Privacy policy
Last updated: October 28, 2026
Courtesy translation. The French version of this page is the reference and prevails in case of any discrepancy. Lire la version française.
This page explains what personal data Agraff processes, why, for how long, with whom we share it, and what your rights are.
1. Data controller
LECOCON, SARL, 23 rue d'Anjou, 75008 Paris, France, SIREN 890 296 197, is the data controller. Contact: contact@getagraff.com.
2. Data processed, purposes and legal bases
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Email address, account creation date, acceptance of the terms | Create and secure your account, send you the login link and service-related messages | Performance of the contract | Until the account is deleted |
| Link to your LinkedIn account (technical identifier at Unipile, display name, connection date) | Let your AI access your LinkedIn at your request | Performance of the contract | Until disconnection or deletion of the account |
| Fingerprint of your personal address (never the address in clear), write settings and caps | Authenticate your AI, apply your settings | Performance of the contract | Until the account is deleted |
| Log of write actions (action type, tool, status, date, technical detail) | Show you the activity, apply your caps, security and abuse prevention | Performance of the contract, legitimate interest | Until the account is deleted |
| Drafts prepared by your AI | Let you review them before sending | Performance of the contract | Until sent, abandoned or the account is deleted |
| Payment data (managed by Stripe), customer identifier, subscription status, invoices | Manage the subscription, invoice, meet our accounting and tax obligations | Performance of the contract, legal obligation | Accounting records: 10 years |
| Free skills: email address, page language, personal token of your access link, date and proof of your consents, fingerprint of your IP address (never the address in clear), browser type | Give you access to the skills and email them to you; limit abuse; if you ticked the optional box, send you Agraff tips and invitations to training sessions | Your request for the skills; legitimate interest (security); consent for communications | 3 years from the last contact, or until you unsubscribe |
| Affiliate programme (when open): affiliate email, link code, click count (IP address fingerprint, never the plain address), referrals, pre-tax amounts and commissions, payout details (IBAN or PayPal, encrypted, never displayed in full) | Run the programme, calculate and pay commissions, prevent self-referral and fraud | Performance of the contract (affiliate terms), legitimate interest, legal obligation | While participating; accounting records of payouts: 10 years |
| Technical connection data (IP address, technical logs) | Security, diagnostics, fraud prevention | Legitimate interest | 12 months at most |
Free skills download. The skills are free: you only need to enter your email and accept this privacy policy. We email you your personal skills install link (at most one message every 6 hours for the same address); this link is specific to your address and gives access to the guide and the files, so please do not share it. A second box, unticked by default and optional, lets you receive Agraff tips and invitations to training sessions; declining it does not affect your access to the skills. The skills delivery email may include one short informational line about Agraff. Apart from that line, we send you no other commercial email unless that box is ticked. We keep this data for 3 years from your last contact with us. You can withdraw your consent and unsubscribe at any time, by writing to contact@getagraff.com; you can also ask for your address to be erased.
LinkedIn content. When your AI asks to read a message, a conversation or a profile, this content passes through our servers and Unipile's to be delivered to your AI. We do not keep it, apart from the drafts mentioned above, and we do not use it to train models. Once delivered to your AI, it is processed by its publisher under its own terms, over which we have no control. You are responsible for choosing your AI.
We do not receive your LinkedIn password: it is entered on Unipile's secure page.
Affiliates. An affiliate never sees the identity of the people they referred: only counters (clicks, sign-ups, paying customers) and amounts. The link between a new subscriber and the affiliate who referred them is kept for the commission period, then for our accounting obligations.
We do not sell your data, we do not run targeted advertising and we make no automated decision producing legal effects concerning you.
3. Recipients and processors
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, authentication, server functions | European Union (Frankfurt, Germany) |
| Unipile | Technical connection to your LinkedIn account | France |
| Vercel Inc. | Website hosting | United States, global network |
| Stripe | Payment and invoicing | European Union and United States |
| Resend | Sending emails (login link, notifications, skills email and, with your consent, Agraff messages) | European Union (sending region), US company |
Your AI and its publisher (for example Anthropic, OpenAI, Mistral AI or Cursor) are not our processors: you choose them and contract with them directly.
4. Transfers outside the European Union
Some providers (Vercel, Stripe, Resend) are companies established in the United States or have activities there. Any transfers are covered by the Data Privacy Framework when the provider is certified, or by the European Commission's standard contractual clauses.
5. Security
Exchanges are encrypted (HTTPS). Your personal address is never stored in clear: only its fingerprint is. Access is limited and data is isolated per account. As no system is infallible, we invite you to keep your personal address secret and to regenerate it if in doubt.
6. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data. You can delete your account and your data at any time from “My account”. For any other request, write to contact@getagraff.com; we answer within one month. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07).
7. Cookies and trackers
The website uses only items strictly necessary for its operation and no advertising or audience-measurement trackers. The only exception, when the affiliate programme is open: if you arrive through a referral link, that link's code is remembered for 60 days to credit the recommendation. Details on the Cookies page.
8. Updates
We may amend this policy. The version in force is the one published on this page; in case of an important change, we will inform you by email.