GDPR policy and data protection

The data controller is Localnord LLC, a U.S. company (Limited Liability Company) registered in the State of Delaware, represented by Robin Gastout. As an entity established outside the European Union, Localnord has appointed, in accordance with Article 27 of the GDPR, a representative within the European Union: Robin Gastout, reachable at sav@localnord.fr.

Registered office

131 Continental Dr, Suite 305, Newark, DE 19713, USA

Contact email

sav@localnord.fr

Data hosting

Database in Switzerland (Zurich) - Supabase

Compliance

GDPR (EU) 2016/679

EU representative (Art. 27)

Robin Gastout

Localnord as data controller

For the following processing activities, Localnord determines the purposes and means and acts as the data controller: account and client-relationship management, billing, support, service improvement, commercial prospecting and website audience measurement. This policy mainly describes these activities.

Localnord as processor

For the data the Agency processes through the platform on behalf of its own clients - Google Business Profile data, reviews, content and End Client data - the Agency is the data controller; Localnord acts as a processor within the meaning of Article 28 of the GDPR. These activities are governed by the data processing agreement (DPA) and the Terms of Sale.

Identification data

• First and last name
• Email address
• Phone number (optional)
• Company / agency name

Billing data

• Billing address
• Payment information (processed by Stripe - never stored by Localnord)

Usage data

• Connection logs (IP address, browser, date and time)
• Last visit of an account signed in to app.localnord.io: when you are signed in, we keep the IP address and the browser (User-Agent) of your last visit, for account security, support and to understand how the service is used. They are deleted 30 days after your last visit or with your account. When our team looks at your account, the address may be sent to ipapi.is (Germany) to find out the internet provider and spot a VPN
• Visits to the localnord.io site and the app.localnord.io application: the site and the application count their visits with Umami, an audience measurement tool that Localnord hosts on its own server (stats.localnord.io). They also record a replay of visits: what the page displays, mouse movements, clicks, scrolling and navigation between pages. Every visit to the pages concerned is recorded, without sampling, for 30 minutes at most per page load. On the site, no page opened from a token link (reports, plans, unsubscriptions received by e-mail) is recorded. In the application, only the pages of signed-in accounts (dashboard, account creation, home) are recorded, never the sign-in pages, the public pages received by link, the agencies' client portal or the games, and the recording is tied to the signed-in account. Nothing is recorded when a page is displayed inside a frame. The content of input fields is masked in your browser before it is sent; what the page displays remains visible in the recording. Recordings stay on Localnord's Umami server and only the Localnord team views them, to understand and fix visitors' difficulties. They are deleted after 30 days. No cookie is used
• Replay analysis: each recorded visit is summarized automatically on our server as a text timeline (pages opened, labels of the buttons and links clicked, durations, signs of difficulty such as repeated clicks or an error). The summary never contains what you type in a field, your name or your email address; email addresses, phone numbers and long strings of digits shown on screen are masked in it. Except for a single-page visit without any click, the summary is then analyzed by an artificial intelligence model, Anthropic's Claude (United States), through Vercel's AI Gateway, to spot what gets in visitors' way and improve the site and the application. Anthropic does not use data from its API to train its models. This analysis is not used to make any decision about you. Summaries and analyses are deleted after 30 days.
• Daily visit review: every morning, the previous day's visits are gathered on our server into a file without identity. It holds totals (source, country, device, browser) and, for each visit, identified only by a number: the country, device, browser, pages viewed (addresses without identifiers), duration, actions (including a sign-up or a payment, without knowing who), the summary and analysis of its replay, and a label (E1, E2…) shared by visits that look alike. It never contains an IP address, a city, an email address, a name or any account or visitor identifier. This file is analyzed by an artificial intelligence model, xAI's Grok (United States), through Cursor (United States), to spot what gets in visitors' way, where the traffic comes from and fake traffic. This analysis is not used to make any decision about you. The file is deleted after 30 days and the report after one year; a copy of the report stays in the Grok app.
• Received emails: emails sent to sav@localnord.fr are read by an artificial intelligence assistant that works for Robin Gastout. Every 30 minutes, from 8 a.m. to midnight (Bangkok time), the sender's address and name, the subject and the text of new messages are sent to xAI's Grok model (United States), through Cursor (United States). The assistant answers a simple question on its own when the answer is in the service's public information. It never grants or commits to anything: a refund, a quote, a contract, access to or data of an account, a complaint go to Robin Gastout, who answers them. It archives messages that ask for nothing. It does not keep the text of the emails: for each message it handles, it keeps only the sender's address, the subject and a one-sentence summary of what was done or what is expected. This information is kept for 30 days in a Supabase database hosted in Europe (Zurich). The emails themselves stay in the inbox (Google Workspace). This processing is based on legitimate interest: answering you faster. For any question or to object to it: sav@localnord.fr.
• Chat and social media messages: messages written to the team in Localnord's help chat, and the private messages and comments received on our Instagram accounts and Facebook pages (Messenger), are read by the same assistant, at the same times. It receives the display name and the text of the conversation's new messages. It answers a simple question on its own, on behalf of the team or of the account holder, when the answer is in the service's public information, and passes everything else to Robin Gastout, whose reply it may then put into shape and send. It does not keep the text of messages: for each message handled, it keeps only the display name, the channel and a one-sentence summary, for 30 days, in the same database. Same legal basis; to object to it: sav@localnord.fr.
• Actions performed on the platform
• Google Business Profile and End Client data, processed as a processor on behalf of the Agency (see Article 2)
• Facebook Pages and Instagram professional accounts connected by the Agency (through Facebook Login): name, picture, posts, comments and their authors' names, insights (followers, views, interactions), processed as a processor to publish the listings' posts, answer comments and display insights. Access tokens are encrypted, never sold or shared; access can be removed at any time from Localnord or the Facebook settings, and the related data is then deleted
• Google Ads accounts connected by the Agency (through Google sign-in, "Google Ads" permission): account names and IDs, campaigns, budgets and statistics (cost, impressions, clicks, conversions), processed as a processor to display the listings' results, pause or enable a campaign, set its budget and create, at the Agency's request, a paused campaign. Localnord's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Access tokens are encrypted, never sold or shared, and never used to train AI models; access can be removed at any time from Localnord or at myaccount.google.com/permissions, and the related data is then deleted
• Free tools on the website (email signature generator): the business name you type and an approximate city derived from your IP address, sent to Google to suggest listings, never stored by Localnord

Cookies and trackers

• Essential cookies: session, authentication, language preference
• Analytics cookies: Google Analytics
• Marketing cookies: Meta Pixel (Facebook), only with your consent

• Service delivery - legal basis: contract performance
• Billing and accounting - legal basis: legal obligation
• Customer support and guidance - legal basis: legitimate interest
• Service improvement and statistics - legal basis: legitimate interest
• Commercial prospecting and advertising - legal basis: consent

Non-essential cookies (analytics and marketing) are only placed after your consent, collected via the cookie consent banner. Cookies strictly necessary for the site to function are exempt.

Google Analytics

Traffic analysis and visitor behavior. Anonymized data. You can install the opt-out module.

Meta Pixel (Facebook)

Advertising campaign effectiveness measurement. Only placed after consent. Manage your preferences on Facebook Ad Preferences.

Retention period

13 months maximum, in accordance with CNIL recommendations.

Account data

Subscription duration + 3 years

Billing data

10 years (accounting obligation)

Connection logs

12 months

IP address and browser of the last visit

30 days after the last visit, or with the account

Replay of site and application visits (Umami recordings)

30 days

Daily visit file (Grok) and its report

30 days for the file, 1 year for the report

Summary of processed emails (sender's address, subject, one-sentence summary)

30 days

Cookies

13 months maximum

Google Business Profile, Facebook Page and Instagram account data

Exportable for 30 days after termination, then deleted

Stripe

Payments (Data Privacy Framework)

Supabase

Database hosting - Zurich, Switzerland (GDPR-compliant DPA)

Vercel

Website and application hosting, platform processing in Paris, EU (GDPR-compliant DPA)

Anthropic

Automated analysis of recorded visit summaries (Claude model), through Vercel's AI Gateway, in the United States

xAI

Daily review of a file of visits without identity and reading of received emails and messages (Grok model), through Cursor, in the United States

Hostinger

Hosting of the audience measurement and replay server (stats.localnord.io), in France

Resend

Transactional email delivery

Google

Google Business Profile API, Places API (free website tools) + Analytics (SCC); Google Ads API for the Google Ads accounts the Agency connects (statistics, campaign management and creation); Google Workspace for the inbox of received emails

Meta

Advertising (with consent only); Graph API for the Facebook Pages and Instagram accounts the Agency connects (publishing, comments, insights)

AI providers

Content generation (text, images)

ipapi.is

Internet provider and VPN detection for an IP address, when our team looks at an account - Germany

The up-to-date list of sub-processors is kept available and the Client is informed of any change, in accordance with Article 28 of the GDPR.

Localnord never sells your personal data to third parties.

The platform database is hosted in Switzerland (Zurich), via Supabase. Switzerland is covered by a European Commission adequacy decision: this transfer requires no specific authorization (Article 45 GDPR). Application processing runs within the European Union (Paris). Some sub-processors (Stripe, Vercel, Resend, Google, Meta, Anthropic, AI providers) may process data in the United States. These transfers are governed by standard contractual clauses (SCCs) approved by the European Commission and/or by the EU-U.S. Data Privacy Framework. The daily file of visits read by Grok (xAI), through Cursor, is also processed in the United States; it contains no IP address, name or email address. The emails received, read by Grok (xAI) through Cursor, are also processed in the United States.

The marketplace allows agencies to access data on businesses that have a Google listing, for business-to-business (B2B) commercial prospecting. This data comes from publicly accessible sources (Google Business Profiles, professional websites). For building this database, Localnord acts as a data controller on the basis of legitimate interest (B2B prospecting) and ensures respect for the rights of the data subjects, in particular their information (Article 14 of the GDPR) and their right to object. When an agency uses this data, it acts as an independent data controller and assumes its own obligations. Any person listed in the marketplace may request the rectification or deletion of their data at sav@localnord.fr.

In accordance with the GDPR, you have the following rights:

• Access - obtain a copy of your data
• Rectification - correct inaccurate data
• Erasure - request the deletion of your data
• Restriction - restrict processing
• Portability - receive your data in a structured format
• Objection - object to processing
• Withdrawal of consent - at any time

To exercise these rights: sav@localnord.fr. Response within 30 days maximum.

• Data encryption in transit (HTTPS/TLS)
• Data encryption at rest
• Secure authentication with password hashing
• Restricted access (principle of least privilege)
• Regular backups and disaster recovery plan
• Periodic security monitoring and audits

In the event of a breach likely to pose a risk to your rights and freedoms, Localnord commits to notifying the competent authority within 72 hours and informing you as soon as possible.

You may file a complaint with the data protection authority in your country. For France: CNIL.

Localnord reserves the right to modify this policy at any time. In the event of a substantial change, you will be informed by email or through the platform.