This policy explains how OGIRY processes the personal data of people who visit the Site, use Marcel OS or deal with us.
3.1 Who is responsible?
OGIRY, an EURL (French single-member limited liability company) with share capital of 21 euros, RCS Lyon 978 960 672, 254 rue Vendôme, 69003 Lyon. Data protection contact: Olivier Giry — [email protected].
3.2 Two different situations
Our own processing. For account management, the free first working session (the diagnostic of your company) for as long as it is not linked to an account, invoicing, support, security, prospecting and the Site, OGIRY is the controller: this is what this policy covers.
The content of your company’s Workspace. Strategy, goals, tasks, documents, Team profiles, “Ma voix” (“My voice”) profile, exchanges with Marcel: this data belongs to the client company, which is responsible for it; OGIRY processes it on that company’s behalf, as processor. To exercise your rights over this data, please contact the company concerned first; if you write to us, we will forward your request to it.
3.3 What data, for what purpose, on what basis?
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Creating and managing your account, authenticating you | Surname, first name, email, role, language, linked workspaces, login dates | Performance of the contract | Lifetime of the account, then deletion within 90 days of the end of the contract |
| Carrying out the free first working session for your company, before any account is created | Address of the company’s website and the information published on it, including the name and position of one of its managers (Marcel asks you whether that person is you); answers to the questionnaire; first name, surname and role if you provide them; email if you give it to create your account; Review written by Marcel; a hash (fingerprint) of the IP address, to limit abuse | Pre-contractual measures taken at your request; legitimate interest (reading the website, preventing abuse) | 30 days if no account is created, then deletion; once linked to an account, lifetime of the account |
| Sending the Service’s emails (login codes, invitations, tasks, comments, reminders, follow-ups) | Surname, first name, email, company, subject of the email | Performance of the contract | Lifetime of the account |
| Managing subscriptions, invoicing and debt recovery | Identity and contact details of the Customer and of the payer, order and payment history (card data is processed solely by our payment service provider) | Performance of the contract; legal obligation | Duration of the relationship; accounting records: 10 years |
| Responding to your support requests | Identity, contact details, content of the exchanges | Performance of the contract; legitimate interest | 3 years from the closure of the request |
| Ensuring the security of the Service and preventing fraud | Login logs, IP address, technical identifiers | Legitimate interest | 12 months |
| Measuring and improving the use of the Service | Usage data (logins, features used, volume of exchanges with Marcel) | Legitimate interest | 25 months, then anonymisation |
| Business prospecting aimed at professionals | Identity, position, company, professional contact details, history of exchanges | Legitimate interest | 3 years from the last contact |
| Affiliate programme and referrals | Identity and contact details of the affiliate; identity and professional contact details of referred persons; tracking of conversions and commissions | Performance of the contract (affiliates); legitimate interest (referred persons) | Duration of the programme + 5 years; referred persons: 3 years after the last contact |
| Publishing the consultant directory | Photo, introduction, city, website, LinkedIn profile, telephone, email, appointment booking link | Consent (publication at the consultant’s initiative) | Until the listing is withdrawn |
| Measuring the audience of the marcel-os.com website | Pages viewed, tracker identifier, technical data of the device | Consent, unless the tool is exempt | 13 months (trackers); 25 months (statistics) |
| Handling your requests to exercise your rights | Identity, content of the request, any supporting documents | Legal obligation | 5 years |
| Establishing, exercising or defending our legal rights | Data necessary for the dispute | Legitimate interest | Duration of the applicable limitation period |
3.4 Marcel and artificial intelligence
When you interact with Marcel, your message and the relevant context (strategy, company identity, your “Ma voix” profile, the content you are working on) are sent from our servers to our artificial intelligence provider, which generates the response. The provider does not use them to train its models.
Your history of exchanges with Marcel is yours alone: the other members of your company do not have access to it. You can delete a conversation at any time.
If you provide a web address, Marcel may read the corresponding page.
The free first working session works in the same way, including before an account is created: your website address and your answers are sent to our artificial intelligence provider, which reads the website and writes your Review. Once your account has been created, the Review becomes part of your company’s Workspace.
Documents that you upload for analysis are not retained: only their name is recorded.
Voice dictation uses your browser’s speech recognition. Depending on the browser, the audio may be processed by the browser’s publisher (for example Google for Chrome), under its own rules. We receive only the transcribed text. This feature is optional.
Marcel does not take any decision in your place: it suggests, you decide.
3.5 Who receives your data?
Your data is accessible to authorised OGIRY personnel, within the limits of their duties, and, within your company, to Users according to their role. It is passed on to our service providers, who act on our instructions: hosting (in France), artificial intelligence, email delivery, online payment, invoicing, email and calendar, appointment booking, live support chat, audience measurement. We do not sell your data.
3.6 Transfers outside the European Union
Some providers (artificial intelligence, email delivery and, depending on the case, messaging or audience measurement) are established in the United States or access the data from there. These transfers are governed by the EU–US Data Privacy Framework where the provider is certified under it, or, failing that, by the European Commission’s standard contractual clauses. A copy of the safeguards can be obtained from the data protection contact.
3.7 Security
We implement measures appropriate to the risks: hosting in France, encrypted communications, passwordless login by one-time link or code, segregation of each company’s data, and restricted, logged access.
3.8 Referred persons and prospects
If a user has referred you to us, or if we contact you in a professional capacity, we tell you so at the first contact, stating where we obtained your contact details. You may object to prospecting at any time, without giving reasons, by replying to one of our messages or by writing to the data protection contact.
If you give your email address without finishing creating your account, we send you a single reminder, with the link to your Review. If you create an account after a free first working session, the session feeds into our sales follow-up, and we may write to you up to three times in the following ten days to suggest taking things further. Each of these emails contains an unsubscribe link, and they stop as soon as you subscribe or unsubscribe.
3.9 Your rights
You have the right of access, rectification, erasure, restriction of processing, portability and objection (in particular to prospecting, without giving reasons), the right to withdraw your consent at any time, and the right to give instructions on what happens to your data after your death. To exercise these rights: [email protected]. We respond within one month, which may be extended by two months if the request is complex. If there is reasonable doubt about your identity, you may be asked for proof of identity.
You may lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL, the French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.
3.10 Changes to this policy
This policy may change. Any substantial change will be notified to you by email or in the application. Last updated: 2 November 2026.
Marcel OS — Version 1.3 of 2 November 2026 — OGIRY, RCS Lyon 978 960 672