Privacy policy

Last updated: 17 October 2026. We do not sell any personal data, and we share it with third parties only in the cases named below.

Source and nature of the data

Sirenic redistributes public company data from official registers and sources, among them the Sirene database (INSEE, monthly stock file, supplemented by the public API recherche-entreprises.api.gouv.fr) and the national company register (INPI, through that API and through INPI's RNE API). Data under each source's licence: Etalab 2.0, OGL 3.0, CC BY 4.0, NLOD 2.0, CC0 or the source's own terms; the register dictionary (GET /v1/provenance/registres, free) gives each one's. Some of this data concerns natural persons (company officers): surname, first name, role and, where applicable, year of birth. This service never publishes a personal address or a full date of birth.

Shareholders: the capital breakdown is read by an AI model from the public articles of association filed with INPI. A natural-person shareholder is never named there: they are only counted, with their role and share, and their name is not kept. An extraction that counts natural-person shareholders is deleted after 90 days, or as soon as newer articles are filed, and redone on request.

Managers' transactions (MAR art. 19): Belgium and Germany

The service redistributes managers' transaction notifications published by the FSMA (Belgium, CC BY 4.0 licence) and by BaFin (Germany, © Federal Financial Supervisory Authority / www.bafin.de). These publications name the declaring manager at the source. No name is stored or published by this service: only a non-reversible cryptographic fingerprint is derived from it, used solely to count distinct declarants so that no breakdown can single out a person. What we serve is an aggregate per listed company, never a profile of a person.

Retention: BaFin removes these notifications from its database twelve months after first publication, and our German stock is entirely replaced at each daily collection, so it never exceeds that window. On the Belgian side, each notification is kept five years at most after its publication, then deleted; the same limit applies to Germany. A notification that the FSMA withdrew before then is not removed from our stock automatically: write to us (section “Right to object and data subject rights”) and it will be.

Legal basis

Processing relies on legitimate interest (GDPR art. 6(1)(f)): redistribution of data that is legally public in company registers, within the limits set by law (notably art. A123-96 of the French Commercial Code) and by the redistribution terms of INPI and INSEE. For managers' transaction notifications, publication is required by article 19 of Regulation (EU) No 596/2014 and carried out by the market authority itself.

“Partial disclosure” status

Where an officer or a sole trader has objected to the public disclosure of their data (“partial disclosure” status in Sirene), this service honours that status and returns only the minimal legal company record, without any officer data.

Right to object and data subject rights

If you are a natural person whose data (officer, shareholder or sole trader) is redistributed by this service, you may exercise your rights (objection, access, rectification, erasure, restriction):

• at the source, with INSEE (Sirene disclosure status) or INPI, the most effective route, since it binds every redistributor;
• directly with us, at the dedicated address rgpd@sirenic.eu (suggested subject: “Right to object”). Please state your surname and first name and, if possible, the SIREN of the company concerned. Your request is handled as quickly as possible, and within 30 days at the latest; once the objection is applied, your personal data is excluded from the service's responses. It is no longer kept either in our local copies that name officers and representatives (the Latvian, Norwegian, Estonian, Cypriot and Romanian registers), nor, for a sole trader or a grouping of natural persons (joint ownership, de facto partnership, silent partnership), in our copy of the Sirene register under the SIREN of their business, which we link to the objection when it is taken (the business record remains, without its name): it is no longer written at the next update, and what was already written is erased by our next daily processing, or by the one after for a copy being updated at that time. In our other local copies (legal notices, events, filed accounts, public procurement, classified industrial facilities, interest representatives, European company names), the objection also applies at every update: a covered name is no longer written there, and one already written is erased by our next daily processing; that processing also erases our caches of BODACC notices, intra-EU VAT number checks (VIES), European public procurement notices (TED), Finnish register notices, ESMA registers and INPI document lists kept before the objection. This removal covers our redistribution and does not affect the original public registers.

You also have the right to lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

Data collected by the service itself

Without an account: the x402 rail requires none, the agent pays per call and no cookie is set for it. A single cookie may be set before any sign-in: sirenic_oauth_demande, set by the connector's authorisation screen when it opens without a session; it holds the pending request while your sign-in link arrives (15 minutes, limited to /compte addresses), is strictly necessary to that flow and is used for no measurement. Technical logs (IP address, user agent, timestamp) are kept for security and billing. Settlements in crypto-assets (USDC or EURC) are recorded in an accounting journal kept in line with French legal obligations (10 years, art. L123-22 of the Commercial Code); it contains the payer's blockchain address, which is pseudonymous data.

Measuring our sign-up channels. Without cookies or scripts, we read where your visit comes from as it reaches us: the campaign parameter of our own links (utm_source, utm_campaign), the domain of the previous page (Referer header, never stored) or the absence of a previous page. We derive a channel from a closed list (for example data.gouv.fr, dev.to, search engine, direct access), which our internal links then carry in the page address. If you create an account, that channel's counter for the week goes up by one. The counter holds neither your email, your account, the time nor your IP address, and nothing is added to your account. Purpose: knowing which channels bring sign-ups (audience measurement for our sole use, nothing is shared with third parties). Basis: our legitimate interest (Art. 6(1)(f) GDPR); tracker exempt from consent as audience measurement (Art. 82 of the French Data Protection Act). Counters are deleted after 25 months. If your browser sends a Global Privacy Control or Do Not Track signal, nothing is read; you can also object at the address below.

Badges. A Sirenic badge shown on another site is loaded from our servers by each visitor's browser (or by that site's image server), with no cookie, no script and no tracking from one site to another; the address of the page that shows it (Referer header) is not stored in our access logs. Like any request, this load leaves the IP address of whoever loads it in two logs. The log of our front-end server also records the date and the badge address; it starts a new file every 20 MB and, at each new file, deletes the closed files older than 7 days and keeps only the 5 most recent. The system log receives the application's line, with the browser (user-agent), the date and the badge address without its number; its size is capped, and its oldest lines are deleted when it is full. For the badge of a response, the IP address is also kept by the counter that limits its loads to 60 per minute and per address; this counter is deleted by the daily maintenance once its minute has been over for more than one day.

With a client account (API key and prepaid credits, open to companies and individuals alike), we keep: the email address used as the identifier and the language of your emails, the sign-up IP address (90 days, against abuse), the billing details you enter (first and last name or company name, postal address, country, and for a company the SIREN or VAT number), the log of charged calls and the credits purchased. A session cookie, valid for 30 days, is set after you click your sign-in link: it is strictly necessary for the client area to work and is used for no analytics whatsoever. Card payments are handled by Stripe, which receives your email address, billing and payment data; no card data passes through our servers. An address never confirmed is deleted after 7 days. An account is kept while it is open; to close it, write to rgpd@sirenic.eu. A closed account is anonymised after 30 days, except for the accounting entries the law requires us to keep for 10 years.

Referrals. If you enter a referral code, we keep the link between your account and the referrer's: two internal identifiers, the state of the award, the reason for any refusal and dates to the day. The referrer only sees numbers per month; you do not see who referred you. To decide an award, we compare the sign-up IP address of both accounts, already kept for 90 days, and the domain of their email address, to prevent fraud (legitimate interest). The link is kept until 30 days after the credits it earned expire, or 30 days after a refusal or an expired deadline, then erased; it is erased together with either account. The day you enter a code stays recorded on your account, so that an account enters only one code; it is erased with your account. The lines of these credits stay in the accounting ledger, like any credit line. A random code, even withdrawn, stays reserved so it is never reassigned, with no link to you once your account is erased; a custom code is erased with your account, and we keep only a fingerprint of it, which cannot be turned back into the code without the server's key, so that a link carrying it never credits another account (legitimate interest), for at most 36 months.

Template reward. If you claim the reward for a published template, we keep, linked to your account, the public address of the template, its date and the number of offered credits. Basis: performance of the contract (Art. 6.1.b GDPR). The template address is erased from our database when the account is anonymised.

Early-access request: while public sign-up is not open, the client area offers to take an email address. It is used solely to invite you when the service opens, is shared with no one, and is deleted 30 days after the invitation is sent, or at the latest 180 days after the request if the service has not opened in the meantime.

Legal basis for account data. Performance of the contract (GDPR Art. 6(1)(b)): email address, language, keys, balance, credits, call log, session, connector, monitoring, early access. Legal obligation (Art. 6(1)(c)): billing, accounting entries. Legitimate interest (Art. 6(1)(f)): sign-up IP address, record of our actions on an account.

Emails. Account emails and monitoring alerts are sent through Brevo (Sendinblue SAS, Paris), our processor (GDPR Art. 28) under the data processing agreement annexed to its terms. It receives the recipient's address and the content, which it hosts in France and Belgium. Some of its sub-processors may access them from outside the Union, under standard contractual clauses. The address or webhook of a monitoring is deleted 30 days after it ends. Your requests about your rights reach the rgpd@sirenic.eu mailbox, hosted by OVHcloud in France, and our replies leave from it, without going through Brevo.

x402 settlements. A pay-per-call payment is verified and then settled by the Coinbase Developer Platform facilitator, provided by Coinbase, Inc. (United States) or a company of its group, our processor (GDPR Art. 28) under its terms. It receives the signed payment authorisation, which carries the payer's public wallet address and the amount, and the address of the route called, without the values in its path. It checks that the payer's address is neither sanctioned nor high-risk, and may decline the payment. The transfer outside the Union is covered by standard contractual clauses. The settlement is then recorded on the public Base blockchain, readable by anyone.

The MCP connector and OAuth authorisation

When you connect an assistant (Claude, ChatGPT, Le Chat, Perplexity, n8n…) to your account, what we keep is limited to the following:

• the identity of the software requesting access: its name, its redirect URI and, where applicable, the address of the metadata document it publishes. This information comes from the software, not from you;
• the link between your account and that software, created when you click “Authorise”, together with the date of that consent;
• token fingerprints, never the tokens: the access token is a key of your account, of which we keep only a SHA-256 fingerprint, as for an API key. It expires after one hour; the refresh token expires after 90 days without use;
• the log of calls made through the connector, identical to that of a direct API call: route, timestamp, amount charged. This is what lets you check your usage.

What the assistant gets: the right to call the data routes on your behalf, against your quota and then your balance. What it does not get: your email address, your invoices, or the right to top up or close the account. You can cut this access off at any time from your API keys; revocation is immediate. Unfinished authorisation requests and single-use codes are deleted automatically once their short lifetime has passed.

Document-analysis processor and transfer outside the European Union

Two features call a language model provided by Anthropic, whose processing servers are located in the United States:

• /v1/entreprise/{siren}/capital sends Anthropic the PDF of the PUBLIC deed filed with the national company register (articles of association published by INPI), for the duration of the extraction. That public deed may name natural persons (shareholders, officers) as it publishes them. The response served by Sirenic is minimised: year of birth at most, never a personal address or a full date.
• /v1/entreprise/{siren}/sante sends NO name of a natural person: the file given to the model is limited to the company's REGISTERED name (only where it is proven to be a legal entity, never that of a sole trader), together with amounts, ratios and qualifications. No officer name, no year of birth, no address.

This processing is governed by Anthropic's data processing addendum (DPA), which incorporates the European Commission's standard contractual clauses for the transfer; documents sent through the API are not used to train the models. Details of the flows and safeguards: rgpd@sirenic.eu.

Security

The service is reachable over HTTPS only (TLS, HSTS). No secret is stored in clear: API keys, connector tokens, authorisation codes and session tokens are kept only as SHA-256 fingerprints, so we can neither read them back nor resend them to you. There is no wallet private key on our servers: only the public receiving address is held. The client area uses neither passwords nor JavaScript; its session relies on an httpOnly, Secure, SameSite cookie that can be revoked at any time. The front-end access log keeps no request headers at all (precisely so that no key can appear in it); it starts a new file every 20 MB and, at each new file, deletes the closed files older than 7 days and keeps only the 5 most recent. In the event of a data breach presenting a risk, we notify the CNIL within 72 hours and, where the risk is high, the individuals concerned.

Hosting and backups. Our servers and databases are hosted by OVHcloud; an encrypted copy of the database is sent every day to OVHcloud object storage in Strasbourg. A daily copy of the accounting entries (including the payer's public wallet address and the user agent of the call) and an encrypted copy of the tables holding personal data (accounts, objection requests, monitoring) are also kept in a private repository at GitHub (GitHub, Inc., United States), which participates in the EU-U.S. Data Privacy Framework; these copies are not purged to date.

Data controller

For any question about your personal data or the exercise of your rights: rgpd@sirenic.eu. The identity and address of the data controller are given in the legal notice.