Privacy policy

Data controller

ELVN SAS, 60 rue François Ier, 75008 Paris, France, registered with the Paris Trade and Companies Register under number 979 732 906. For any question about your data: bonjour@joli.studio.

Data we process

• Account: name, email address, interface language and hashed password. With “Continue with Google”: the identifier, name, email address and photo of the Google account.
• Organization and members: organization name, members, roles and invitations.
• Content: brand profile, address of the analyzed website, strategy, calendar, posts, generated or uploaded images, metrics entered by hand.
• Sparks and purchases: grants, spending per action and purchase history.
• Billing: individual or business, name or company name, address, country, billing email and, for a business, EU VAT number and the result of its verification; for the saved card, its brand, last four digits and expiry date; the organization’s invoices, refunds and disputes; the box checked before paying (date and version of the text) and, where applicable, the withdrawal. The card number stays with Stripe: ELVN neither sees nor stores it.
• Emails: address and content of the messages sent by the service (address confirmation, invitations, forgotten password, morning digest, billing notices). The sending log keeps their type, their status and the recipient’s domain, with a hash of the address, never the address itself.
• Technical logs: IP address, browser, date and time of requests and errors, for security and troubleshooting; for each open session, the device and the sign-in IP address.
• Error reports: when the app or wall.joli.studio runs into an error, the type of the error, its message and the place in the code where it happened, the version of the service, the page (without its parameters or tokens), the browser and operating system, and, in the app, the identifier of your account and organization — never your email address, your name, your IP address or the content of your posts and brand.
• Waitlist: when sign-up is by request, the email address left, the language of the page, the wall.joli.studio wall it keeps if any, and the dates of the request, of the access sent and of the account created. No name and no IP address.
• Support log: the actions the joli.studio team takes on an account or an organization (see below), with their reason.
• Prospecting: for a business we write to, its name, SIRET number and activity, its website, the business address it publishes and our exchanges (see “Prospecting” below).
• Publish links: when you publish from your phone, the post concerned, its platform, the account that created the link, the files uploaded for the phone, the link’s fingerprint and the dates it was created, expires, was opened and was published (see below).

Legal bases and purposes

No processing relies on consent: joli.studio uses neither advertising trackers nor any cookie that would require it.

Artificial intelligence

To run an AI action (write, rewrite, analyze a website, generate an image, draft a strategy), the instructions and the content that action needs are sent to OpenAI, through Cloudflare’s AI Gateway. Nothing is sent outside an action you start, and whose estimated cost is shown beforehand.

Under its API terms of use, OpenAI does not use this data to train its models.

Cloudflare’s gateway keeps only the metadata of each call: model, token count, cost, duration, status, and the technical identifiers of the organization, project and account. It never keeps the instructions, the content or the responses.

Brand analysis reads only the public pages of the address you give, with a crawler that identifies itself as JoliStudioBot. It also looks at the top of the home page in a browser, without accepting any cookie; two screenshots of that public page are sent to OpenAI with its text, and are not kept.

Publishing from your phone

In the “Publish” window, “On my phone” shows a QR code. It leads to a page that opens without signing in, for one hour, and for that post only. It holds what you need to publish it, and nothing else: the post’s title, its texts (caption, hashtags, alt texts, the posts of a thread, a poll’s question and options), its files (images, PDF or video), its platform and the brand’s handle on that platform. Neither the organization nor the project appears on it, and the page is not indexed by search engines.

The link carries a secret token. We never keep that token, only its fingerprint: the link can’t be rebuilt from what we store. The link stops working when it expires, as soon as you ask for a “New code”, or when you create another one for the same post. Anyone who has the link during that hour sees what the page shows and can mark the post as live: don’t share it. “It’s live!”, from the phone, records the publication in the name of the person who created the link.

The files uploaded for the phone are erased one day after the link expires, by the daily cleanup that follows; the link records (dates, account, fingerprint), 30 days after they were created.

Cookies and audience measurement

The super.joli.studio app uses only cookies that are strictly necessary for your session. Your preferences, such as language and display, are kept in your browser.

Payment. Stripe’s script (Stripe.js) is loaded only on the app’s payment screens — pay, change plan, change card — never when other pages load, nor on the website. It shows the card form in a frame served by Stripe and, to prevent fraud, collects information about the device, the browser and how the form is filled in; Stripe may set cookies needed for payment security at that point. This data is processed by Stripe under its own privacy policy.

The joli.studio website, the super.joli.studio app and wall.joli.studio measure their audience without cookies or any identifier kept on your device, to learn which pages are useful and where visits come from. Two probes: Cloudflare Web Analytics on the website, and Elvn Analytics, our own tool, operated by ELVN SAS, on all three. The Elvn Analytics script is served by each site itself, and its measurements go through our servers, which relay them to Elvn Analytics without any cookie.

Each event is sent on its own, when it happens. What Elvn Analytics records:

• on each page view: the page address, without its parameters except campaign tags (utm_*, ref, source); the site you came from, reduced to its home address; your screen width and browser language; the browser, operating system and device type, derived from the header every browser sends; the country, region and city, derived from the connection;
• engagement: when you leave a tab, the time spent interacting with the page and how far you scrolled it;
• outbound links and downloads: the address of a link to another site or of a downloaded file, without its parameters.

To count visitors, Elvn Analytics computes a technical pseudonym for each event: a hash of your IP address and browser, mixed with a secret salt that is renewed every month and specific to the site. Neither the IP address nor the full browser signature is stored. This pseudonym recognizes the same visitor for one month at most and on one of the three sites only; it doesn’t say who you are, and it can’t follow you from one month to the next, or from one site to another.

Inside the app, a page address contains the technical identifiers of your organization, your project or a post. They are therefore recorded along with the page view. They say nothing about the content, and these measurements go to no one but ELVN SAS. The administration console and the pages that carry a personal link (invitation, new password, address confirmation, the phone page for publishing) are never measured.

Opting out takes one gesture, and applies right away:

• on the website, with the button below;
• in the app, in “My account”, Preferences tab, with the “Audience measurement” switch;
• everywhere, with your browser’s Global Privacy Control signal (built into Brave, through an extension in Firefox and Chrome): when it is sent, nothing is measured, neither on the website, nor in the app, nor on wall.joli.studio.

The button and the switch write a single preference in your browser (elvn_ignore) so you’re no longer counted; it applies to the site where you set it. Nothing is measured either from a browser driven by a program.

No advertising cookie is set, neither on the website nor in the app: there is therefore no consent banner.

What the joli.studio team sees

To run the service and help its customers, the joli.studio team at ELVN SAS uses an administration console. Only a few team addresses can open it. There, the team sees:

• accounts: name, email address, sign-up date, whether the address is confirmed, organizations and roles, last visit, open sessions (browser, operating system and truncated IP address);
• organizations: name, plan, members and invitations, and for each project its name and number of posts;
• usage: Sparks granted and spent, per action and per project, the real cost of calls to AI models, AI tasks and their errors;
• emails sent by the service: their type, their status and the recipient’s domain, without the address itself.

It never sees your content: not your posts, your brand profile, your images, or your references and their photos. The console can neither sign in as you nor write in a project.

Your feedback is the exception, because you send it: feedback sent with “Send feedback” (a problem, an idea, a question) reaches the console with its message, the page it was sent from, the open project and organization, the browser, window size, app version and, for a problem, the app’s last error. A screenshot of the page is attached only if you check it; it is the only time the team can see part of your content. The team replies in writing, in the app and by email. Your feedback is visible only to you and the team.

Support actions (adding Sparks, comping a plan, creating an organization, suspending an account, closing its sessions, sending the password reset email, deleting an account, stopping a task) require a stated reason and are logged: who, what, on what, when and why. A password reset link goes to your address; nobody else sees it.

These traces are not kept forever: a daily task erases the log of sent emails past 12 months, the reports of scheduled tasks past 90 days and the log of support actions past 24 months.

wall.joli.studio

On wall.joli.studio, you paste a website address and joli.studio turns it into a wall of nine posts, with no account. What we keep:

• the wall: the site’s domain, what joli.studio read from it (name, colors, fonts, voice, topics), the nine posts, their look, the date and, for a wall given as a gift, the first name the giver chose to leave;
• measurement: a wall’s opens and its shares by channel, counted without cookies or identifiers, then deleted after 12 months.

What we don’t keep:

• no account and no email address are required to make a wall;
• your IP address is never stored. To limit the number of walls per day, we only keep a fingerprint computed from the address, the current date and a secret key: without that key, it can’t be traced back to the address, nor link two days together. This fingerprint is deleted after 2 days.

The browser that made a wall keeps its key in local storage; it is used to adjust that wall, nothing else. Before a wall is made or reported, wall.joli.studio tells visitors from robots with Cloudflare Turnstile, in invisible mode. Turnstile is governed by the Cloudflare Turnstile Privacy Addendum.

Like the brand analysis, the reading only covers the site’s public pages, by the same robot, and the text read is sent to OpenAI to write the posts. Before any wall, this text — along with the optional description sentence and the first name of the person giving a wall — goes through an automated moderation check by OpenAI. A refused domain is kept for 30 days, so its site isn’t read again on every request. A wall remains the wall of its domain for 30 days; after that, a new one may replace it.

“It’s my brand.” A brand can prove a site is theirs, through a link sent to an address on their domain (email sent by Resend) or a tag placed on their home page. The address given is only used for that email and is deleted upon confirmation; the record of the claim is deleted 90 days after it is confirmed or expires. The brand can then take the wall down: removal is immediate, the wall disappears from the Wall and from its address, and the domain can’t get a new wall for a year. A wall that was taken down or replaced is no longer shown anywhere; its record is kept, not displayed, to enforce the removal. Anyone can also report a wall, which the team takes down from the admin console.

Make this wall real. If you create an account from a wall, its brand and posts enter your first project: from then on, they follow the rules of the app described on this page.

Prospecting

The joli.studio team writes to businesses to introduce the service, one message at a time, reviewed and sent by a person, from the address jc@jolistudio.app. We never write to private individuals, never to a guessed address: only to the address a business publishes for its trade (including a consumer mailbox, as craftspeople and freelancers often use) and about a subject related to that trade.

Where the data comes from. Two public sources: the French government’s business directory (the Recherche d’entreprises API, Sirene data from INSEE), from which we only keep active establishments whose information is public; and the company’s own website, read by the same robot as the brand analysis, respecting its robots.txt file. We read neither Instagram, Facebook nor LinkedIn, and we buy no lists.

What we keep about a business we contact:

• its name (which may be the owner’s name for a sole proprietorship), its SIREN and SIRET numbers, its activity code, its town and its headcount bracket, as published by the directory;
• its website, the links to its social accounts found on that site, the business address it publishes there and the page where we read it;
• a score out of ten, criterion by criterion, which helps us choose whom to write to, and our working notes;
• our exchanges: the messages sent and received, their date, whether they were delivered or bounced, and our reading of each reply (interested, question, not now…);
• the wall we prepared for it on wall.joli.studio, if any.

The offered wall. We may prepare a wall.joli.studio wall for the business from its website. This wall is never public: it is not on the Wall, not indexed by search engines, and shows no person. The link in our message carries a personal token: when it is opened, we know the wall was seen, and if an account is created from that wall, we link that account to our exchange, once. The token is never stored in clear, only its fingerprint.

Artificial intelligence. To find a business’s website, its name and town are sent to OpenAI, which runs a web search. To prepare a message, score a business or read a reply, the information above and our exchanges are sent to OpenAI, under the same terms as the AI actions of the app: OpenAI does not use them to train its models. The model prepares; a person always reviews and sends.

Legal basis: our legitimate interest in introducing joli.studio to professionals, within the framework set by the CNIL for business-to-business prospecting.

Objecting can be done at any time, with no reason needed, and is permanent:

• by replying STOP to any of our messages;
• through the opt-out link at the bottom of each of our messages (or “Unsubscribe” in your email app);
• by writing to bonjour@joli.studio.

An objection immediately stops all sending, removes the offered wall and erases the business’s record by the next day at the latest. So that we never write to you again, even if your business shows up in the directory again, we only keep a fingerprint of your domain and address (a one-way calculation that cannot be reversed to find them): this is our objection register, which is never erased and contains nothing else.

Who sees this data: the joli.studio team, in its admin console. The jc@jolistudio.app mailbox is hosted by Google (Google Workspace), which carries and stores our messages; OpenAI processes what is described above. No prospecting data is sold or passed on to anyone else.

How long: a business with no follow-up and our exchanges are erased 12 months after our last contact; search results we did not keep, after 7 days; an offered wall never opened, 30 days after it was made (otherwise along with the record); the link between an account and our exchange lives and dies with the account; the fingerprints in the objection register are never erased.

Your rights of access, rectification, erasure and objection are exercised at bonjour@joli.studio, as described below. A request for erasure is handled as an objection: the record is erased, and only the fingerprint remains, so that we don’t write to you again.

Where your data lives

The database is hosted by Cloudflare (D1) in Western Europe; images and files are stored on Cloudflare R2. The following providers process data on our behalf, on our instructions:

If you choose “Continue with Google,” Google authenticates you and passes us the identifier, name, address and photo of your account; Google then acts under its own privacy rules.

Suggested addresses. When you type a billing address in France, the text typed in the “Address” field goes through our servers to the geocoding service of IGN’s Géoplateforme (the French public institute for geographic and forest information), which suggests addresses from the Base Adresse Nationale. Only that text is sent: not your IP address, your name or your account. Nothing is sent for an address outside France.

Transfers outside the European Union

Cloudflare, OpenAI, Resend and Sentry are established in the United States, and Google may process the messages of the prospecting mailbox outside the European Union. The corresponding transfers rely on the standard contractual clauses of the European Commission.

Retention periods

• Account and content: for as long as the account exists. The saved versions of a published post are deleted 30 days after it is published, except its “Published” version. An organization is deleted from its settings, the account from “My account”, Danger zone tab, or on request at bonjour@joli.studio.
• Invoices: ten years, under accounting obligations; our copy of them, with withdrawals, outlives the organization’s deletion for the same reason. Events received from Stripe: 12 months.
• Technical logs: Cloudflare’s request and error logs (Workers Logs), 7 days; error reports at Sentry, 90 days at most. The metadata of AI calls, without their content, stays in Cloudflare’s gateway within its storage limit, the oldest deleted first.
• Traces of the administration console: the log of sent emails, 12 months; the reports of scheduled tasks, 90 days; the log of support actions, 24 months. A daily task erases whatever is past its period.
• Waitlist: a request that never became an account is erased 12 months after its last email; a request that became an account, 30 days after the account was created, and along with it if it is deleted. “Remove me from the list,” at the bottom of every email, erases it right away.
• Publish links: the files uploaded for the phone, one day after the link expires, at the next daily run; the link itself, 30 days after it was created.
• Feedback: for as long as the account exists; a page screenshot attached to feedback is erased 90 days after the feedback is resolved or archived.
• wall.joli.studio: IP address fingerprints, 2 days; domains refused by moderation, 30 days; measurement of opens and shares, 12 months; claims, 90 days after they are confirmed or expire; a wall remains the wall of its domain for 30 days.
• Prospecting: a business with no follow-up and our exchanges, 12 months after the last contact; search results not kept, 7 days; an offered wall never opened, 30 days; the fingerprints of the objection register, with no limit (see “Prospecting”).
• Audience measurement: at Elvn Analytics, events and their pseudonym are deleted at most two months after they are sent; the statistics drawn from them, simple counters, are kept for 13 months.

When the account is deleted, the content and the associated data are erased, subject to legal retention obligations.

Your rights

You have the right to access, rectify, erase, restrict, object and to data portability. To exercise them, write to bonjour@joli.studio: we answer within one month.

You may also lodge a complaint with the CNIL, the French data protection authority, at 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

Security

Exchanges are encrypted in transit. Passwords are stored as hashes. Access to data is partitioned by organization: the content of an organization is visible only to its members.

Changes

This policy evolves with the service. Every version is published at this address with its update date; a significant change is announced to account holders before it takes effect.