Privacy Policy
Dernière mise à jour : 20 octobre 2026
Translation provided for convenience; the French version prevails.
Who is responsible for your data
The Marius service is published by Marius Studio SAS (see the legal notices). Depending on the case, Marius has two roles:
- Data controller for the marius.qd.je site, the contact form, the customer area accounts, the preparation of demonstrations and the assistant present on marius.qd.je.
- Subcontractor of its customers when the Marius assistant is installed on their site: the company which welcomes you to its site is then responsible for the conversations, and Marius processes them on its behalf, according to its instructions and a contract compliant with article 28 of the GDPR.
Contact for any questions: bonjour@marius.qd.je.
Data, purposes and durations
Contact form
Name, email address, address of your site, sector and message, to respond to your request and present the service to you. Basis: pre-contractual measures taken at your request. Conservation: the time to exchange with you, then at most 3 years after the last exchange.
Customer area accounts
Email address, display name, company and team role, login dates. To provide customer space and secure access. Basis: execution of the contract. Conservation: as long as the account exists; it can be deleted at any time from the space (My account). At the end of the contract, the company's space, accounts and conversations are deleted within 30 days. The trace of the responses added by the company (text, author, date) is kept 5 years after the end of the contract, as proof in the event of a dispute.
Customer area API and webhooks
When the owner of a company's space creates an API key or a webhook: name of the key, email address of the person who created it, dates of creation, expiration and last use, address of the webhooks. The key itself is never kept, only a fingerprint that allows it to be recognized. The API call log (address called, result, time) is kept for 90 days and events sent to webhooks for 30 days. To provide this service, secure it and limit abuse. Basis: execution of the contract.
Service emails
Invitations, connection links, quota alerts, monthly reports and notifications chosen by each member: email address and message content. Basis: execution of the contract.
Preparing for demonstrations
To propose Marius to a company, we read the public pages of its site and note the professional contact details published there (company name, email and contact telephone number). Basis: legitimate interest in prospecting professionals. A demonstration is only accessible via a non-guessable link. The company can object at any time: the demonstration and its data are then deleted within 7 days. Conservation: as long as the exchange with the company is in progress, and at most 1 year after the last contact.
Email prospecting
We identify companies likely to be interested in Marius in public sources (official business directory, legal announcements, public procurement notices), then read a few public pages of their site (home, legal notices, contact) to verify that it is indeed their site and note the contact email address that they publish there. We never use addresses guessed, purchased, or taken from a third-party directory. Basis: legitimate interest in presenting a service related to the company's activity. Each message indicates where the address was found and contains a one-click unsubscribe link. Shipments are made by Brevo, which notifies us of invalid addresses. Conservation: the information of an uncontacted lead is deleted after 6 months, that of a contacted company follows the demonstration rule above.
If you unsubscribe or object to prospecting, we keep an encrypted (non-reversible) imprint of the address, domain name and SIREN number for no time limit, only to never write to you again.
Likewise, when we have written to a company for the first time, we keep an encrypted imprint (non-reversible) of its address, its domain name and its SIREN number for an unlimited period of time, only to never send it a second first message.
Conversations with Marius
When you write to the assistant (on marius.qd.je or on a customer's site), we process:
- your messages and replies, their date, your opinion (thumbs up or down) and a random conversation identifier;
- the contact details you choose to write in the conversation (name, email, telephone), so that the company can contact you again;
- your answers to the few questions that the assistant may ask you on behalf of the company (for example your project, the deadline or the number of people), and a form which summarizes your request and estimates its progress, so that the company can respond to you as best as possible. These questions are chosen by the company, never on sensitive data; answering it is optional and the assistant does not insist;
- a fingerprint of your IP address, deleted after one hour, to limit abuse (number of messages per minute). She is not guarded with conversation.
Purposes: to respond to you, allow the company to read the exchanges, to qualify the requests to contact you again, to complete the missing responses and to monitor the use of its assistant. Basis: legitimate interest of the company to respond to visitors to its site. Conservation : 12 months, then automatic deletion.
If the company chooses, this information (contact details, responses, file, conversation) can be transmitted to its own tools, for example its customer management software, on its instructions, via the API or Marius webhooks. The company is then responsible for processing: to find out where your data is going and to exercise your rights, contact it.
Conversations are neither resold nor used to train artificial intelligence models. Do not write sensitive data (health, bank details, passwords): the assistant does not need it.
Providers
Your data is only communicated to service providers necessary for the service, bound by contract:
- Supabase : database, accounts and files, hosted in Frankfurt (Germany).
- Mistral AI (France): generation of responses, search in content, reading PDF documents and submitted documents. The data transmitted is not used to train its models.
- European Cloud : site hosting, served from Frankfurt, Germany.
- Brevo (France): sending service emails.
- Bunny Fonts (BunnyWay, Slovenia, European Union): the fonts of the site and the assistant are loaded from its European servers, which on this occasion receive the IP address of your browser to send them to you. No fonts are loaded from Google.
- GitHub : automatic preparation of demonstrations, based on public content on the company's site; no conversation takes place there.
The tools that a company itself links to its space (API, webhooks) are not Marius service providers: it chooses them and is responsible for them.
Security
Encrypted exchanges (HTTPS); database closed by default, each access being checked on the server side; each company only sees its own conversations; no stored password (connection via link sent by email, valid for one hour); automatic partitioning checks after each evolution of the service; API keys never kept in plain text, reserved for the owner of the space and limited in time; sending signed and reserved webhooks to secure addresses (HTTPS).
Your rights
You can request access to your data, their rectification, their erasure, limitation of processing, object to processing and request portability of your data, by writing to bonjour@marius.qd.je. Response within a month.
For a conversation held on the site of a client company, you can contact this company or us: we will forward your request to them and help them respond to it.
If you believe that your rights are not respected, you can contact the CNIL (cnil.fr).