Privacy policy
Last updated: 2026-07-21
Opinion Radar measures what AI assistants say about brands, products and organisations. That service needs very little personal data — and this page states exactly which data, why, for how long, and who else can see it.
1. Who is responsible for your data
The data controller is STELLAR REGIONS, société par actions simplifiée à capital variable, 200 rue de la Croix Nivert, 75015 Paris, France (registration 835 198 052 R.C.S. Paris). For any question or request about your data, write to contact@opinion-radar.com.
2. What we process
a. If you create an account
- Your email address — your login and the channel for service messages.
- Your password, stored only as a cryptographic hash (argon2id). We do not know it and cannot recover it.
- Your interface language (French or English), so we write to you in your language.
- A session token while you are signed in, and a temporary token when you verify your address or reset your password.
- If you sign in with Google: the stable identifier Google sends us and the associated email address. We never receive your Google password or access to your other Google services.
b. What you enter into the service
Your radar content — the entity you track, competitors, situations, questions, your website address — along with the AI models' answers and the resulting reports. This content is yours. It is visible only to members of your account, unless you choose to publish a report: only then does the page become publicly accessible at the address we give you.
c. If you subscribe
Your plan, its status and billing period, plus the customer and subscription identifiers issued by Stripe. We never see or store your card details: payment is handled entirely by Stripe, which alone processes your card number.
d. If you leave your email on a public page
Some observatory pages let you ask to be notified of the next measurement, or suggest a tool to add. We then keep the address you entered, the page concerned and, where applicable, the tool suggested — for that purpose only. We never sell or rent these addresses, and we do not use them for unrelated marketing.
e. Technical usage records
We record the jobs run for your account (measurements launched, models queried, volumes, costs) in order to enforce your plan's quotas, bill correctly and detect abnormal usage.
f. Audience measurement
We measure traffic to our public pages with Umami, a tool that sets no cookies and creates no identifier that could track you across sites or across visits. We obtain aggregate statistics (page views, referring pages, country, device type) — never an individual profile. That is why this site shows you no consent banner. Audience measurement is not active inside your account once you are signed in.
3. Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Create and secure your account, give you access to the service | Performance of the contract |
| Run the measurements you request and produce your reports | Performance of the contract |
| Manage your subscription, take payment, issue invoices | Performance of the contract and legal obligation (accounting) |
| Send service messages (address verification, password reset, subscription confirmation, failed payment) | Performance of the contract |
| Notify you of a new public measurement, if you asked us to | Consent (withdrawable at any time) |
| Measure traffic to our public pages in aggregate | Legitimate interest (understanding what is read, without individual tracking) |
| Prevent fraud and abuse, keep the service secure | Legitimate interest |
4. How long we keep it
| Data | Retention |
|---|---|
| Account and associated content | As long as the account exists, then 3 years after your last sign-in — or immediately upon your deletion request |
| Sign-in session | 30 days |
| Password reset token | 1 hour, and unusable as soon as it has been used |
| Invoices and accounting records | 10 years (legal obligation) |
| Emails left on a public page | 3 years after last contact, or as soon as you ask to be removed |
| Audience statistics | Aggregated, with no individual identifier |
5. Who else has access
We sell no data. We rely on the following providers, strictly to operate the service:
| Provider | Role | Data involved | Hosting |
|---|---|---|---|
| Fly.io | Application and database hosting | All service data | France (Paris) |
| Stripe | Payment and billing | Email, payment method, subscription history | United States / EU |
| Resend | Sending service emails | Email address and message content | United States |
| “Sign in with Google” (if you use it) | Google identifier, email | United States / EU | |
| Google Cloud Storage | Storing images you upload | Entity images | EU |
| OpenRouter | Access to the AI models queried | The text of the questions measured (not your account data) | United States |
| Umami | Cookieless audience measurement | Aggregate visit statistics | United States |
We may also disclose data where the law requires it (court order, tax obligation).
Transfers outside the European Union
Your data is hosted in France. Some of the providers above are established in the United States: those transfers rely on the safeguards provided for by the GDPR (European Commission standard contractual clauses and, where applicable, Data Privacy Framework certification).
An important note about AI models
The questions we put to AI models are about brands, products and organisations — not about you. We do not send your email address, your identity or your account data to model providers. Even so, avoid entering personal data in the free-text fields of your radars: their content is sent to the models being queried.
6. Cookies
This site uses no advertising cookies, no analytics cookies and no third-party trackers. The only cookies we set are strictly necessary to operate the site, which exempts them from prior consent:
| Cookie | Purpose | Lifetime |
|---|---|---|
gio_session | Keeps you signed in | 30 days |
locale | Remembers the language you chose | 1 year |
gio_oauth_state, gio_oauth_next |
Secures Google sign-in (cross-site request forgery protection) | A few minutes |
Two resources are loaded from third-party servers when pages render — the htmx interface library (unpkg.com) and the audience measurement script (cloud.umami.is). Those servers technically receive your IP address, as does any server your browser requests from; they set no cookies.
7. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, and to withdraw your consent wherever processing relies on it.
To exercise these rights, write to contact@opinion-radar.com from the address linked to your account. We respond within one month at most. Deleting an account erases your radars, measurements and reports, including any published pages — except accounting records the law requires us to keep.
To stop an alert you requested on a public page, use the unsubscribe link in the message you received, or write to us.
If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), www.cnil.fr, or with your local supervisory authority.
8. Security
Traffic to the site is encrypted (HTTPS). Passwords are stored as argon2id hashes. Each account's data is isolated: every read of your data is filtered by your account identifier, and that isolation is verified by automated tests on every change to the software. Administrative access is restricted to named addresses.
9. Changes
This policy may change as the service evolves. The last-updated date appears at the top of the page; account holders are notified by email of any substantial change.