Privacy Policy

Last updated: August 27, 2026

INSPYRSTUDIO places great importance on protecting your personal data. This policy explains what data we collect when you use the website cygon.tech and the Cygon software (together, "the Services"), why we collect it, how long we keep it and what your rights are. It is drawn up in accordance with Regulation (EU) 2016/679 (the GDPR) and the applicable national data protection legislation.

1. Data controller

The controller of your data is:

INSPYRSTUDIO, a SAS with a share capital of €80,000, registered with the Chambéry Trade and Companies Register under number 101 208 809, whose registered office is at Savoie Technolac, 19 boulevard Mer Caspienne, 73370 Le Bourget-du-Lac, France.
For any question regarding your personal data: support@cygon.tech.
INSPYRSTUDIO has not appointed a Data Protection Officer (DPO), as this is not mandatory given the nature of its activities.
Our merchant of record, Paddle, acts as a separate and independent controller for the sale itself. See § 4.

2. Data we collect and purposes

We only collect the data necessary for the purposes described below. Each processing operation is based on a legal basis within the meaning of Article 6 of the GDPR.

• Account creation and management, authentication, access to the Cygon software — Name or pseudonym, e-mail address, password (stored in hashed form), technical session and connection data — Performance of the contract (Terms of Use of the Services) — For the entire duration of the account; deletion no later than 3 years after the last activity on the account. Connection logs are kept for 12 months.
• Sending service-related e-mails (confirmation, password reset, notifications, subscription reminders) — E-mail address — Performance of the contract — For the duration of the account
• Subscription management — Your account e-mail address, the plan and billing frequency subscribed, the status of the Subscription, its start and renewal dates, and the identifiers Paddle uses to link the Subscription to your account. We do not receive or store your payment card data, and we do not hold the invoices Paddle issues to you (see § 4) — Performance of the contract — For the duration of the Subscription, then 3 years, subject to the following point
• Accounting and tax records — The accounting records relating to the sums remitted to us by our merchant of record, which are transaction-level and do not require us to retain your account data — Compliance with our legal accounting and tax obligations — 10 years, as required by the applicable accounting rules
• Responding to requests, collecting feedback and user support — Name or pseudonym, e-mail address, content of messages and feedback — Legitimate interest (assistance and improvement of the Services) — 3 years from the last contact
• Audience measurement and improvement of the Services — Browsing data, pages viewed, device type, session identifiers, and, for Microsoft Clarity, mouse movements, clicks and session recordings in which sensitive content is masked (see § 6) — Consent (non-essential cookies) — Audience measurement data: 25 months maximum
• Security of the Services, protection against bots and fraud — IP address, connection logs, technical browsing data (notably via the CAPTCHA service, see § 4) — Legitimate interest (information system security) — 12 months
  ‍

3. Mandatory or optional nature of the data

Data marked as mandatory in our forms is necessary to provide the relevant service (for example, an e-mail address is essential to create an account). Without it, we will not be able to process your request. Other data is optional.

4. Hosting, recipients of your data, and our merchant of record

Your data is intended solely for the authorised departments of INSPYRSTUDIO and for the recipients listed below.

Hosting and authentication. The Cygon application and its database are hosted on our own servers, operated by OVH in France (European Union). Account and authentication management is carried out by us, on this same infrastructure: your credentials (e-mail address and hashed password) are not transmitted to any third-party provider and do not leave the European Union. Files and media content are stored and delivered via Cloudflare (R2 object storage and delivery network), encrypted at rest.

Processors. For the operation of the Services, we use providers that act on our behalf and under our instructions (processors within the meaning of the GDPR), bound by a data processing agreement (DPA):

• ‍Webflow, Inc. — Hosting of the showcase site, forms, native audience measurement — United States — EU–US DPF and standard contractual clauses
• ‍OVH SAS — Hosting of the application and database — France (EU) — No transfer outside the EU
• ‍Cloudflare, Inc. — Storage of files and data (Cloudflare R2), delivery of media content (media.cygon.tech) and network security — Worldwide network, data encrypted at rest — EU–US DPF and standard contractual clauses
• Brevo SAS — Sending of service-related e-mails (SMTP relay) — France (EU) — No transfer outside the EU
• ‍Cordnet OÜ (Featurebase) — Collection of feedback and user support — European Economic Area (Netherlands, Germany, Ireland) — No transfer outside the EU
• ‍Google (Google Ireland Ltd / Google LLC) — Audience measurement (Google Analytics 4), Search Console, advertising (Google Ads), anti-bot protection (reCAPTCHA) — EU and United States — EU–US DPF and standard contractual clauses
• ‍Microsoft Corporation — Behavioural analysis (Microsoft Clarity) — United States — EU–US DPF and standard contractual clauses

‍

Merchant of record (Paddle). Subscriptions are sold through Paddle (Paddle.com Market Limited, Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom, and Paddle.com Inc. for customers located in the United States), acting as our merchant of record. For the sale of subscriptions, payment processing, subscription billing, invoicing, fraud prevention and tax compliance, Paddle processes your identity, e-mail address, billing address and payment data as an independent controller, for its own purposes and under its own responsibility, in accordance with its privacy policy available at https://www.paddle.com/legal/privacy. Payment card data is entered directly with Paddle and is never stored or processed by INSPYRSTUDIO. Paddle is PCI-DSS certified, the security standard applicable to payment data.

Paddle informs us of the data we need to operate your Subscription: your account e-mail address, the plan subscribed, the status and dates of the Subscription, and the transaction identifiers. We do not receive your payment card data.

Previous payment provider (Stripe). For subscriptions taken out before our migration to Paddle, and until they are migrated, payments are processed by Stripe (Stripe Payments Europe, Ltd — EU and United States, EU–US DPF and standard contractual clauses). Stripe acts as a processor for the payments made on our behalf, and may also act as an independent controller for its own purposes of fraud prevention and compliance with its legal obligations. Stripe is PCI-DSS certified. Once a subscription has been migrated to Paddle, the data held by Stripe is retained only for the period required by Stripe's own legal obligations, and is no longer used to operate your Subscription.

We do not sell or rent your personal data. It may be disclosed to administrative or judicial authorities where required by law.

5. Transfers of data outside the European Union

The application, the database and the authentication services, as well as our providers Brevo and Featurebase, process your data within the European Union or the European Economic Area.

Some other providers (Webflow, Cloudflare, Google, Microsoft, Stripe, Paddle) may process data in the United States. These transfers are governed by:

• the European Commission's adequacy decision of 10 July 2023 regarding the EU–US Data Privacy Framework (DPF), a decision whose validity was upheld by the General Court of the European Union on 3 September 2025, each of these providers being certified under the DPF; and
• as an additional safeguard, the standard contractual clauses adopted by the European Commission.

This twofold mechanism aims to ensure a level of protection of your data equivalent to that guaranteed within the European Union, including in the event that the DPF should evolve.

Our merchant of record Paddle also processes data in the United Kingdom (Paddle.com Market Limited). Transfers to the United Kingdom are covered by the adequacy decisions adopted by the European Commission on 21 December 2025, which replaced the earlier decisions of 28 June 2021.

6. Cookies and trackers

The Site uses cookies, in particular for audience measurement (Google Analytics 4, Microsoft Clarity, Webflow native measurement), advertising (Google Ads) and anti-bot protection (Google reCAPTCHA). Microsoft Clarity records browsing sessions (mouse movements, clicks, pages viewed); by default, sensitive content (passwords, banking details, personal fields) is masked and not collected.

When you open the checkout, our merchant of record Paddle sets its own cookies and similar technologies, which are strictly necessary to process your order and to detect and prevent fraud. These are governed by Paddle's own privacy policy.

Non-strictly-necessary cookies are only set after your consent, obtained via the banner displayed on your first visit, which allows you to accept, refuse or customise them category by category. You can change your choices at any time. Details can be found in our Cookie Policy.

7. Security

INSPYRSTUDIO implements appropriate technical and organisational measures to protect your data: password hashing, management of authentication and access on infrastructure we control (OVH, France), encryption of media content at rest, encrypted communications (HTTPS), restricted access to authorised personnel, and the use of providers offering recognised security guarantees.

8. Your rights

In accordance with the GDPR, you have the following rights over your data:

• ‍Right of access: obtain confirmation that your data is being processed and obtain a copy of it.
• ‍Right to rectification: have inaccurate or incomplete data corrected.
• ‍Right to erasure: request the deletion of your data in the cases provided for by law.
• ‍Right to restriction of processing.
• Right to object</strong> to processing, in particular for direct marketing purposes.
• ‍Right to data portability: receive the data you have provided to us in a structured, commonly used and machine-readable format.
• ‍Right to withdraw your consent at any time, where processing is based on it, without affecting the lawfulness of processing carried out before the withdrawal.
• ‍Right to give directives concerning the fate of your data after your death, where the applicable law provides for this.

To exercise these rights, write to us at support@cygon.tech. We may ask you for proof of identity in the event of reasonable doubt as to your identity. We respond within one month, which may be extended by two months for complex requests.

These rights apply to the data we process as controller. For the data Paddle processes as an independent controller (payment, billing, invoicing, tax compliance), address your request to Paddle, as described in its privacy policy. If you write to us, we will point you to the right place.

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with a data protection supervisory authority, in particular the authority of the country where you habitually reside, where you work, or where the alleged infringement took place. Our lead supervisory authority is the French data protection authority (Commission nationale de l'informatique et des libertés, CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at www.cnil.fr.

9. Changes to this policy

INSPYRSTUDIO may amend this policy to adapt it to legal, regulatory or technical developments. The applicable version is the one published on the Site on the date of your consultation. In the event of a substantial change, we will inform you by an appropriate means.

‍