Privacy Policy

The sherlock.blue service (the "Service") is published by Alexandre GORSKI EI, a French sole proprietor (entrepreneur individuel, micro-entreprise), registered under SIREN number 911 947 786, with registered office at 2 Boulevard de Strasbourg, 31000 Toulouse, France ("sherlock.blue", "we"), controller of the processing described in this policy.

Contact: contact@sherlock.blue

This policy applies to holders of a sherlock.blue account (the "Clients"), to the people they invite on a multi-seat plan (the "Members"), to visitors of the sherlock.blue website and to people who contact us.

Special case: the people recorded as prospects by our Clients. For that data, the Client is the controller and sherlock.blue acts as processor, under the "Data Processing Agreement" annex to the Terms of Use. Section 8 below summarises what concerns them.

Account. Name, email address, password (stored exclusively in hashed form, never in clear), language, dates of acceptance of the terms. When signing in with Google, we receive from Google your name, your email address and the address of your profile picture; the technical tokens of that sign-in are kept with the account. Purpose: creation and management of the account, provision of the Service. Legal basis: performance of the contract.

Members (multi-seat plans). Team name, role and joining date of each Member, email address of invited people. The Client and its Members see each other's name, email address and role. Purpose: teamwork, seat management. Legal basis: performance of the contract.

Agent connection. API key (stored only in hashed form), authorisations granted to MCP clients, name of the connected client, and log of tool calls (tool called, outcome, duration, size of the exchanges). sherlock.blue does not receive the conversations between the Client and its agent: only the tool calls the agent sends to it. Purpose: provision of the Service, security, quota enforcement. Legal basis: performance of the contract.

Prospecting data. Projects, searches, notes, prospects, proofs and exclusions recorded by the Client and its agents. It is processed on behalf of the Client (section 8). Legal basis: performance of the contract.

Technical and security data. IP addresses in hashed form (never kept in clear), browser used, technical logs. Purposes: security of the Service, abuse prevention, quota enforcement. Legal basis: legitimate interest.

Usage measurement. Daily counters per account and per Member (prospects created, tool calls), with no tracker or profiling, deduplicated by means of a hashed fingerprint of the IP address purged within 24 hours. Purpose: dashboard, monitoring of the Service. Legal basis: legitimate interest.

Audience measurement. Daily count of visitors of the public pages of the website (home, pricing), with no cookie or tracker, deduplicated by means of a hashed fingerprint of the IP address and browser, purged within 48 hours. Purpose: knowing the website's traffic. Legal basis: legitimate interest.

Browsing analytics. We use PostHog (PostHog Inc., hosted in Frankfurt) to understand how the website and the Service are used: pages viewed, clicks, session recordings. Linked to your account once signed in. Legal basis: legitimate interest. Opt out by writing to contact@sherlock.blue.

Transactional emails. Verification code, password reset, email change confirmation, team invitation, cancellation confirmation. Legal basis: performance of the contract.

Marketing communications. Only if you have consented (dedicated checkbox in the account settings). Consent can be withdrawn at any time, in the same place. Legal basis: consent.

Payment. Payments are processed by Stripe, as payment service provider, acting as a separate controller, in accordance with its privacy policy. At payment, we transmit to Stripe the account identifier and the Client's name and email address. Stripe collects the billing address, the business name, the VAT number and the bank details directly. sherlock.blue neither collects nor stores any bank details.

Artificial intelligence. sherlock.blue uses no artificial intelligence model and transmits no data to an AI provider. The agents used are the Client's own, under its responsibility.

sherlock.blue uses cookies strictly necessary for the operation of the Service: authentication session (30 days), temporary Google sign-in cookie (a few minutes) and sidebar display preference (7 days). The browser also stores interface preferences locally: theme, language, current project, displayed columns.

No advertising cookie, no resale of browsing data. One analytics cookie (PostHog, 1 year). The Service displays no cookie banner. At payment, Stripe's payment page may set its own cookies, described in Stripe's privacy policy.

Data is neither sold, rented nor shared for advertising purposes. It is processed by the following providers, each for its own part:

• Cloudflare, Inc. — hosting and infrastructure (data storage in Western Europe, delivery of the Service);
• Resend — sending of transactional emails;
• PostHog Inc. — browsing analytics and session recordings, hosted in Frankfurt (EU);
• Stripe — payments and billing, as a separate controller;
• Google — sign-in with a Google account, as a separate controller, if you choose that sign-in method.

Data may also be disclosed to authorities where the law requires it.

Data is stored in Western Europe. Our providers may nevertheless process data outside the European Union, in particular in the United States and on Cloudflare's global network. Such transfers are governed by appropriate safeguards within the meaning of Chapter V of the GDPR, in particular the European Commission's standard contractual clauses and, where applicable, the adequacy frameworks in force.

• Account, Members and prospecting data: as long as the account exists. Deletion can be requested at any time (section 9) and is carried out within one month at most;
• Unverified accounts: deleted 7 days after creation;
• Sign-in sessions: 30 days;
• Technical logs, quota counters and security data: purged automatically once they are no longer needed for security and quota enforcement;
• After deletion, only aggregated anonymous statistics and a record of the deletion without identifying data remain;
• Invoices: kept for ten years, in accordance with accounting obligations.

If you appear in a Client's prospects (professional contact details, job title, company, description, source), that data was recorded by that Client or its agents, from sources it chose, and is processed on its behalf. sherlock.blue collects nothing itself, never contacts you and sends no message.

To exercise your rights, in particular to object to any prospecting, contact the Client concerned; you may also write to contact@sherlock.blue, which will forward your request. The Service lets the Client flag you as "do not contact", which blocks any re-registration on its account.

Under the GDPR, you have the rights of access, rectification, erasure, portability, restriction and objection, as well as the right to withdraw your consent at any time for the processing that depends on it.

These rights are exercised by writing to contact@sherlock.blue. We reply within one month. You may also lodge a complaint with the CNIL or with the supervisory authority of your country of residence.

sherlock.blue implements appropriate technical and organisational measures: encryption of exchanges in transit (TLS), hashing of passwords, IP addresses and API keys, partitioning of data per account, role-based access control.

This policy may be updated, in particular when the Service or the regulations evolve. The date of the last update appears at the top of the document; any substantial change is brought to the Clients' attention.