Privacy policy
Last updated: October 6, 2026In force as of October 1, 2026.
This is a translation provided for convenience. The French version is the reference and prevails.
Data controller
Banast SASU, 25 rue de la Banasterie, 84000 Avignon, France, registered with the Trade and Companies Register of Avignon under number 108 811 845, represented by Adrien Lebas, President. Contact for any question about your data: privacy@banast.com.
Data we collect
- Account: email address, and name if provided.
- Pre-audit and report: address of the analysed site, information about the project entered or validated by the user (market, customers, offer, prices, costs, income goals).
- Payment: handled by Stripe. Banast only receives the payment confirmation, never card details.
- Usage: pages viewed, actions in the service, device type, through audience measurement tools.
- Technical data: IP address, processed for the security of the service (bot check, rate limiting) and error tracking.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Provide the pre-audit and the report | Performance of the contract, or pre-contractual steps for the pre-audit |
| Manage payments and invoicing | Performance of the contract and legal obligation |
| Send service emails | Performance of the contract |
| Send Banast news and offers | Consent, or legitimate interest for existing customers |
| Reach out to professionals | Legitimate interest |
| Secure the service and fix errors | Legitimate interest |
| Measure audience and improve the product | Legitimate interest, or consent where the law requires it |
Recipients and processors
Data is never sold. It is accessible to Banast and to the following providers, within the limits of their task.
| Provider | Role | Location |
|---|---|---|
| Vercel Inc. | Site hosting | United States |
| Supabase Inc. | Database and authentication | European Union |
| Google (Gemini API) | AI-generated analysis | United States |
| Stripe | Payment | United States and European Union |
| Loops | Email delivery | United States |
| PostHog | Product analytics | European Union |
| Plausible | Audience measurement | European Union |
| Sentry | Error tracking | United States |
| Cloudflare (Turnstile) | Bot check | United States |
Transfers outside the European Union are covered by the Data Privacy Framework or by the European Commission's standard contractual clauses. Data sent to the Gemini API is not used by Google to train its models.
Retention periods
| Data | Period |
|---|---|
| Account and reports | While the account is active, then 3 years after the last contact |
| Pre-audit without an account | 12 months |
| Invoices and accounting data | 10 years |
| Prospects | 3 years after the last contact |
| Cookies and trackers | 13 months maximum |
Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, and to withdraw your consent at any time. You may also set instructions about what happens to your data after your death.
To exercise them: privacy@banast.com. Banast replies within one month. You may lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
Security
Banast takes appropriate measures to protect data: encrypted connections, restricted access, established providers.
Changes
Banast may update this policy. The date of entry into force shown at the top is authoritative.