Privacy policy (English courtesy translation)
Version 1.0 · Other languages: FR
Version 1.0, courtesy translation of the French version of 30 octobre 2026. Only the French version is binding: in case of divergence, the French version prevails (article 15.6 of the Terms of Service).
This policy describes all the processing of personal data that we carry out, and the trackers that we set. It is written to be read.
Sellers observed on marketplaces have dedicated information: seller information notice.
1. Who processes your data
WhoHeld, société par actions simplifiée unipersonnelle, 49 cours Mirabeau, 13100 Aix-en-Provence, France, Trade and Companies Register (RCS) Aix-en-Provence 130 164 783.
Data protection contact: privacy@whoheld.com.
No data protection officer has been appointed: our written and dated analysis, provided on request, concludes that Article 37(1) of the GDPR does not require us to appoint one. It is reviewed every year, and earlier if the estimated number of observed sellers who are natural persons or the scope of the service changes significantly. Requests concerning your data are handled at the address above.
2. What we do not do
- We do not connect to any merchant account of our clients and receive no data from one.
- We process no buyer data: no identity, no delivery address, no purchase history, no order content.
- We process no sensitive data (Article 9 of the GDPR) and no data relating to criminal convictions, and we keep no bank card number.
- We neither sell nor rent any personal data.
- We use no third-party audience measurement tool, no advertising tracker, and our commercial messages contain neither an open-tracking pixel nor a tracking link. The page of a personal demonstration film tells us nothing of its own accord: only the button provided for that purpose, if you click it, tells us that you have watched it.
3. Our processing operations
We act as controller, except for the rows marked "processor": in that case, the controller is the client company that opened the account, and it is to that company that we direct you.
| Processing | Data | Legal basis or capacity | Retention |
|---|---|---|---|
| B2B commercial prospecting | Name, position, employer, professional email address and telephone number, address of the public professional profile, history of exchanges. For a prospect to whom we send a personal demonstration film: the link to their page (private address, not indexed, without trackers) and, if they use them, their response to the "let us know I watched" button and their access request. Sources: public company websites, public professional profiles (LinkedIn), online professional directories, and the person themselves. No purchased file, no automated extraction tool. We keep track of our exchanges in an internal tool hosted in the Union. If you test the service, we link these exchanges to the steps of your evaluation (acceptance of the terms, logins, requests), to support you. | Legitimate interest (Article 6(1)(f)). Our messages are sent to professionals, concern offers related to the position held and include a simple and free means of refusal (article L.34-5 of the French Postal and Electronic Communications Code (CPCE)). Our first message states where your contact details come from, refers to this policy and allows you to refuse any further contact (Article 14 of the GDPR). We send an email only to an address that you have given us | 3 years after the last exchange; 1 year after our last message if you have never replied. Personal film: deleted no later than seven (7) days after its page expires (30 days); link to the page: ninety (90) days after that expiry, the page stating until then that the film has expired. Only the data necessary to take a refusal into account (name, address or profile, date) are kept for as long as we carry out prospecting, so that we do not contact you again |
| Platform user accounts | Surname, first name, professional email address, company, role and rights | Processor (controller: the employer) | Term of the contract, then deletion in accordance with the reversibility clause of the Terms of Service |
| Security, logging, usage measurement | Technical identifiers, IP addresses, timestamps, administrative actions, security events, volumes, platform pages viewed; log of team actions (invitation, resending, removal, change of role or scope: author, person concerned and their email address, date, role and scope before and after, without free text), visible to your company's administrator | Legitimate interest (Article 6(1)(f)): security of the service and prevention of unauthorised use, and management of the support provided to the client (pages viewed, aggregated per client account); legal and contractual obligations for invoicing. This measurement is carried out by our own application, without any third-party tool or additional tracker | Log of team actions: twelve (12) months, then deletion. Log of calls to the connector for artificial intelligence assistants (account, authorised assistant, tool, date, without content): twelve (12) months. Administration logs (access granted by us, a client account viewed by our team): twelve (12) months. Log of actions on evaluations (opening, extension, closure) and of announcements sent to clients: thirty-six (36) months. Other logs: 6 mois au plus, a period aligned with the purges actually scheduled, extended for the duration of an investigation. Daily copy of the security logs of our server (connections, IP addresses, errors), encrypted before it is sent and stored outside that server: ninety (90) days, under a lock that prevents its deletion before that date |
| Support for the free evaluation | Name, position, employer, professional email address, exchanges with us, platform usage indicators during the evaluation (last login, screens viewed, documents downloaded), answers given | Legitimate interest (Article 6(1)(f)): supporting the evaluation that we offered you and that you accepted for your company, answering your questions and presenting the possible next steps to you. No automated decision; you may object at any time, without the evaluation being affected | Usage indicators: deleted with the accounts, thirty (30) days after the end of the evaluation, unless a subscription is taken out. Exchanges, including feedback sent from the application: 1 year after the last contact, then permanent deletion within thirty (30) days. Proof of acceptance of the conditions of the trial (account address, company, date, text accepted): thirty-eight (38) months after acceptance, that is at least 3 years after the end of the evaluation, in order to establish, in the event of a dispute, what was accepted. Access window of each invited person (address, start and end dates, extension and reference of the written document granting it): thirty-six (36) months after the invitation, for the same reason |
| Log of questions asked to Ask WhoHeld (assistant open to clients on the Lead+ plan since 26 October 2026) | Question as typed by the user (free text, which may contain personal data, including a seller's name), answer produced (before anything is sent to the model, the names and identifiers of sellers that we recognise, in the data and in the question, are replaced by pseudonyms; the answer kept in the log may contain a seller name, restored on display), tools consulted, volume and cost of the exchange, identifier of the user and of their company, timestamp. The pseudonym correspondence table is never kept | Legitimate interest (Article 6(1)(f)): checking the accuracy of the answers, auditing and correcting the assistant, preventing unauthorised use | 12 months after the question, then deletion |
| Contracts and invoicing | Identity, professional contact details, position, contractual and accounting documents. Recipients: our chartered accountant, Dougs, which keeps our accounts and through which our invoices are issued and sent; our bank, Qonto, for the transfers we receive; the tax and social security authorities | Performance of the contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)) | Term of the contract, then 10 years for accounting documents (article L.123-22 of the French Commercial Code) |
| Support | Content of requests, technical elements provided | Processor (controller: the employer) | 3 years after the request is closed; earlier deletion if the contract ends before then, in accordance with the reversibility clause |
| Email alerts | Professional address, preferences, content of the alert | Processor (controller: the employer) | Term of the contract; sending log sans adresse de destinataire (compte client, type d'alerte, référence produit, date) |
| Browser extension | Product references present on the page viewed (a single one on a product page, all the references displayed on a search results page), marketplace identifier, session token stored locally | Processor (controller: the employer). Local storage is strictly necessary for the service requested (Article 82 of the French Data Protection Act (loi n° 78-17)) | No browsing history is built up: the references are used to compose the answer displayed, they are not kept |
4. Observation of marketplaces and sellers
| Data subjects | Sellers present on the tracked Amazon marketplaces (France, Germany, United Kingdom, Spain, Italy, United States, Canada, Japan, Mexico, Brazil, India), where they are natural persons. As we cannot reliably distinguish them from legal persons, we apply the GDPR to all records |
| Data | Trading name, seller identifier, country of establishment (the address itself is not kept), public rating and number of public reviews, fulfilment method, offer qualifications, prices charged over time, activity indicators (Buy Box holding, number of competitors, catalogue size, brands distributed) |
| Purpose | Producing, for business clients, analyses of the competitive environment on marketplaces |
| Legal basis | Legitimate interest (Article 6(1)(f)). The balancing test was carried out according to the three-step test and is provided on request. The public nature of the data is not, on its own, a ground for lawfulness |
| Sources | Public pages of the marketplaces. We do not browse them ourselves: we obtain this data from a specialised provider, under a written commercial licence, based on public sources of the marketplaces. This provider collects the data on its own account, as an independent controller, and we reuse it as a separate controller (see the seller notice). To check that our screens are accurate, we also open a few public product pages ourselves, once a week, and note the seller who holds the buy button |
| Recipients | Our business clients, including companies in a free evaluation, in the form of analysis results; our prospects, in the form of pseudonymised extracts (sellers designated "Seller A", "Seller B") limited to their own products; the third parties to whom they are contractually authorised to disclose results (companies of their group, advisers, e-commerce agencies and service providers, contacts within the marketplaces), in the form of processed results, never the raw data or anything from which they could be reconstructed, and under equivalent confidentiality; our processors (section 6), on our instructions; the competent authorities, upon lawful request |
| Profiling | This processing involves profiling (Article 4(4)), limited to the selling activity carried out towards the public. No automated decision is taken, and no indicator is designed to form the basis, on its own or in a determining way, of a decision producing legal or significant effects for a seller (Article 22, criterion of the CJEU SCHUFA judgment) |
| Retention | Seller's trading name and country: 24 months after the last observation, then erased. Seller's marketplace identifier, and dates of first and last observation: 36 months rolling, like the series it allows to be linked. Holding events, shares and prices linked to a seller: 36 months rolling. Profile indicators: 12 months, replaced at each refresh, with no history. Mentions of a seller in the questions asked by our clients to Ask WhoHeld and in the answers kept in the log: masked as soon as the seller objects, and deleted no later than 12 months after they are recorded |
| Objection | A right to object is available, free of charge, simply by invoking grounds relating to your particular situation (Article 21(1)). See the seller notice |
Price and rank series attached to a product reference, without a seller identifier, relate to the product page and are processed outside the personal data regime. This classification is verified, and it is requalified as soon as a series would become reasonably attributable to an identifiable seller.
5. Trackers
We use eight trackers, and only eight: two keep your session authenticated, six remember a choice you have made.
| Tracker | Where | Type | Duration |
|---|---|---|---|
sb-<project>-auth-token (possibly split into .0, .1) |
Web platform | Cookie, set on our behalf by our authentication provider, limited to this sole purpose | Cookie: up to 400 days, a ceiling set by browsers, and deleted on logout. It carries an access token valid for 15 minutes, renewed automatically, and a refresh token |
| Session token | Browser extension | Browser local storage | Until logout, uninstallation or clearing of browser data |
whoheld-help-from |
Help centre | Browser session storage: the platform screen from which you opened the help, in order to take you back to it | Closing of the tab |
whoheld-legal-from |
Site and platform | Browser session storage: the last page of the site visited outside the legal documents, so that the return link of the legal documents takes you back to it | Closing of the tab |
whoheld.carte-essai.repliee |
Web platform, during the evaluation | Browser local storage: the evaluation card is collapsed or expanded | Until you expand it, or clearing of browser data |
whoheld.start.reste-confirme.<your company identifier> |
Web platform, first-use screen | Browser local storage: you have confirmed that the other sellers are third-party sellers, so that the question is not asked again in this browser. It contains only the value "1"; the key carries your company's technical identifier, without any name or email address | Until browser data is cleared |
whoheld.newAsins.rayon.<your account identifier> |
Web platform, New ASINs screen | Browser local storage: the shelf you chose last, to find it again on your next visit. It contains only the technical identifier of the shelf; the key carries the technical identifier of your account, without any name or email address | Until you change shelf, at logout (browser storage purge) or when browser data is cleared |
whoheld.commentLire.<box> |
Web platform | Browser local storage: the "How to read these numbers" box of a page is open or collapsed, so that you find it as you left it. It contains only the value "1" or "0" | Until browser data is cleared |
These eight trackers are strictly necessary for the service you request: no consent is required and we display no banner (Article 82 of the French Data Protection Act (loi n° 78-17); CNIL guidelines No. 2020-091 and recommendation No. 2020-092). This absence is a choice, not an oversight.
No Google Analytics, no Meta or LinkedIn pixel, no retargeting tool, no social sharing button setting a tracker. No third-party audience measurement tool is installed. The pages viewed on the platform are recorded by our server when it serves them, and deliverable downloads when it signs their link: no request, cookie or storage is added in your browser for this tracking. The page path, the date, the User account and the company are recorded, identified by the session already open; this data is kept for six (6) months. They are used for security, to measure your company's use and for onboarding support (section 3), never for advertising or for tracking outside the platform. This processing relies on our legitimate interest; your rights, including the right to object, are exercised as set out in section 9. If we were to install an audience measurement tool, it would be without cookies or persistent identifiers, under the cumulative conditions laid down by the CNIL for tools exempt from consent; if we had to set a tracker subject to consent, we would put in place a compliant consent mechanism offering a refusal as simple as acceptance. In both cases, this policy would be updated before any tracker is set.
You can block or delete trackers from your browser's privacy settings. Blocking the authentication trackers prevents access to the platform; the extension's storage is deleted by uninstalling it; blocking the other six only deprives you of the return to the original page, of the memory of the collapsed card, of the explanatory boxes and of the chosen shelf, and of the memory of your confirmation about the other sellers.
6. Who receives the data
The data relating to observed sellers are disclosed to our business clients in the form of analysis results, with a contractual prohibition on any programmatic access, except the connector through which a Lead+ client has these results read by the artificial intelligence assistant it has chosen, for which it is responsible and whose provider is often established outside the Union. Our clients may disclose these results to the companies of their group, to their advisers, to their e-commerce agencies and service providers and to their contacts within the marketplaces: these are always processed results, never the raw data or anything from which they could be reconstructed, and the recipient is bound by equivalent confidentiality.
All data are hosted with our processors and are accessible, within our company, only to authorised persons. A contract compliant with Article 28 of the GDPR governs each processing arrangement:
| Processor | Role | Location of processing |
|---|---|---|
| Supabase Pte. Ltd. (AWS infrastructure) | Database, authentication | France (eu-west-3) |
| Hostinger International Ltd. | Server running the collection | France (Paris), Union européenne ; sauvegardes hebdomadaires de l'instance aux Pays-Bas, Union européenne |
| Resend | Service messages, alerts and evaluation onboarding series | envoi depuis l'Union européenne (Irlande, région eu-west-1), stockage des données aux États-Unis |
| Vercel Inc. | Hosting of the web application | Allemagne (Francfort, région fra1), réseau de diffusion mondial ; société établie aux États-Unis, clauses contractuelles types (UE) 2021/914 |
| Functional Software, Inc. (Sentry) | Reporting of the platform's technical errors, in order to fix failures: error message, technical identifier of your account and of your company, page concerned, browser, operating system, language and time zone; no email address, no request content, no IP address retained, no geolocation; ninety (90) days at most | Germany (Frankfurt) |
| Scaleway SAS | Storage of our weekly backup copy and of the daily copy of our server's security logs, both encrypted before they are sent: this provider does not hold the key and cannot read their content; kept for ninety (90) days | France (Paris, région fr-par), Union européenne ; société établie en France, aucun transfert hors de l'Union |
| Google Cloud France SARL, 8 rue de Londres, 75009 Paris (Google Workspace) | Business email: our exchanges with you, invitations, support | Centres de données de Google, sans choix de région dans la formule souscrite : transferts possibles hors de l'Union européenne, encadrés par l'avenant de traitement des données de Google Cloud (Cloud Data Processing Addendum : clauses contractuelles types (UE) 2021/914 ; Google LLC certifiée au cadre de protection des données UE–États-Unis) |
| Anthropic Ireland, Limited (Ireland), which has the data processed in the United States by its parent company Anthropic, PBC | Artificial intelligence assisted analysis (Ask WhoHeld), on pseudonymised data and on the question you type; data kept for thirty (30) days at most, except an exchange flagged as breaching its usage policy (two (2) years at most) or a legal obligation; Anthropic does not use data received through its API to train its models | United States |
Invoicing data are also disclosed to our chartered accountant, Dougs, and to our bank, Qonto, both established in France (point 3, "Contracts and invoicing"). Finally, the data may be disclosed to our advisers and to the competent authorities, upon lawful request.
7. Where the data are processed
The data are hosted within the European Union, except the data of the emails we send, which our sending provider stores in the United States; artificial intelligence assisted analysis (Ask WhoHeld) is performed in the United States, and some of our processors may access the data from a third country (see below).
The observation of sellers present on marketplaces located outside the Union (United Kingdom, United States, Canada, Japan, Mexico, Brazil, India) does not constitute a transfer: the data are collected into the Union and hosted there.
Google Workspace (email), subscribed with Google Cloud France SARL, 8 rue de Londres, 75009 Paris, does not allow the storage region to be chosen: our exchanges may be processed in Google data centres located outside the Union, under the Google Cloud data processing addendum (standard contractual clauses; Google LLC is certified under the EU-US Data Privacy Framework). Four of our processors are established outside the European Union: Supabase Pte. Ltd. in Singapore (database, hosted in Paris), and, in the United States, Resend (email sending from Ireland, message data stored in the United States), Vercel Inc. (web application, run in Frankfurt) and Functional Software, Inc. (Sentry, error reporting, data stored in Frankfurt); their teams may access the data from those countries. A fifth, Anthropic Ireland, Limited (artificial intelligence assisted analysis), is established in Ireland but has the data processed in the United States by its parent company Anthropic, PBC. Anthropic receives pseudonymised data derived from the results, without any seller name or country, and the question you type into Ask WhoHeld, after the names and identifiers of sellers that we recognise have been replaced by a pseudonym: any other name you write in it is transmitted. These data are kept by Anthropic for thirty (30) days at most, except an exchange flagged as breaching its usage policy (two (2) years at most) or a legal obligation; Anthropic does not use data received through its API to train its models. These transfers are governed by the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), incorporated into their processing agreements, and by the technical measures of point 8, supplemented for Anthropic by the pseudonymisation of sellers before anything is sent. Any other transfer to a third country would be subject to the same safeguards or to an adequacy decision. Copy of the safeguards on request at privacy@whoheld.com.
8. Security
We implement appropriate technical and organisational measures: encryption of communications (TLS) and of data at rest, segregation of data between clients at database level and not only at application level, personal accesses and the principle of least privilege, secrets kept outside the source code, logging of sensitive operations, daily backups, continuous monitoring of production. In addition, a weekly copy of the data that collection and computation cannot rebuild is kept for ninety (90) days with a provider other than the database host, encrypted before it is sent and locked: no one, ourselves included, can delete or modify it before that date. A deletion made in the database, at your request or at the end of a retention period, therefore reaches a copy already placed only when its lock ends. Details of these measures, and of the improvements in progress, are provided on request.
No system offers absolute security. In the event of a personal data breach likely to result in a risk to the rights and freedoms of individuals, we notify the CNIL within 72 hours and inform the data subjects where the risk is high (Articles 33 and 34 of the GDPR).
9. Your rights
You have the rights of access, rectification, erasure (Article 17), restriction (Article 18), portability where the processing is based on consent or on the contract (Article 20), the right to give post-mortem instructions, and the right to object.
Objection may be exercised on grounds relating to your particular situation against processing based on our legitimate interest, including the observation of marketplaces described in section 4. In relation to prospecting, it may be exercised without giving reasons and at any time.
Write to privacy@whoheld.com. We reply within one month, extendable by two months for a complex request; we tell you so in that case. We may ask for the information reasonably necessary to establish your identity or your link with the data (Article 12(6)). If you are a user under a contract concluded by your employer, a request relating to your account falls to your employer: we direct you to it without delay.
You may lodge a complaint with the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr) or with the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement (Article 77). In the United Kingdom: the Information Commissioner's Office.
10. Changes
This policy may change. The applicable version is the one published on the date of consultation. Any substantial change is announced in advance.
End of the courtesy translation of the Privacy Policy, version 5.12. The French version prevails.