Privacy policy

This is an English translation provided for convenience. In case of any discrepancy, the French version prevails.

This policy explains what personal data BRIXEL (“we”) collects and processes when you visit the graine qui pousse website (grainequipousse.com, and its French version grainequipousse.fr) and when you use the app (app.grainequipousse.fr), which creates content and publishes it on your social networks. It is written in accordance with the General Data Protection Regulation (GDPR), the French Data Protection Act (“loi Informatique et Libertés”), and the requirements of the platforms whose APIs we use (Meta, TikTok, LinkedIn, Google/YouTube).

1. Data controller

The data controller is BRIXEL, a SASU (French simplified joint-stock company with a single shareholder) with share capital of €1,000, registered with the Antibes Trade and Companies Register (R.C.S.) under number 940 320 641, with its registered office at 67 boulevard du Val Claret, 06600 Antibes, France.

• Contact for any question or request about your data: justin@brixel.ai
• Publication director: Justin Grivon

2. Who this policy covers

This policy covers three distinct situations:

• Website visitors who sign up for the waitlist;
• App users who create an account, have their business analyzed and connect their social networks;
• Business prospects to whom we send, by way of demonstration, a preview of their company’s brand dossier.

3. Data we process

3.1 Account and authentication

• Name and email address, which you provide when you sign up; your password is never stored in plain text (cryptographic hash only).
• Email verification and last sign-in dates, account status.

3.2 Technical connection data

• For each session: IP address, user agent (browser and operating system), creation and last-activity timestamps. This data is used to maintain your session, to limit abusive access attempts and to secure the service.
• A strictly necessary session cookie (see the Cookies section).

3.3 Brand dossier

From the address you give us (domain name, Google Business Profile or company name), we build a dossier from publicly available information: the content of your website, your Google Business Profile (including its contact details and public reviews), public social media profiles, web search results, industry news and public information about your competitors. This dossier may contain business contact details published by the company itself (phone number, contact email), as well as brand elements extracted from the website (logo, colors, fonts).

3.4 Content and media

• The files you upload (photos, videos, logos, editorial examples) and their associated metadata.
• The content generated by the service (text, images, videos, carousels), its successive versions, your editorial calendar and your scheduled posts.
• If you explicitly ask for it, your existing posts imported from an account you have connected (Instagram, Facebook, Threads): the media and its caption are then copied into your library to serve as editorial references, so that the generated content matches your brand’s style. This import never happens automatically.

3.5 Connected social accounts

When you connect a social network, we store, for each connected account:

• the OAuth access and refresh tokens, always encrypted at rest: they are never stored in plain text, never exposed to the browser and never passed on to any third party;
• the account’s technical identifier, its display name and its profile picture;
• the list of destinations you can publish to (your personal profile and the Pages or business accounts you manage), so that you can choose where to publish;
• the permissions granted and the tokens’ expiry date.

3.6 Post statistics

For posts published through the service, we retrieve the statistics the platform makes available: impressions, reach, likes, comments, shares, saves, video views, clicks and follower count. They feed your dashboard. We collect no data about your followers or contacts on an individual basis.

3.7 Push notifications

If you turn them on: the technical address (“endpoint”) provided by your browser, the associated encryption keys and the device’s user agent.

3.8 Waitlist and prospecting

• Waitlist: email address, the address of your company’s website and the source of the sign-up.
• Prospecting: the business email address publicly published by the company, to which we send a preview of its dossier. Every message includes a way to object to any further contact.

3.9 Technical logs

Execution logs (errors, durations, costs) and, for diagnostic purposes, the trace of the exchanges with the AI models that produced a piece of content. These traces are accessible only to technical administrators and are used solely for debugging and cost control.

3.10 Connected AI assistants (MCP connector)

You can connect an MCP-compatible AI assistant (for example Anthropic’s Claude or OpenAI’s ChatGPT) to your account so that it creates and publishes with you (see the “Connect your AI assistant” page). We then keep:

• the authorization you give: the application, the brands you give it access to, the permissions granted (read, create, publish), the date, IP address and browser at the time of consent, and the date it was last used;
• the access tokens issued to the application, in hashed form (never in plain text);
• the files you send through an upload link, stored in the brand’s library like your other media;
• a technical log of the assistant’s actions (tool called, duration, result), without the content of your conversations: we never receive the history of your exchanges with the assistant, only the requests it sends to the connector.

4. Data from connected social networks

Connecting a network is optional and is done one network at a time. We request only the permissions needed for the features described below, and we do not use this data for any other purpose: in particular, never for advertising, profiling, resale, or to train AI models.

Two important points: connecting a social network is never used to sign you in to graine qui pousse (accounts are created with an email address and password only); and nothing is ever published without your approval or without the scheduling you have approved.

Instagram (Meta)

• Permissions: instagram_business_basic, instagram_business_content_publish, instagram_business_manage_insights.
• We read: the business account’s identifier, username and picture, and the statistics of posts published through the service.
• We write: the images, carousels, reels and stories you approve.
• Only at your explicit request: your existing posts (media and caption), to import them as editorial references (see 3.4).

Facebook (Meta)

• Permissions: public_profile, pages_show_list, pages_manage_posts, pages_read_engagement, read_insights.
• We read: your public name and profile picture, the list of Pages you manage, and the engagement and statistics of the selected Page.
• We write: the posts you approve, on the Page you designate.
• Only at your explicit request: your Page’s existing posts (media and caption), to import them as editorial references (see 3.4).

Threads (Meta)

• Permissions: threads_basic, threads_content_publish, threads_manage_insights.
• We read: the account’s identifier, username and picture, and the statistics of posts published through the service.
• We write: the text, image, carousel and video posts you approve.
• Only at your explicit request: your existing posts (media and caption), to import them as editorial references (see 3.4).

TikTok

• Permissions: user.info.basic, user.info.profile, user.info.stats, video.publish, video.list.
• We read: the account’s open ID, display name, avatar, follower count, and the statistics of videos published through the service.
• We write: the videos and photo posts you approve.
• For photo posts, TikTok downloads the media from our servers through a signed link that expires after one hour.

LinkedIn

• Permissions: openid, profile, email, w_member_social and, if you publish on behalf of a Page, r_organization_admin and w_organization_social.
• We read: your identifier, your name, your picture, your email address and the list of Pages you manage.
• We write: the posts you approve.

YouTube

• Permissions: youtube.upload and youtube.readonly.
• We read: your channel’s information and the statistics of videos published through the service.
• We write: the videos you approve for publication on YouTube.

5. Purposes and legal bases

• Providing the service (creating your account, building your brand dossier, generating, scheduling and publishing your content, displaying your statistics). Legal basis: performance of the contract between us.
• Publishing on your behalf on your networks. Legal basis: performance of the contract, carried out only after your explicit authorization when you connect through OAuth, and upon your approval of each post or of the scheduling you approve.
• Securing the service, preventing fraud and abuse, diagnosing incidents. Legal basis: legitimate interest.
• Letting you know about the launch (waitlist). Legal basis: your consent, which you can withdraw at any time.
• Business prospecting to companies, using public business addresses and for an offer related to their activity. Legal basis: legitimate interest, with an immediate right to object.
• Push notifications. Legal basis: your consent, which you can withdraw from your browser or the app.
• Complying with our legal obligations (accounting, tax, responding to authorities). Legal basis: legal obligation.

6. Generative artificial intelligence

The service relies on third-party AI models to write text and to generate images and videos. The following is sent to these models:

• the information in your brand dossier (business activity, value proposition, products, target personas, brand tone of voice, location);
• your editorial instructions and the recent history of your posts;
• the images in your library (logos, product photos, editorial examples): they are sent to the model that writes and composes the post, and may be sent to our visual generation provider when they serve as a reference for a generated image or video.

The following is never sent to the models: your social network access tokens, your password, or your followers’ data.

Requests are routed through OpenRouter to the model providers we select. The up-to-date list can be provided to you on request.

Assistants you connect yourself. When you authorize an AI assistant (Claude, ChatGPT…) through the MCP connector, the data of the brands you give it access to (brand context, library, posts and their publishing statistics, connected social accounts) is sent to it when it uses the connector, at your request. The publisher of that assistant (Anthropic, OpenAI…) processes this data as a separate data controller, under its own privacy policy. You can remove this access at any time (see section 10).

Your content is not used to train AI models, either by us or by our providers: our accounts are configured to exclude the reuse of requests for training purposes. Content produced by AI is submitted to you before any publication; you remain responsible for it (see the terms of use).

7. Recipients and processors

Your data is accessible only to authorized BRIXEL personnel and to our technical processors, who act on our instructions and provide appropriate safeguards. We do not sell or rent your data.

• OVH SAS (France): hosting of the website, the app, the server and the database.
• Amazon Web Services (Paris region, eu-west-3): storage of your media in a private space.
• Resend (United States): sending of transactional emails (address verification, password reset, invitations).
• OpenRouter (United States): gateway to language models, which routes requests to the LLMs.
• Replicate (United States): generation of images and videos.
• Tavily (United States): web search used when building the brand dossier.
• Google (Places API): retrieval of the public Google Business Profile.
• Meta, TikTok, LinkedIn and Google/YouTube: recipients of the content you choose to publish, each under its own privacy policy.
• The AI assistants you connect (for example Anthropic for Claude, OpenAI for ChatGPT): recipients, with your authorization, of the data of the brands you give them access to, each under its own privacy policy.

We may also disclose data where required by law (judicial request, competent authority).

8. Transfers outside the European Union

Your account, your content and your media are stored in the European Union (OVH in France, AWS in Paris). Some of our processors (Resend, OpenRouter, Replicate, Tavily, and the model providers they use) are based in the United States: the data strictly necessary for their services is transferred there. These transfers are governed by the European Commission’s standard contractual clauses and, where applicable, by the provider’s participation in the EU-U.S. Data Privacy Framework, together with additional technical measures. You can ask us for a copy of these safeguards.

The AI assistants you connect yourself (Anthropic, OpenAI…) are most often based in the United States: your data is sent to them at your initiative, as part of your own relationship with the assistant’s publisher.

9. Retention periods

• Account, brand dossiers, content and media: for as long as your account exists, then deleted within 30 days of its deletion.
• Social network access tokens: until the network is disconnected, the account is deleted, or the token expires; deleted immediately in the first case.
• Sessions: 14 days maximum, or until you sign out.
• Connected AI assistants: the authorization, until it is removed or the account is deleted; access tokens, 1 hour, and refresh tokens, a rolling 30 days up to a limit of 180 days; file upload links, 15 minutes (their result, 24 hours).
• Notifications in the app: 7 days.
• Technical cache (web pages and searches): 7 days.
• AI diagnostic traces: 12 months maximum.
• Waitlist: up to 3 years after the last contact, or until you ask to be removed.
• Prospecting invitations: 30 days; if you object, only the information needed to stop contacting you is kept.
• Accounting data: the applicable statutory period.

10. Deleting your data

Disconnecting a social network

In the app, under Connected accounts, disconnecting a network results in the immediate and permanent deletion of the corresponding access tokens and of the account information obtained from that platform. Posts already published on the network stay online: they belong to you and can be deleted from the platform concerned.

Deleting a brand

In the app, deleting a brand permanently erases its brand dossier, its content, its scheduled posts, its statistics, all associated media (including posts imported from your networks) and the linked social connections.

Removing an AI assistant’s access

In the app, Settings → Connected apps → Remove access: the assistant’s tokens stop working immediately. Changing your password removes access for all applications. Data already sent to the assistant is governed by its own privacy policy.

Deleting your account and all your data

Email us at justin@brixel.ai from your account’s email address. We will then delete your account, your brands, your content, your media and all your social connections within a maximum of 30 days, and confirm this to you in writing.

Revoking access from the platform

You can withdraw the authorization directly with the network concerned at any time: revocation immediately makes our tokens unusable. For Meta platforms, our servers are notified automatically and delete the connection and the associated account information. To erase all the data linked to a platform, including any posts you imported as references, delete the brand concerned in the app or ask us to delete your account.

• Facebook: Settings → Apps and websites
• Instagram: Settings → Apps and websites
• Threads: Settings → Account → Website permissions
• TikTok: Settings → Security → Manage app permissions
• LinkedIn: Preferences → Permitted services
• YouTube / Google: Google Account → Third-party apps with account access

11. Your rights

Under the GDPR, you have the following rights:

• the right to access your data and to obtain a copy of it;
• the right to have inaccurate data rectified;
• the right to erasure (“right to be forgotten”);
• the right to restriction of processing;
• the right to object, in particular to prospecting, at any time and without giving a reason;
• the right to data portability, in a structured and readable format;
• the right to withdraw your consent at any time, without retroactive effect;
• the right to set instructions regarding what happens to your data after your death.

To exercise these rights, email us at justin@brixel.ai. We respond within one month. If you are not satisfied with our response, you may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

12. Security

• Encryption of all communications in transit (HTTPS/TLS).
• Encryption at rest of OAuth tokens; passwords stored only as a cryptographic hash (Argon2). Tokens are never exposed to the browser and are decrypted in memory only at the moment of publishing.
• Media hosted in a private storage space, accessible only through temporary signed links. When a platform requires downloading a media file itself, the signed link issued for that purpose expires after one hour.
• Data partitioned by account, rate limiting on sensitive endpoints, encrypted database backups.
• Administrator access: a limited number of BRIXEL technical administrators, bound by a duty of confidentiality, can access your workspace, in order to provide you with support or to diagnose an incident. This access is logged.

In the event of a data breach likely to result in a high risk to your rights, we will inform you and notify the CNIL within the legal time limits.

13. Cookies

We use no advertising cookies, no third-party trackers and no audience measurement tools. Only a session cookie, strictly necessary to keep you signed in to the app, is set; in accordance with the regulations, it does not require prior consent, so no banner is displayed. If audience measurement were ever introduced, your consent would be obtained beforehand.

14. Minors

The service is intended exclusively for adult professionals. We do not knowingly collect data about minors. If you believe that a minor has provided us with data, contact us: we will delete it without delay.

15. Platform compliance

Our use of the platforms’ APIs is subject to their own terms, which we comply with:

• Meta (Facebook, Instagram, Threads): we comply with the Meta Platform Terms and its developer policies; see Meta’s privacy policy.
• TikTok: we comply with TikTok’s terms for developers; see TikTok’s privacy policy.
• LinkedIn: see LinkedIn’s privacy policy.
• YouTube: the service uses the YouTube API Services. By connecting your channel, you agree to the YouTube Terms of Service, and your data is also governed by the Google Privacy Policy. Our use of data received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements: this data is used exclusively for the features described here, is not transferred to third parties except in the cases provided for, and is used neither for advertising nor for training AI models.

16. Changes

This policy may be updated to reflect changes to the service or to the regulations. The applicable version is the one published on this page on the date you consult it; in the event of a substantial change, we will inform you by email or in the app before it takes effect.

17. Contact

For any question about your personal data: justin@brixel.ai — BRIXEL, 67 boulevard du Val Claret, 06600 Antibes, France.