Privacy policy

The data controller

CHECK EASY, 6 rue Albert Difusco, 13007 Marseille, France, processes the data described below. For any question, write to hello@fortiche.io.

When your agent talks to your customers, you are the controller of that processing, and we are your processor: we use those conversations only to provide the service to you. What this commits us to do is set out in black and white in the data processing agreement.

What we process, and why

Your Google data

When you connect your Google account, Fortiche only requests the access needed by the capabilities you give your agent, at the moment you add them. Here is the full list, and nothing else:

• Google Drive, chosen or created files: always requested. Only the files you pick yourself in Google’s file picker, and the files your agent creates (a document, a presentation, a form, a file it uploads). On those files only, it reads a spreadsheet, a document, a presentation or a form’s responses. When asked, it adds content, updates cells in a spreadsheet, or makes a file readable by anyone who has its link. It never deletes a file and does not see the rest of your Drive.
• Google Calendar: reading your calendars, events and availability, creating an appointment, attaching a Google Meet link and inviting the people named, when asked: by you, or by a customer writing to your agent. It never edits or deletes an event.
• Gmail, sending only: sending from your address an email requested by you, or by a customer you have allowed to (a confirmation, a follow-up). This access cannot read your mailbox.
• Google Contacts: finding a person’s email or phone number, and adding a contact. It never edits or deletes an existing contact.
• Google Tasks: reading your tasks, adding some, and ticking off the ones that are done. It does not delete tasks.
• YouTube, Search Console and Google Analytics: reading your channel’s numbers and your website’s traffic. Read-only: nothing is published or changed. YouTube is connected separately: that authorization asks only to read your channel, with no other access.

Access to a Gmail mailbox is not offered today: it requires an annual security assessment imposed by Google, which we have not yet completed. When it has been completed, that access will be subject to separate consent, and the same rules will apply. Nothing is connected by default, and you can disconnect at any time from your settings; the tokens are then erased.

Fortiche’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice: when you ask your agent to work on a file or your calendar — read a figure, add a row, book an appointment — its content is read for the time it takes to produce the reply, and we keep no copy of it. Only your agent’s reply stays in the conversation, like any other message.

There is one exception, and you are the one who triggers it: if you paste the link to a Google file for your agent to learn (the link on its own, or “learn this document”), its text is kept in what your agent knows, so it can use it later. It then appears under “What you taught it”, where you can remove it at any time: it is deleted, together with everything derived from it. As soon as your message asks for something else — adding, calculating, answering a question — the file is handled live, and its text is not kept.

Your agent may also remember know-how drawn from its work, for example the tab where orders are recorded. What it remembers this way appears under “What it figured out on its own”, where you can erase it at any time.

In every case, this content is not resold, not used for advertising, and not used to train a model. It is passed only to the model provider needed to process your request, and to no one else.

Your agent never deletes a file or an appointment, and only writes in a spreadsheet or a calendar when asked to. This limit is built into the code, not just written in this text. You can withdraw access at any time, from your Fortiche settings or from the permissions page of your Google account; in both cases, the tokens are erased from our servers.

Your Notion data

When you connect Notion, you choose, in Notion’s own window, the pages your agent will be able to see. It only has access to those pages, their sub-pages and the databases they contain: the rest of your workspace stays closed to it. On those pages only, it can:

• search them by title, and read their content or the rows of a database;
• create a page, inside a page or database you have shared, when asked to;
• add text at the end of a page, when asked to.

It never deletes a page and does not change what is already written in it. The content it reads is used for the time it takes to reply, with no copy kept, with the same exception as for Google: if you paste the link of a Notion page for your agent to learn, its text is kept in “What you taught it”, where you can remove it at any time. This content is never sold, never used for advertising, and never used to train a model.

A customer writing to your agent cannot make it read or change your Notion, unless you have allowed it in the “Toucher à tes données” (touch your data) setting. We keep the name of your Notion workspace, to show you what your agent is connected to, but neither your email address nor the list of your pages. When you disconnect it, the access token is erased from our servers and we ask Notion to revoke it. You can also remove the access from Notion’s settings, under “My connections”.

What we do not do

• We do not train any artificial intelligence model on your content.
• We do not sell or rent your data to anyone.
• We do not read your conversations, unless you ask us to for support.
• We do not set any advertising cookie or third-party audience measurement tracker.

The retention periods above are not intentions: they are enforced by an automatic purge, and the text you are reading is built from the values that drive it. If one of them changed, this page would change with it.

Who the data is entrusted to

Running the service requires service providers. Each one acts only for what concerns it, under a data processing contract. Transfers outside the European Union are governed by the European Commission’s standard contractual clauses.

If you use your own key with a model provider, the exchanges go directly to that provider, under your contract with them.

When you subscribe to a creator’s fortiche, your subscription email address is only passed on to them if you ticked the box that offers it. They then become responsible for it. You can withdraw this consent at any time, at the top of your conversation with that fortiche. What you write yourself in that conversation, an address included, they can read, like the rest of the exchange.

Cookies and trackers

The site sets no advertising cookie, no audience measurement tracker and no third-party tracker. Pages you can view without an account set none at all, of any kind. What follows is the complete inventory, kept up to date with the code.

All of them are strictly necessary for the service you request by signing in. Article 82 of the French Data Protection Act (loi Informatique et Libertés) exempts these trackers from consent: that is why you do not see a cookie banner on this site. If we ever added audience measurement, it would be subject to your prior consent, with refusing as simple as accepting.

The widget installed on a customer’s website

When a business installs the Fortiche chat bubble on its own website, its visitors’ browsers store three pieces of information, locally and solely to make the chat work: agenthub_session_… (resuming the ongoing conversation), agenthub_identity_… (if the visitor has identified themselves) and agenthub_expanded_… (keeping the bubble open or closed). Nothing is sent to an advertiser, and nothing makes it possible to track that visitor on another site. It is the business installing the widget that informs its visitors: it may reuse this paragraph as is.

Security

Exchanges go over HTTPS, passwords are hashed, and the keys you entrust to us are encrypted before being stored. Access to systems is restricted to the people who need it. In the event of a data breach likely to harm you, we notify you and inform the CNIL (the French data protection authority) within 72 hours.

Your rights

You can request access to your data, its rectification, its erasure, the restriction of its processing, its portability, and object to processing based on our legitimate interest. Write to hello@fortiche.io: we reply within one month.

If you are not satisfied with the reply, you can lodge a complaint with the CNIL, cnil.fr.

Your agents’ customers

When someone chats with an agent you have published, it is up to you to inform them about the processing of their data, as for any form on your website. We keep these conversations on your behalf and delete them when you delete them.