Privacy

Controller. Better ISMS EURL, 60 rue François 1er, 75008 Paris, France, RCS Paris (SIREN 943 594 648), is the controller for the processing described here. Contact: contact@ismscopilot.com or the contact form linked in the footer. The products (ISMS Copilot, heyGRC, Aevral, the directories) have their own privacy terms on their own sites and on the trust center.

Page analytics. We use Vercel Web Analytics, which does not use cookies and does not store IP addresses or personal identifiers; it records page views and anonymised device categories. Lawful basis: our legitimate interest in knowing how the site is used. Retention: aggregated, not personal.

Server logs. Our hosting provider, Vercel, records requests (IP address, user agent, requested URL, time) for security and operations. Lawful basis: legitimate interest in keeping the site secure and available. Retention: the request logs are kept by the provider for a short rolling window and are not exported by us.

The embedded assistant. The homepage embeds ISMS Copilot, a service we operate. What you type into it, together with technical session data, is processed by that service to answer you and to secure the service. Lawful basis: your request when you use it (pre-contractual steps and legitimate interest). Retention and sub-processors for that service are published on the trust center; conversations are not stored by this site. Do not enter confidential information you would not send to a support chat.

The contact form. The contact form is hosted by Tally (Tally BV, Belgium). What you submit (your name, email address and message) is stored by Tally and read by us to answer you. Lawful basis: legitimate interest in answering the people who write to us. Retention: deleted within twelve months of the last exchange.

Recipients and transfers. Processors: Vercel Inc. (hosting and analytics, United States, with European points of presence), Tally BV (forms, EU), and the sub-processors of ISMS Copilot listed on the trust center. Transfers outside the European Economic Area rely on the European Commission's Standard Contractual Clauses included in each provider's data processing terms.

Cookies. This site sets no tracking cookies of its own and shows no cookie banner because none is needed. The embedded assistant may set a functional cookie or storage entry to keep your conversation open while you use it.

Your rights. Under the GDPR and French law you may access the data we hold about you, have it corrected or erased, restrict or object to its processing, receive it in a portable format, withdraw consent where consent was the basis, and set directives on what happens to your data after your death. Write to contact@ismscopilot.com or use the contact form; we answer within one month. You may also complain to the CNIL (cnil.fr).

Evidence. The list of sub-processors, the data processing agreement and the security programme are published on trust.ismscopilot.com.