Who we are
ReBiz is operated by Yannick AST, 7 rue d’Altheim, 57720 Ormersviller, France. For anything in this document, including access and erasure requests, write to support@rebiz.app.
A data controller can be a person rather than a company, and at this stage that is what it is. Nothing in this document depends on that — the rights below are the same either way.
Add the SIREN to this line as soon as one is issued. Selling subscriptions is commercial activity and has to be registered; the checkout is now live, so this is no longer a future problem.What we collect
Three separate things, with different sources and different reasons.
Business data. Publicly listed information about businesses: name, address, phone number, website, Google rating and review count, obtained through the Google Places API. Where a business publishes a contact email address on its own website, we record that address and which page it was found on.
Website technical metadata. For each business website we record measurable facts about the page: whether it loads, how quickly, whether it has a valid certificate, whether it is usable on a phone, whether analytics or advertising tags are present, and whether a contact form exists. We read the public page as any visitor would, we respect robots.txt, and we do not attempt to access anything that is not publicly served.
Account data. Your email address and authentication details, held by our identity provider (Clerk); your plan, scan quota and scan history; your saved pipeline notes; and, if you subscribe, a customer identifier from our payment provider (Stripe). We never see or store card numbers.
What we do not collect
No data about consumers or private individuals. We scan businesses, not people, and we do not build profiles of anyone’s customers. We do not use advertising cookies or third-party trackers on this site.
Some of what we collect is nonetheless personal data — a sole trader’s business is often their own name, and prenom.nom@entreprise.fr identifies a person. We treat that data as personal and everything below applies to it.
Why we are allowed to (legal basis)
For business contact data we rely on legitimate interest (GDPR Article 6(1)(f)): providing a business-to-business prospecting tool. The data is published by the businesses themselves for the purpose of being contacted about their trade, and the processing is limited to that context.
For your own account data the basis is performance of a contract — we cannot give you an account without it. For subscription records the basis is that contract plus our legal obligation to keep invoices.
The legitimate-interest assessment should be written up and kept on file — a documented LIA is what makes this basis defensible if it is ever questioned. A lawyer should also confirm the balancing test for sole traders specifically, where the line between business and personal data is thinnest.When you export a list, you become the controller
This is the most important paragraph on the page. While data sits in ReBiz, we are the data controller. The moment you export a list or copy the contacts out, you become an independent controller of that copy — it is on your machine, under your control, and we have no further say in what happens to it.
From that point you are responsible for:
- having your own lawful basis for contacting those businesses
- honouring objections and erasure requests made to you directly
- complying with the marketing rules of the country you are contacting
- keeping the file secure and not passing it on
The terms cover the marketing rules in more detail, because they differ sharply between France and Germany.
How long we keep it
Scan results are kept while your account is open, so you can reopen a list without paying to run it again. Delete your account and we delete your scans, your saved pipeline notes and your account record within 30 days, except where we are legally required to keep invoices for longer.
Deletion is not a manual promise: when an account is deleted, Clerk notifies us and we remove that account’s scans, billing records and saved state immediately — well inside the 30 days above. Invoices are the exception, and stay with our payment processor for as long as French commercial record-keeping requires.
There is still no self-serve deletion button in the product; deleting an account is a request to us today. Either build the button, or say that plainly here.Confirm the retention period against the French commercial-record requirement for invoices, which is longer than the rest of this and applies regardless.Your rights, and a business's rights
You can ask for a copy of your data, correction of anything wrong, or deletion. Write to support@rebiz.app and we will respond within one month.
A business that appears in our data can ask us to remove it, and we will — without requiring a reason. Ask at the same address.
Removals are currently done by hand, and a business removed today can be rediscovered by a later scan of the same city. Until a suppression list exists, do not promise here that removal is permanent — this paragraph deliberately does not.You may also complain to your supervisory authority. In France that is the CNIL.
Who else processes it
- Clerk — authentication and account records
- Neon — the database, hosted in the EU
- Vercel — hosting the site
- Google Places API — the source of business listings
- Stripe — payments and subscription records
Cookies
A session cookie so you stay signed in, and the cookies Stripe sets during checkout to process your payment and prevent fraud. No analytics or advertising cookies, which is why there is no cookie banner asking for your consent — there is nothing to consent to.
If product analytics are switched on later, this section and the cookie position both have to change.