Article 1: Data controller
The controller of the data collected on the riwil.co website and through the Riwil platform is LUCKY BOYS SAS (see the Legal Notice). Contact: marion@riwil.co.
Article 2: Data collected
Client data (subscribed professionals): identification and contact details (name, email, phone, company and establishment name), login data, billing data transmitted to our payment provider Stripe, and data related to activated services (for example the Google account connected for review management).
Participant data (Clients' end customers): email, phone (optional) and game participation data. This data is processed on behalf of the organizing Client, in accordance with Article 8 of the CGUV: the Client acts as data controller and Riwil as data processor.
Website visitor data: browsing data (see the "Cookies and trackers" article).
Article 3: Purposes and legal bases
The data is processed for:
— creating and managing Client accounts and providing the Service (performance of the contract);
— billing and accounting (legal obligation);
— assistance and support (performance of the contract);
— improving and securing the Service (legitimate interest);
— audience measurement and advertising (consent / legitimate interest, see the "Cookies and trackers" article);
— commercial marketing (consent);
— sending emails and SMS messages to Participants on behalf of Clients (performance of the game and, for marketing, the Participant's consent).
Article 4: Processors and recipients
The data is accessible to Riwil's authorized teams and to the following providers, to the extent necessary for their services:
| Provider | Role | Location |
|---|---|---|
| Heroku (Salesforce, Inc.) | Platform hosting | United States |
| Stripe | Payment and billing | Ireland / United States |
| Cloudinary | Media storage (logos, posters) | United States / Israel |
| Brevo | Email sending | France |
| Capitole Mobile | SMS sending | France |
| Mistral AI | Artificial-intelligence processing | France |
| Google APIs (reviews, business profiles) | Ireland / United States | |
| Sentry | Technical error monitoring | United States |
| Scout APM | Performance monitoring | United States |
| Hotjar | Audience measurement | Malta (EU) |
| Meta Platforms | Advertising measurement (Meta Pixel) | Ireland / United States |
| TikTok | Advertising measurement (TikTok Pixel) | Ireland / United Kingdom |
Article 5: Transfers outside the European Union
Some of the providers listed above are established, or process data, outside the European Union, notably in the United States. These transfers are governed by appropriate safeguards: an adequacy decision of the European Commission (notably the EU–US Data Privacy Framework for certified providers, or the decisions concerning the United Kingdom and Israel) or the European Commission's standard contractual clauses.
Article 6: Retention periods
| Data category | Period |
|---|---|
| Client account and associated data | Duration of the contractual relationship, then archiving in accordance with legal obligations |
| Invoices and accounting records | 10 years (legal obligation) |
| Participant data | 2 years maximum from collection (Article 8.7 of the CGUV) |
| Technical logs | 12 months maximum |
| Cookies and trackers | 13 months maximum |
Article 7: Cookies and trackers
The Site uses cookies and trackers for audience measurement and advertising purposes, notably Hotjar, Meta Pixel (Facebook) and TikTok Pixel. You can configure your browser to refuse these cookies, enable its tracking protection, or use the opt-out mechanisms offered by these platforms (for example youronlinechoices.eu). Refusing these trackers does not prevent you from using the Site.
Article 8: Artificial intelligence
Some features (replies to Google reviews, assistance) rely on artificial-intelligence models provided by Mistral AI (France), accessed via API. The data transmitted for this purpose is limited to what is necessary for the feature; Riwil does not use your data to train its own models. The generated content consists of suggestions subject to review by the Client before publication.
Article 9: Security
Riwil implements appropriate technical and organizational measures to protect data: encryption of communications (TLS), passwords stored in hashed form, access control and regular backups.
Article 10: Your rights
In accordance with the GDPR, every person has the right to access, rectify, erase, restrict and object to the processing of their data, the right to data portability, and the right to withdraw consent at any time. These rights may be exercised by contacting marion@riwil.co. Game Participants may also contact the organizing establishment directly, as the controller of their data. Anyone may lodge a complaint with the CNIL (www.cnil.fr).
Article 11: Changes
This policy may be updated to reflect changes to the Service or to regulations. The date of the last update appears at the top of this page; any substantial change is brought to Clients' attention.
Article 12: Contact
For any question regarding this policy or your data: marion@riwil.co.