This Privacy Policy explains how Dialog collects, uses, shares and protects personal data when you visit our website, request a demo, communicate with us, or use the Dialog platform. We are committed to processing personal data in accordance with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (Law no. 78-17 of 6 January 1978).

1. WHO WE ARE

DIALOG is a French simplified joint-stock company (société par actions simplifiée), registered with the Paris Trade and Companies Registry under number 922 195 300, with its registered office at 3 boulevard de Sébastopol, 75001 Paris, France ("Dialog", "we", "us" or "our"). For the processing activities described in this policy, Dialog acts as the data controller. For any question relating to your personal data or this policy, you can contact us at baptiste@askdialog.com or by post at the address above.

2. SCOPE OF THIS POLICY

This policy applies to personal data we process as a data controller, namely data relating to website visitors (people browsing askdialog.com), prospects and contacts (people who request a demo, subscribe to our communications, or otherwise contact us), and clients and users (individuals who administer or use the Dialog platform on behalf of a business client).

End-Users of our clients' websites. When a business client integrates Dialog's AI chat widget into its own website, and where personal data is processed in that context, Dialog acts as a data processor on behalf of that client, who is the controller. Such processing is governed by our client agreements and Data Processing Agreement rather than by this policy. By design, the Dialog widget is not intended to collect personal data from End-Users, and clients are instructed to ask End-Users not to share personal data in the chat.

3. WHAT PERSONAL DATA WE COLLECT

Data you provide to us: identity and contact details (first and last name, business email address, phone number, company name, job title); demo and enquiry data (the information you submit when booking a demo or contacting us, and the content of your communications with us); account data (credentials and profile information for users of the Dialog platform, and workspace configuration you enter); billing data (business and billing details necessary to invoice our clients; card payment data is collected and processed directly by our payment providers Stripe and Shopify, and Dialog does not store full card numbers).

Data collected automatically: technical and usage data (IP address, device and browser type, operating system, pages viewed, referring URL, marketing attribution parameters such as UTMs, and interactions with our website and platform); cookies and similar technologies as described in our Cookie Policy. Non-essential cookies are only used with your consent. We do not intentionally collect special categories of data (such as health, religion or biometric data), and we ask you not to send us such data.

4. HOW AND WHY WE USE YOUR DATA

We process personal data for the following purposes and legal bases under the GDPR: providing, operating and securing the Dialog platform and account management (performance of a contract); responding to demo requests, enquiries and providing support (pre-contractual steps and legitimate interest); invoicing, payment processing and accounting (performance of a contract and legal obligation); operating, maintaining and securing our website (legitimate interest); measuring audience and analyzing usage through analytics (consent, for non-essential cookies); sending marketing communications, newsletters and product updates to professionals (consent, or legitimate interest for existing business relationships, with an opt-out in every message); improving our AI models and services using aggregated, anonymized data that does not identify you (legitimate interest); and complying with legal obligations and defending our rights (legal obligation and legitimate interest).

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interest, you may object to the processing (see section 8).

5. WHO WE SHARE YOUR DATA WITH

We do not sell your personal data. We share it only with trusted service providers (sub-processors) who act on our instructions, and where required by law. Our main service providers include: Amazon Web Services (AWS) for hosting, servers and databases (European Union); PostHog for product and usage analytics (European Union); Anthropic (Claude) for the AI language model generating responses (United States, under EU Standard Contractual Clauses and the provider's DPA, with data not used to train the provider's models); Google Cloud (Vertex AI / Gemini) for the AI language model generating responses (European Union where an EU region is configured, otherwise United States, under EU Standard Contractual Clauses, with data not used to train the provider's models); Stripe and Shopify for payment processing and billing; HubSpot for CRM, marketing and communications; Calendly for demo scheduling; and Framer for website hosting. We may also disclose personal data to professional advisers, auditors, potential acquirers or investors in the context of a corporate transaction, and to public authorities or courts where required by law.

6. INTERNATIONAL DATA TRANSFERS

We host and process personal data primarily within the European Economic Area (EEA). Where a service provider processes data outside the EEA (for example certain AI providers in the United States), we ensure an appropriate level of protection through recognized safeguards such as the European Commission's Standard Contractual Clauses, adequacy decisions where applicable, and additional technical and organizational measures. You may request a copy of the relevant safeguards by contacting us.

7. HOW LONG WE KEEP YOUR DATA

Prospect and marketing data: up to 3 years from our last contact with you. Client and account data: for the duration of the contractual relationship and then archived as needed to meet our legal obligations. Invoicing and accounting data: 10 years, as required by French commercial law. Website analytics and cookie data: for the retention periods set out in our Cookie Policy (cookie lifetimes do not exceed 13 months, and related data no more than 25 months). End-User data processed on behalf of clients: retained only as long as necessary to create the relevant lead and for a maximum of one year, in accordance with the applicable Data Processing Agreement.

8. YOUR RIGHTS

Subject to the conditions set out in the GDPR, you have the right to access the personal data we hold about you; rectify inaccurate or incomplete data; erase your data (right to be forgotten); restrict or object to certain processing, including direct marketing; data portability (receive your data in a structured, commonly used, machine-readable format); withdraw consent at any time where processing is based on consent; and define guidelines for the fate of your data after your death.

To exercise your rights, contact us at baptiste@askdialog.com. We may need to verify your identity before responding, and we will reply within the timeframes set by law (normally one month). If you believe your rights have not been respected, you may lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or your local supervisory authority.

9. HOW WE PROTECT YOUR DATA

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit (TLS 1.2 or above) and at rest (AES-256), strict access controls based on the principle of least privilege, multi-factor authentication for administrative access, access logging, per-client data segregation, daily encrypted backups, hosting in EU regions, and regular security reviews. No method of transmission or storage is completely secure, but we work to continuously improve our safeguards.

10. CHILDREN

Our website and services are intended for professional use and are not directed at children. We do not knowingly collect personal data from individuals under the age of 18.

11. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "last updated" date at the top of this page indicates when it was last revised. Where changes are material, we will provide a more prominent notice.

CONTACT

DIALOG SAS, 3 boulevard de Sébastopol, 75001 Paris, France. Data protection contact: baptiste@askdialog.com.