This is a translation of the French text, pending legal review. The French version prevails. French version
Privacy policy
This page describes the data processed by Moustache AI, the purposes pursued and the rights you have.
Last updated: 27 July 2026
Data controller
Moustache AI, 9 rue des colonnes, 75002 Paris, is responsible for the processing described below as it relates to its website and customers. For any questions, write to bonjour@moustacheai.com.
Where we operate the Service on behalf of a merchant, the data of its end customers is processed as a data processor, on its sole instructions and under an agreement in accordance with Article 28 of the GDPR.
Data processed and purposes
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Subscription management | Professional identity, email address, company, billing address, order history | Performance of the contract | Duration of the contract, then 10 years for accounting documents |
| Contact requests | Name, email address, company, message | Legitimate interest to respond | 3 years after the last exchange |
| How the agent works | Content of conversations, order data transmitted by the store | Performance of the contract, on behalf of the merchant | Depending on the offer subscribed, from 7 days to unlimited |
| Security and logging | IP address, timestamp, user agent | Legitimate interest in securing the service | 12 months |
What we don't do
- We do not use merchant conversations or data to train artificial intelligence models.
- We do not sell or rent any personal information.
Recipients and data processors
The data is accessible to authorized personnel of Moustache AI and to technical service providers strictly necessary for the service: application hosting, transactional emails, payments (Stripe Payments Europe Ltd.), video call appointments (Calendly LLC) and language model providers. Only after your consent, ChatGPT (OpenAI Ads) and Meta (Meta Platforms Ireland Ltd.) advertising measurement is also used. Each provider is bound by a data processing agreement and acts only on our instructions.
Location and transfers
The data is hosted in France. When a subcontractor involves a transfer outside the Union – this is the case for appointment making, operated by Calendly, and the ChatGPT and Meta advertising measures, operated by OpenAI and Meta Platforms – this is governed by the standard contractual clauses of the European Commission, supplemented where necessary by additional technical measures.
Cookies and audience measurement
This site uses cookies that are strictly necessary for its operation and the security of the payment tunnel. Your browsing data is never sold.
The Contact page displays an appointment schedule provided by Calendly, instead of a form. It loads as soon as the area hosting it approaches the screen, that is to say as soon as the page is opened on most screens, and Calendly then places its own cookies, for the sole purpose of making the reservation work. We do not send them any data: only what you enter in their form reaches them. Other pages on the site do not load it.
Site traffic is measured with Umami, a statistics tool that we host ourselves, in France, on our own server: navigation data does not leave our infrastructure and is not shared with any third party. Umami sets no cookies and does not store your IP address. It groups the pages viewed during a visit under a pseudonymous identifier, derived from the IP address and browser and reset every month, which we cannot link to you as a person. It records the pages viewed, the origin of the visit, the type of device and browser and the country, solely for our audience statistics.
We also use the ChatGPT advertising pixel (OpenAI Ads) to measure the effectiveness of our campaigns served on ChatGPT. This tracker transmits to OpenAI Ireland Ltd. the pages visited and a measurement identifier, for the sole purpose of knowing whether a visit comes from a campaign and whether it led to a registration — we do not transmit any other personal data.
We also use the Meta pixel to measure our campaigns broadcast on Facebook and Instagram. It transmits to Meta Platforms Ireland Ltd. the pages viewed and a measurement identifier. If you send a request from a form on the site, it also transmits a contact event. The pixel does not load if you have refused cookies.
If you have accepted these measures, the opening of the payment and the subscription made from the customer area (app-shop.moustacheai.com) are also transmitted to Meta, from our servers, by its Conversions API: pixel measurement identifier, IP address, browser type, email address, country and postal code (the last three hashed), offer chosen and amount paid. Your choice is stored in a cookie common to the site and the customer area; in the event of refusal, nothing is transmitted.
A banner allows you to accept or refuse these measures during your first visit, and to reconsider your choice at any time. Advertising pixels only load if accepted. A refusal has no consequences on access to the site or on subscription.
List of partners
The consent banner covers the following measurements. None of them loads before you accept, and refusing blocks them all.
- Moustache AI (ourselves) — audience measurement with Umami, hosted on our own server in France, without cookies and without storing your IP address. No partner has access to it.
- OpenAI Ireland Ltd. — ChatGPT advertising pixel (OpenAI Ads), to know whether a visit comes from our campaigns served on ChatGPT and whether it led to a registration. OpenAI privacy policy
- Meta Platforms Ireland Ltd. — Meta pixel and Conversions API, to measure the effectiveness of our campaigns served on Facebook and Instagram (pages viewed, contact requests, subscriptions from the customer area). Meta privacy policy
Your rights
You have rights of access, rectification, erasure, restriction, objection and data portability. You can exercise these rights by writing to bonjour@moustacheai.com; we will reply within one month.
If you are the end customer of a store using Moustache AI, send your request directly to this store: it determines the purposes of the processing. We will relay any requests received in error.
You can also submit a complaint to the National Commission for Information Technology and Liberties (CNIL), 3 place de Fontenoy, 75007 Paris.
Security
Encryption of exchanges in transit and data at rest, partitioning of environments, nominative and logged access, regular review of authorizations: the measures are proportionate to the risks. Any data breach likely to create a risk for individuals is notified in accordance with Articles 33 and 34 of the GDPR.
Changes
This policy may change. Any substantial modification is notified to customers by email. The commercial conditions are described in general conditions of sale.