Legal information
Version 1.4, in force as of 20 August 2026
This policy explains how CONCIPI, the publisher of Aptessia, processes the personal data whose purposes and means it determines itself: that of site visitors, of people who request a demonstration or a trial, and of users of client accounts. Candidate data falls under two distinct regimes. In the talent pool belonging to a client company, that company decides how the data is used, and CONCIPI processes it on that company's behalf under the terms of the data processing agreement (DPA). In the Aptessia shared talent pool, where a profile becomes visible to other companies, CONCIPI is the controller and answers for it directly. In both cases, what concerns candidates is set out in the privacy policy written for them.
The controller for this processing is CONCIPI, a société par actions simplifiée whose registered office is at 43 quai Malakoff, 44000 Nantes, France. Its full identification details appear in the legal notice. CONCIPI has not appointed a data protection officer: the processing carried out to date falls under none of the cases of mandatory appointment set out in Article 37 of the GDPR. Any request relating to personal data may be sent to contact@aptessia.com.
Visiting the site. The host's technical logs (IP address, timestamp, page requested) keep the site running and make it possible to spot abuse. Legal basis: CONCIPI's legitimate interests in the security and proper functioning of the service. Contact form and appointment booking. Name, company, email address, telephone number, message and chosen time slot are used to arrange the meeting you requested and to continue the conversation afterwards. Legal basis: pre-contractual steps taken at your request, then legitimate interests for the rest of the business relationship. Trial request. The same information is used to check the request, open your trial workspace and contact you about it. The consent box shown on the form, its timestamp and the version of the text you accepted are kept as evidence of that consent. No payment details are requested at this stage. Creating and managing a client account. Company name, company registration number or intra-Community VAT number, the administrator's email address, the plan subscribed to and billing details are used to open the account, perform the subscription and issue invoices. Legal basis: performance of the contract, and the legal obligation to retain accounting records. The bank details of the direct debit mandate are collected and kept by our payment provider, never by Aptessia. Using the platform. Connection logs and usage measurement (actions carried out, consumption of the subscription) are used for account security, usage-based billing and improvement of the service. Legal basis: performance of the contract and legitimate interests. Marketing. CONCIPI may send information about its offers to people who have contacted it or who use the service. Legal basis: legitimate interests. You can put a stop to this at any time, simply by replying to one of our messages or by writing to contact@aptessia.com. Your data is never sold to third parties.
Aptessia relies on artificial intelligence models to analyse a recruitment need, generate questionnaires and propose summaries. Two principles govern this use. No automated decision-making. No decision producing legal effects concerning you or similarly significantly affecting you is taken solely on the basis of automated processing, within the meaning of Article 22 of the GDPR. AI informs, a person decides. Content sent to a model is filtered beforehand to remove directly identifying data, and content produced by AI is flagged as such in the interface.
The data is accessible only to those people at CONCIPI who need it, and to the following providers, which act solely on instructions and for the purposes described here: Scaleway (France): hosting of the site and the application, sending of the service's emails. Supabase: database and authentication, data hosted in Paris. Mistral AI (France): language processing for the artificial intelligence features. GoCardless: setting up the SEPA direct debit mandate and collecting subscription payments. Google: calendar used for online appointment booking. Cloudflare: audience measurement for the site, with no cookies and no profiling. The processors involved in candidate data are listed in the DPA, and any change to that list is communicated to clients.
The site, the application and the database are hosted in France. Some providers are nevertheless established outside the European Union, or may access the data from a third country for their support purposes: this is the case for Supabase, for GoCardless and for Cloudflare. Depending on the provider, that access relies on an adequacy decision of the European Commission or on the standard contractual clauses it has adopted.
Contact, demonstration and trial requests: three years from the last exchange, then automatic erasure. Client accounts: for the whole term of the subscription, then deletion or return of the data under the terms set out in the contract. Invoices and accounting records: ten years, in accordance with the French Commercial Code. Evidence of a consent: for as long as that consent produces its effects, then for the applicable limitation period. Technical logs and connection logs: twelve months at most. Candidate data placed in a company's talent pool follows the period that company has set in its workspace, which is communicated to the candidate at the time of collection. Data published in the shared talent pool is governed by the privacy policy written for candidates.
The site uses no advertising tracker, and no browsing data is ever sold. Site traffic is measured with Cloudflare Web Analytics, which sets no cookie and builds no fingerprint of your browser. The tool produces totals only: page views, where visits come from, country and device type. No profile is built, and nothing allows you to be followed from one site to another. Legal basis: CONCIPI's legitimate interest in knowing its site's audience. The application itself is measured by no third-party tool. The only cookies set are those strictly necessary for the service you request: the session that keeps you signed in, and the language and display theme you have chosen. These cookies are exempt from consent, and the audience measurement described above neither writes to nor reads from your device. That is why no banner is shown to you: asking for your agreement to cookies that are exempt from it would lead you to believe you have a choice that you do not.
You have the right of access, rectification, erasure, restriction of processing, objection and data portability, as well as the right to withdraw your consent at any time where the processing is based on it, without that withdrawal calling into question what was done beforehand. You may also give directions on what is to become of your data after your death. These rights are exercised by writing to contact@aptessia.com. You will receive a reply within one month, which may be extended to three months if the request is complex: you are then informed of this and told the reason. If your request concerns a candidate profile submitted by a client company, it is for that company to deal with first, and we forward it to them. You may also lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at www.cnil.fr, or with the supervisory authority of the country where you habitually reside.
The data is hosted in France, encrypted in transit and at rest. Access is restricted to the people who need it and is logged, directly identifying data is filtered out before any call to an artificial intelligence model, and the measures are set out in detail in the DPA.
This policy carries a version number and a date of entry into force. Any change gives rise to a new version published on this page, and substantial changes are notified to clients by email.
For any question about this document or about the processing of your data: contact@aptessia.com, or CONCIPI, 43 quai Malakoff, 44000 Nantes, France.