Legal notice

A cookie is a small file a site stores on your device, or reads from it. These are the ones used by the NeoPhi platform — the www.neophi.ai site and the app.neophi.ai application, under one and the same responsibility. Data controller: F.initiatives; its full identity, its Data Protection Officer and the routes for lodging a complaint appear further down this page.

We count our visits without identifying you: that count falls under the audience-measurement exemption recognised by the CNIL and runs even if you refuse everything — setting no cookie at all in that case. You may nonetheless object to it. Everything else exists only with your agreement, purpose by purpose.

The trackers we set

Strictly necessary — no consent required

They keep the decision you made and keep you signed in. Legal basis: the exemption provided for by article 82 of French Act no. 78-17 of 6 January 1978 as amended.

- neophi_consent_v2 — your answer for each purpose, the date of your choice and the version of this notice. 180 days, whether you accept or refuse. Set on the parent domain so the site and the application do not ask you separately; if you are signed in it is also recorded on your account, the most recent decision prevailing.

- mtm_consent_removed — your objection to anonymous audience measurement. Up to 400 days: we request a longer life and your browser caps it.

- neophi-auth.jwt — your session on the application. 30 days, renewed while you keep using it; the token it carries is revalidated every hour. Set on the parent domain by the NeoPhi authentication service.

- neophi-auth.sid — the single-use security values exchanged while you sign in. 30 days.

The application also keeps strictly technical values in your browser’s local storage: interface state, the synchronisation queue for your cookie choice, and a technical identifier limiting anonymous use of the service.

Your decision is also recorded in our server logs — date, purposes, notice version — with no IP address and no visitor identifier.

Campaign attribution — only with your agreement

To know which channel or which partner brought you here, so the right source is credited if you create an account. Nothing is stored before you agree, and nothing is stored on an ordinary visit: the link you followed must itself carry a campaign or partner parameter.

- neophi_visitor — a pseudonymous identifier tying together the visits of one browser. 180 days, readable by our servers only. Set once and never extended: the period runs from first contact, it does not slide.

- neophi_utm — the campaign of your first such visit. 90 days. The first signal received prevails.

- neophi_aff — the partner link of your first such visit. 90 days.

The application additionally keeps a copy of these campaign values in your browser’s local storage, subject to the same agreement and erased after 90 days.

A visit marked this way sends the NeoPhi platform: the visitor identifier, the campaign parameters, the partner code, the referring site reduced to its domain, the landing page, a timestamp, and your account identifier if you are signed in. If — and only if — you have also accepted audience measurement, a SHA-256 fingerprint of your IP address, salted and renewed daily, and your browser’s technical signature are added. The address itself is never stored.

Detailed audience measurement — only with your agreement

Your agreement adds a second Matomo property, without the enhanced compliance mode: pages viewed, actions, technical characteristics — device type, browser, screen resolution — originating campaign and a pseudonymous identifier; if you are signed in to the application, the pseudonymous identifier of your account is associated with it. It remains hosted on our own infrastructure: no analytics provider receives this data.

- _pk_id — Matomo’s pseudonymous visitor identifier. 13 months (393 days), a duration we set explicitly.

- _pk_ses — marks the current visit so the referrer is not credited twice. 30 minutes.

- _pk_ref — the referrer credited to a later conversion. 6 months, and set only if your visit actually carries a referrer or a campaign.

These three names carry a suffix identifying the property concerned and your browser; you see it as such in your browser settings.

Advertising and campaign measurement — only with your agreement

To connect a visit or a subscription to the advertising we run. This is the only purpose whose data leaves our infrastructure to third-party recipients: Meta, Google and Linkedin, with whom we are joint controllers for this collection and transmission. No advertising script is loaded on our pages: we generate the two identifiers below ourselves and send the events from our servers.

- _fbc — the advertising click that brought you here. 90 days.

- _fbp — a pseudonymous browser identifier for advertising measurement. 90 days.

Withdrawing this agreement actively deletes both identifiers on the parent domain; they are not merely ignored.

Anonymous audience measurement, and how to object

Matomo is self-hosted on our own infrastructure: no statistics pass through an analytics provider. The baseline count applies to everyone, including if you refuse everything — and in that case sets no cookie at all. We have enabled Matomo’s enhanced compliance mode on it: IP address truncated by two bytes before storage, referrer reduced to its domain, campaign parameters stripped, no visit log and no visitor profile, no account identifier, no third-party cookie, retention limited to 180 days.

It is that configuration which earns it the consent exemption recognised by the CNIL. In return, you have a right to object: the “Object” button, in [Cookie settings] and in the footer, stops both measurements for this browser. Clearing your cookies or changing browser undoes it.

A cookie we read without setting

On the www.neophi.ai site, your neophi-auth.jwt session is read without being set: it comes from the application. Reading a cookie is still access to your device, so we declare it. Two uses: verifying its signature, which determines which action button the header shows; and, when a visit is recorded under attribution above, taking your account identifier from it to attach to that record. Sign out of the application to remove it.

Managing your choices

A banner asks you to choose on your first visit: accept, refuse or customise. Refusing is offered at the same level, in one click, and access is never conditioned on it; there is no cross to close it without answering. Until you have chosen, no attribution, detailed-measurement or advertising cookie is set.

The [Cookie settings] panel, permanently reachable from the footer, gives one row per purpose with its duration, and the objection button above; everything that is not strictly necessary is off by default. Withdrawing an agreement is as easy as giving it, and deletes the cookies concerned instead of ignoring them. Your choice lasts 180 days, accepted or refused; you are then asked again. A new purpose is never authorised by an earlier agreement: until you grant it, it is treated as refused. Finally, you can block or delete cookies from your browser.

Recipients, hosting and transfers

Attribution data and statistics stay with F.initiatives: in both cases the recipient is F.initiatives, and no analytics provider is involved. The whole platform and its Matomo installation are hosted in France, within the European Union. This data is neither sold, nor rented, nor passed to third parties for commercial purposes.

The one exception is the advertising purpose above: it sends data to Meta, Google and Linkedin, outside the European Union, and only if you have accepted it.

On the server side, attribution journey records are kept for one year — a period enforced automatically by our database, which exceeds the cookie’s. First-visit values attached to your account are never overwritten: they are kept with it and deleted with it.

To exercise your rights — access, rectification, erasure, restriction, portability, objection — see the “Exercising your rights” and “Contact F.initiatives” sections below; “Complaint” explains how to refer a matter to the CNIL.

Contact Form

Personal data processed and provided by the data subject: First name, last name, professional or personal email address, subject and content of messages.

Data controller: F.initiatives

Data subjects: Visitor(s) to the Neophi website

Who collects the personal data? The F.initiatives team dedicated to the Neophi service

Retention period for collected personal data: 2 years after the last contact.

Legal basis: User consent.

Type of collection: Contact form on the Neophi website of F.initiatives.

Recipients of the processed personal data: When you contact us via the contact forms on the Neophi website of F.initiatives, the team dedicated to the Neophi service may transfer your contact details and the nature of your request to the relevant departments and/or to the Management of F.initiatives in order to process your request.

Purpose of the processed personal data: To receive and process contact requests from users of the Neophi website of F.initiatives;

To contact website users who request it and facilitate communication with the appropriate internal contacts.

Newsletter Form

Personal data processed and provided by the data subject: Professional or personal email address.

Data controller: F.initiatives

Data subjects: Individuals who have subscribed to the Newsletter distribution.

Who collects the personal data? The Neophi team and the Marketing Department of F.initiatives responsible for managing the mailing list.

Retention period for collected data: Information relating to your rights is retained only for the period strictly necessary to process the request.

Legal basis: User consent.

Type of collection: The user enters their email address in the dedicated space on the Neophi website of F.initiatives.

Purpose of the processed personal data: To send the Newsletter to subscribers.

Exercising Your Rights

Explanation of Rights Relating to Personal Data

In accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, you have several rights relating to your personal data. These rights supplement the right to information, allowing you to be informed about the collection of your data and how it is used.

Right of access to your personal data (Article 15 of the GDPR):

You may request confirmation as to whether F.initiatives processes your personal data and, if so, obtain a copy and details of such processing.

Right to rectification (Article 16 of the GDPR):

You may request the correction or updating of inaccurate or incomplete personal data as soon as possible.

Right to erasure (“right to be forgotten”) (Article 17 of the GDPR):

You may request the deletion of your personal data when you no longer wish it to be processed by F.initiatives, by withdrawing your consent, including the removal of any links, copies, or reproductions.

Right to restriction of processing (Article 18 of the GDPR):

You may request that your data be temporarily isolated so that, except for storage, it is processed only with your consent.

Right to data portability (Article 20 of the GDPR):

You may request that your data be exported and transferred to another company.

Right to object to processing (Article 21 of the GDPR):

You may request the cessation of processing of your personal data under certain conditions, particularly where processing is based on legitimate interests or for commercial prospecting purposes.

Right not to be subject to profiling (Article 22 of the GDPR):

You may request not to be subject to an automated individual decision, including profiling.

To exercise your rights relating to your personal data, you may write to:

dpo@f-initiatives.com

Contact – F.initiatives

F.initiatives has appointed an AFNOR-certified Data Protection Officer (DPO).

If you have any questions, please write to the dedicated email address:

dpo@f-initiatives.com

Complaint

To file a complaint with a national supervisory authority:

CNIL – Commission nationale de l’informatique et des libertés

3 place de Fontenoy

TSA 80715

75334 PARIS CEDEX 07

France

Telephone: +33 (0)1 53 73 22 22

Website publisher and hosting provider

F.initiatives

Simplified Joint-Stock Company (SAS)

Espace Bellini, 14 Terrasse Bellini

92800 PUTEAUX – France

Registered with the Nanterre Trade and Companies Register under number 499 154 557

Share capital: €210,200

VAT number: FR90 499 154 557

Telephone: +33 (0)1 80 18 88 00

Fax: +33 (0)1 80 18 88 01

Email: contact@f-initiatives.com

The general terms of use are available on the application NeoPhi