Privacy Policy
Version 0.4, September 2026, Processing of personal data by Crosstensor
Before you start: who is this policy for?
Crosstensor acts in two distinct roles within the meaning of the GDPR, and this policy covers only one of them:
- Data controller for the data it collects on its own behalf: site visitors, prospects, and commercial and administrative contacts at client organizations (billing, platform administrator accounts). This is the subject of this policy.
- Data processor for the data that client organizations pass through the platform (Toolbox, Gateway, Guard) as part of their own professional use of AI, namely: queries, documents, and content exchanged with models. This processing is governed by the Data Processing Agreement entered into with each client organization (DPA), not by this policy. If you are an end user of the platform within a client organization, it is your own organization's privacy policy that applies to your use of the service. Crosstensor acts on that organization's behalf.
1. Who we are
Crosstensor SAS, registered with the Lille Trade and Companies Register under SIREN number 109,417,154, with its registered office at 177 Allée Clémentine Deman, Avenue de Bretagne, 59000 Lille, France, is the controller responsible for processing the personal data described in this policy.
Data Protection Officer (DPO): Thibaut Cauliez, reachable at for any question relating to the processing of your personal data or the exercise of your rights.
2. What personal data we collect
| Category of person | Data concerned | Origin |
|---|---|---|
| Visitors to crosstensor.ai | Technical browsing data, including the IP address (see Section 9: Cookies and trackers); data provided voluntarily via a contact form | Directly from you |
| Prospects and commercial contacts | Name, surname, job title, professional email, company, commercial correspondence | Directly from you, or via public professional sources (e.g. professional networks) as part of B2B prospecting |
| Client organization contacts (billing, administration, security) | Name, job title, professional email, professional phone number | Directly from the client organization |
| Platform administrator and user accounts | Login identifier, name, professional email, role, connection logs | Directly from you, via the client organization that administers your account |
3. Why we process this data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Managing the commercial relationship and B2B prospecting | Legitimate interest (B2B outreach, subject to the right to object) |
| Managing and performing the contract with the client organization (billing, support, account administration) | Performance of a contract |
| Platform security (authentication, logging, incident prevention) | Legitimate interest and legal obligation |
| Responding to contact requests | Consent (a voluntary action on your part) |
| Protection of the site's forms against automated submissions (Cloudflare Turnstile) | Legitimate interest (site security and abuse prevention) |
| Compliance with legal and accounting obligations | Legal obligation |
| Site audience measurement (Matomo) and continuous improvement of the site | Consent (collected through the cookie management banner) |
4. Who has access to your data
The data described above is accessible to Crosstensor staff whose duties justify it (sales, support, administration, security), on a least-privilege basis.
It may also be shared with Crosstensor's subprocessors needed to operate its internal tools (hosting, email, commercial management and billing tools, bot protection of the forms by Cloudflare), the list of which is kept up to date in the Register of Subprocessors and LLM Providers, available on request.
This data is never shared with the AI model (LLM) providers listed in that same register: those providers process only the data that client organizations voluntarily pass through the platform as part of their own use, not the data covered by this policy.
5. Transfers of data outside the European Union
The data described in this policy is processed and hosted within the European Union, except for the data processed by Cloudflare to protect the forms (see Section 9), which may be processed outside the European Union. Should another Crosstensor subprocessor come to be established outside the European Union, such a transfer would be governed by an appropriate mechanism within the meaning of Chapter V of the GDPR (notably the European Commission's Standard Contractual Clauses).
6. How long we keep your data
| Data category | Retention period |
|---|---|
| Prospects and commercial contacts with no follow-up | 3 years from the last contact |
| Contacts and accounts linked to an active client | Duration of the contract, then 90 days after its termination or expiry |
| Billing data and accounting records | 10 years (legal accounting and tax retention period) |
| Security logs (authentication, permissions, system administration) | Rolling 12 months |
| Logs relating to a confirmed alert or intrusion attempt | 3 years |
| Logs relating to a confirmed data breach | Until the incident is resolved, plus 5 years |
| Cookie storing your consent choices (tarteaucitron) | 6 months |
| Matomo audience measurement cookies (only after consent) | Matomo default durations: 13 months for the visitor cookie, 30 minutes for the session cookie |
| Audience measurement data recorded in Matomo | 12 months |
Scope note: these periods relate to the data described in this policy (Crosstensor as data controller) and to the platform's own security logs. Retention of the content of requests and documents that client organizations pass through the platform is governed by the DPA (duration of the contract, then 90 days), not by this document.
7. How we protect your data
Crosstensor implements technical and organizational measures appropriate to the risk: encryption of data in transit and at rest, strong authentication for administrative access, logging and traceability of access, hosting within the European Union, and a vulnerability management policy. These measures are detailed, for data processed on behalf of client organizations, in the DPA.
8. Your rights
In accordance with the GDPR, you have the following rights over data concerning you that is processed by Crosstensor as data controller (see the scope note at the start of this document):
- right of access to your data;
- right to rectification of inaccurate or incomplete data;
- right to erasure, within the limits provided by the regulations;
- right to restriction of processing;
- right to object, in particular to commercial prospecting;
- right to portability of the data you have provided to us.
How to exercise these rights differs depending on the nature of the data concerned:
- Account and billing data (Crosstensor as data controller): you can view and export all of this data directly from your account space, in JSON and CSV formats, with no manual intervention needed.
- Platform usage data, namely queries, history, and preferences (Crosstensor as processor on behalf of your organization): this data falls under your organization's responsibility as controller. Access is through your organization's administrator or DPO, who can trigger an export on your behalf from the back office, depending on the configuration your organization has chosen in its own data processing agreement; direct self-service access may also be made available to you.
Every access or export request is logged (requester, date, scope covered). The response time does not exceed one month, in accordance with Article 12 of the GDPR, and this access is free of charge.
To exercise these rights, contact the DPO at . You will receive a response within one month at the latest. If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL) : www.cnil.fr.
9. Cookies and trackers
The crosstensor.ai site uses two categories of cookies. On your first visit, a banner lets you choose which ones you accept: "Allow all" and "Deny all" are presented with the same prominence, and you can customize your choices. You can browse the entire site without accepting any audience measurement cookie.
Strictly necessary cookies (no consent required)
- tarteaucitron: stores your consent choices, 6 months;
- ct_lang: stores the site language you have chosen, 12 months.
Audience measurement (with your consent)
With your agreement, the site uses Matomo, an open-source audience measurement tool, for the purposes of traffic analysis and continuous improvement of the site. This instance is operated directly by Crosstensor and hosted in France: your browsing data is not shared with any third party. Matomo then records, among other things, your IP address, the pages viewed, the referring page and information about your device and browser, and sets cookies (prefix _pk_, notably a 13-month visitor cookie and a 30-minute session cookie, Matomo's default durations). Without your consent, no Matomo cookie is set and no audience measurement is carried out. Legal basis: your consent.
Retention period of audience measurement data: 12 months.
Form protection (Cloudflare Turnstile)
The contact and appointment request forms are protected against automated submissions by Cloudflare Turnstile, a service provided by Cloudflare, Inc. When you display one of these forms, your browser loads a script from the challenges.cloudflare.com domain. Cloudflare then receives your IP address and technical information about your browser, in order to verify that the request comes from a human. This service is not used for advertising purposes. Legal basis: Crosstensor's legitimate interest in securing its site. It does not depend on the consent banner, because it is necessary to the security of the forms you choose to use.
To learn more about the processing carried out by Cloudflare: Cloudflare's privacy policy.
Managing or withdrawing your consent
You can change or withdraw your choice at any time, as easily as you gave it, using the cookie management icon shown at the bottom right of every page, or by opening the management panel: Manage my cookies. Your choice is kept for 6 months, after which the banner is shown to you again.
10. Contact
For any question relating to this policy or the processing of your personal data: .
11. Changes to this policy
This policy may be updated to reflect changes in our practices, tools, or applicable regulations. The date of the last update appears at the top of this document. In the event of a substantial change, client organizations will be informed under the terms provided for in their contract.