Privacy policy

Controller and contact

The legal identity, address and public contact of Carte Beige’s controller remain to be completed. A DPO contact will be listed only if one is actually appointed. In the beta, authenticated requests can be submitted under My account, Data and privacy. Contact details for requests without signing in remain to be completed.

Data and sources

Data comes primarily from your inputs: email address and sign-in identifier, display name, optional profile, income, expenses, assets, debts, projects, assumptions, dossiers, narratives and edit history. Google may supply profile information when that sign-in method is chosen.

Technical events necessary for security and synchronisation are separate from optional analytics. If you accept analytics, records may include pages, commands and steps used, their date, the account identifier and an approximate country provided by the infrastructure. They are not represented as anonymous.

The beta does not collect card details or real payments. Test offers, transactions and receipts remain simulations. Supporting documents or extracts supplied to a selected feature may contain personal data: limit them to what is useful.

Purposes and legal bases

Accounts, backups, simulations and requested assistance provide the service on the basis of contractual performance or requested pre-contractual steps. Security and defence of rights may rely on a legitimate interest that must be documented and balanced. Applicable legal obligations provide the basis for required retention.

Optional usage measurement relies on your explicit choice and can be stopped at any time. Accepting the terms of use does not enable it. No newsletter is currently offered in this flow; introducing one would require separate information and choices. The selected legal bases must be validated in the publisher’s processing records.

Recipients and artificial intelligence

Dossier data is accessible to the account holder and authorised parties according to their role. Authentication uses Supabase and optionally Google; hosting and server dossiers use Sites and Cloudflare services. Administrative access is controlled and must be limited to operational, security or request-handling needs.

When you choose Prepare with AI, the narrative, answers and stated preparation context are sent to OpenAI. Item assistance may send the item, period, relevant context and supporting material you submit. Transmission is not triggered solely by viewing a page or accepting cookies.

Provider processing agreements, access arrangements, retention rules and transfer safeguards must be verified. This version does not promise exclusively European locations, end-to-end encryption or an absence of reuse or retention that has not been verified.

Aggregate studies of Carte Beige dossiers

This optional participation allows Carte Beige to study declared profiles and goals, departure horizons, data quality, scenario robustness and registration cohorts. It is separate from click analytics and cookies and is not a condition for using any service function.

Elements used are age bands, declared country and household, goals, the optional expected first pension payment date, dossier and scenario counts, registration and last-access dates, and indicators calculated from the current server copy: open issues, simulated duration, reserves and sensitivity to assumptions. Scenario names, narratives, addresses, phone numbers and attachments are not included in study indicators.

One summary per account is calculated on the server and linked to the account so it can be refreshed and withdrawn. It is therefore not presented as anonymous data. Only authorised administrators see aggregate dashboards; small groups and statistics based on fewer than ten contributions are hidden. This threshold reduces risks without providing a legal guarantee of anonymity. Currencies are kept separate and results remain simulations, not facts about individuals’ actual circumstances.

Your choice applies to the account for six calendar months. You can decline or withdraw in My account, Data and privacy, from any signed-in device. Withdrawal stops future use and deletes the active summary; evidence of choices is retained separately. At expiry the summary is excluded from dashboards. Archive and backup purge periods remain to be configured as part of the beta legal framework.

This study describes Carte Beige’s voluntary participants; it is not representative of the general population. The controller, contact details and data-related requests are described in the privacy policy, whose administrative information remains to be completed.

Server retention and temporary edits

Dossiers, scenarios and their versions are retained on the server. Old browser financial copies are no longer read or used for saving. Current edits remain temporarily in page memory until server confirmation and do not survive closing the page. Server retention limits and purge procedures remain to be defined.

Tracker preferences expire after six months; expiry or a policy-version change stops analytics until a new choice is made. Preference expiry alone does not purge server evidence or previous events. Closure or erasure is handled by distinguishing active data, justified archives and local copies.

Your rights and requests

Subject to applicable rules, you can exercise rights of access, correction, erasure, restriction, objection and portability, and withdraw consent for future processing. Some rights depend on the legal basis and processing conditions. Erasure does not override legally justified retention.

My account lets you export available server data and current edits in this page, submit a request and view its progress. This immediate export does not replace a complete access request, particularly for infrastructure backups or data held by a provider.

A request is normally handled within one month of receipt; a reasoned extension may apply to complex requests, with notice within the initial period. Identity checks must remain proportionate. You may contact the competent authority; the CNIL is the reference for the prepared French framework and the FDPIC for the Swiss framework, where applicable.

Security and updates

Accounts and permissions are verified on the server; private exports and requests require sign-in. The publisher must document access management, backups, incidents and notification obligations. Actually configured safeguards and processing locations remain to be verified before any definitive compliance statement.

This policy is versioned. Significant changes are announced and renewed consent is requested where required. Choosing French or English does not by itself determine applicable law.