1. Who is responsible
OPEREXAAI is a French société par actions simplifiée (SAS), with its registered office at 50 avenue des Champs-Élysées, 75008 Paris, France. SIREN: 108 008 137. SIRET: 108 008 137 00011. VAT number: FR94108008137. Contact: support@operexa-ai.com.
OPEREXAAI is responsible for personal data used to operate its website, manage customer accounts, billing and support. When customers connect business advertising accounts, they remain responsible for the data they are authorized to share; we use connected data to provide the requested SaaS functions.
2. Information we process
We obtain information you submit, information from advertising accounts you choose to connect, and technical information generated when you use the service.
- Account information: name, email address, authentication information, account identifiers, language and preferences.
- Billing information: plan, subscription status, invoice details, payment references and transaction history. Payment providers handle payment credentials; our application does not collect full card numbers or card security codes.
- Connected Meta data: authorized account and campaign identifiers, names, permissions and access tokens, performance metrics such as spend, impressions, clicks, conversions and revenue, and analysis history.
- Service and support information: messages you send us, usage of features, connection and security logs, IP address, browser/device information and page-visit statistics.
3. Why we use it
Account creation, authentication, billing, support and requested campaign analysis are necessary to perform our contract with you or take steps at your request before entering into it. Required account and payment details are needed to provide the corresponding paid service. Connecting Meta is optional, but campaign analysis needs access to the accounts you select.
We rely on legitimate interests to secure the platform, investigate errors and misuse, and understand service usage, taking account of your rights. Accounting records and responses to legally binding requests are processed to meet legal obligations. Where consent is required for an optional use, we will request it separately; you can withdraw it without affecting earlier lawful processing.
4. Providers and AI processing
Information is made available to authorized people and service providers as needed for their role. The current service uses the following providers:
- Supabase for account authentication and database storage.
- Vercel for website hosting, infrastructure and Web Analytics.
- Stripe for SaaS payments, subscription billing and the customer billing portal.
- Meta for the advertising connection and advertising account data you authorize.
- OpenAI for AI diagnoses. Requests can include account identifiers and labels, currency, campaign names and identifiers, performance summaries and selected campaign metrics. Avoid including unnecessary personal or sensitive information in campaign names or support messages.
5. Sharing and international processing
Providers may process data in countries other than your own, including outside the European Economic Area. Where GDPR transfer rules apply, transfers must be covered by an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses. Contact us to obtain details of the arrangements applicable to your data.
We may also disclose information where required by law or necessary to establish, exercise or defend legal claims. A payment provider or merchant of record identified at checkout may separately process transaction information under its own privacy notice.
6. Retention and deletion
Account and connected advertising information are retained for the period needed to provide the service and the analysis history you use. You can request account closure and deletion by email. We assess the request and delete data that is no longer needed, subject to legal obligations, active disputes and necessary security records.
Invoices and accounting records are retained for the applicable statutory period, generally ten years under French accounting rules. Support, diagnostic and security records are retained according to their purpose, the issue being handled and any applicable limitation period. Backups may retain residual copies until their normal replacement cycle.
Revoking the Meta authorization stops further access using that authorization; it does not automatically erase information previously stored in Operexa AI. Contact us to request deletion of that information as well.
8. Your choices and rights
Where applicable, you may request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent. Email support@operexa-ai.com using your account email and describe your request. We may ask for proportionate information to verify your identity. Do not send passwords or full payment-card details.
We respond within the applicable legal deadline, normally one month for a GDPR request, and explain any lawful extension or restriction. You may lodge a complaint with the CNIL in France or the competent supervisory authority where you live.
The platform is intended for professional users and is not directed at children. If you believe a child has provided personal information, contact us. Material changes to this policy will be communicated as appropriate; the date above identifies the current version.