1. Data controller
E-KIGAI, SAS with a share capital of 100 €, RCS Bayonne B 999 138 050, with its registered office at 1 allée des Écuries, 64600 Anglet, France, hereinafter "Phantera", operates the platform available at phantera-tn.com. For any question about the processing of your data: privacy@phantera-tn.com.
2. Data collected
Phantera collects the following categories:
- Account data: last name, first name, email address, hashed password (managed by Clerk).
- Billing data: Stripe information (never stored in clear text on Phantera's side).
- Usage data: technical logs; in your browser, audience measurement (PostHog) only if you have accepted it; on the server, a few key events of your account (sign-up, campaign creation, subscription), linked to your account identifier, to monitor that the service works properly (legitimate interest; you can object by writing to the address above).
- Prospecting data: leads imported, entered or enriched through our B2B data providers, for which you are the data controller.
- Messaging data: if you connect an email inbox or a LinkedIn account, your prospects' replies to the messages sent by your campaigns (sender, subject, text), in order to stop follow-ups and show them to you.
3. Purposes of processing
- Providing and improving the service (legal basis: performance of the contract).
- Billing and subscription management (legal obligation).
- Security and fraud prevention (legitimate interest).
- Product communications (explicit consent, unsubscribe at any time).
4. Processors
Phantera relies on the following providers. When a provider processes data outside the European Union, the transfer is governed by the European Commission's standard contractual clauses or by the Data Privacy Framework.
- Vercel: application hosting (runs in Europe, Paris region).
- Railway: database hosting.
- Clerk: authentication (United States).
- Stripe: payments (United States, PCI-DSS).
- Anthropic: Claude AI models for writing, lead scoring and reply classification (United States). Data sent is not used to train the models.
- Ollama: fallback AI models, used only if the Anthropic service is not configured.
- Apollo.io, Hunter.io and enrichment providers (Dropcontact, LeadMagic, Findymail, Prospeo): finding and verifying business contact details.
- Unipile: LinkedIn connection and messaging, if you connect an account.
- Google and Microsoft: sending and reading replies, if you connect a Gmail or Outlook inbox.
- Resend and Cloudflare: sending emails and receiving replies addressed to our technical addresses.
- Inngest: running scheduled tasks (sequences, reply detection).
- Sentry: technical error tracking.
- PostHog: audience measurement (hosted in the European Union): in the browser only after your consent, and key account events on the server.
5. Connected inboxes (Gmail, Outlook, SMTP)
If you choose to connect your Gmail account, Phantera requests two permissions (for Outlook, the Microsoft equivalents Mail.Send and Mail.Read; for an SMTP inbox, read-only IMAP access with the credentials you provide):
- gmail.send: send, from your address and at your request, the prospecting emails you have written or approved.
- gmail.readonly: detect your prospects' replies to these emails, to stop follow-ups automatically and show the reply in your Phantera inbox.
- Phantera only keeps replies to emails sent by your campaigns. Other messages received are read automatically, only to check whether they are such a reply: they are not kept, sorted or passed on to any third party.
- Phantera does not modify, move or delete any message in your inbox.
- OAuth access tokens are encrypted at rest (AES-256-GCM) and are never shared with third parties.
- No Google data is used for advertising, sold, or used to train AI models. The text of a reply may be sent to our AI provider (Anthropic) only to classify it (interested, not interested, meeting request…), without training.
- You can revoke access at any time from your Phantera settings or from myaccount.google.com/permissions.
Phantera's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6. Retention period
Your data is kept for the whole duration of your subscription, then for 12 months after cancellation (accounting obligations and defense of legal claims). Logs are kept for 90 days at most.
7. Your rights
Under the GDPR, you have the right of access, rectification, erasure, portability, restriction and objection. To exercise these rights, contact privacy@phantera-tn.com. You can also lodge a complaint with the CNIL (the French data protection authority).
9. Changes
This policy may change. Any substantial change will be notified by email at least 30 days before it takes effect.