutes. Logs contain no message content.
9. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability of your data, as well as the right to set instructions about what happens to it after your death.
- From your personal page ("Privacy" tab): download all your data in a readable file, or have it erased permanently. What the assistant remembers about you can be read and corrected in the "What I remember" tab.
- In writing: [to be completed]. You will receive an answer within one month.
If you believe your rights are not respected, you may lodge a complaint with the CNIL (cnil.fr) or with the data protection authority of your country.
10. Cookies
The personal page and the administration only use strictly necessary cookies: keeping the session opened by your link and protecting forms. No audience measurement or advertising cookie is set; no consent is therefore required.
11. Minors
The service is reserved for people aged 15 or over; below that age, the consent of a holder of parental authority is required.
12. Changes
This policy may evolve with the service. The date of the last update appears at the top; significant changes are announced in advance.