Privacy Policy

Last updated: 19 June 2026

INSPYRSTUDIO places great importance on protecting your personal data. This policy explains what data we collect when you use the website cygon.tech and the Cygon software (hereinafter "the Services"), why we collect it, how long we keep it and what your rights are. It is drawn up in accordance with Regulation (EU) 2016/679 (GDPR) and French Act No. 78-17 of 6 January 1978 known as the "Informatique et Libertés" (Data Protection) Act.

1. Data controller

The controller of your data is:

INSPYRSTUDIO, a SAS with a share capital of €80,000, registered with the Chambéry Trade and Companies Register under number 101 208 809, whose registered office is at Savoie Technolac, 19 boulevard Mer Caspienne, 73370 Le Bourget-du-Lac, France.
For any question regarding your personal data: contact@cygon.tech.
‍INSPYRSTUDIO has not appointed a Data Protection Officer (DPO), as this is not mandatory given the nature of its activities.

2. Data we collect and purposes

We only collect the data necessary for the purposes described below. Each processing operation is based on a legal basis within the meaning of Article 6 of the GDPR.

Purpose	Data collected	Legal basis	Retention period
Account creation and management, authentication, access to the Cygon software	Name or pseudonym, e-mail address, password (stored in hashed form), technical session and connection data	Performance of the contract (Terms of Use of the Services)	For the entire duration of the account; deletion no later than 3 years after the last activity on the account. Connection logs are kept for 12 months.
Sending service-related e-mails (confirmation, password reset, notifications)	E-mail address	Performance of the contract	For the duration of the account
Subscription and payment management	Identity, e-mail address, billing data. Bank card data is processed directly by our payment provider and is never stored by INSPYRSTUDIO (see § 4)	Performance of the contract and compliance with legal obligations (accounting and tax)	Billing data: 10 years (Article L.123-22 of the French Commercial Code)
Responding to requests, collecting feedback and user support	Name or pseudonym, e-mail address, content of messages and feedback	Legitimate interest (assistance and improvement of the Services)	3 years from the last contact
Audience measurement and improvement of the Services	Browsing data, pages viewed, device type, session identifiers, and — for Microsoft Clarity — mouse movements, clicks and session recordings in which sensitive content is masked (see § 6)	Consent (non-essential cookies)	Audience measurement data: 25 months maximum
Security of the Services, protection against bots and fraud	IP address, connection logs, technical browsing data (notably via the CAPTCHA service, see § 4)	Legitimate interest (information system security)	12 months

‍

These periods are based on the recommendations of the CNIL, compliance with which gives rise to a presumption of conformity.

3. Mandatory or optional nature of the data

Data markedas mandatory in our forms is necessary to provide the relevant service (for example, an e-mail address is essential to create an account). Without it, we will not be able to process your request. Other data is optional.

4. Hosting, authentication and recipients of your data

Your data is intended solely for the authorised departments of INSPYRSTUDIO.

Hosting and authentication. The Cygon application and its database are hosted on our own servers, operated by OVH in France (European Union). Account and authentication management is carried out by us, on this same infrastructure: your credentials (e-mail address and hashed password) are not transmitted to any third-party provider and do not leave the European Union. Files and media content are stored and delivered via Cloudflare (R2 object storage and delivery network), encrypted at rest.

Processors. For the operation of the Services, we use providers that act on our behalf and under our instructions (processors within the meaning of the GDPR), bound by a data processing agreement (DPA):

Provider	Role	Data location	Framework for transfers outside the EU
Webflow, Inc.	Hosting of the showcase site, forms, native audience measurement	United States	EU–US DPF and standard contractual clauses
OVH SAS	Hosting of the application and database	France (EU)	No transfer outside the EU
Cloudflare, Inc.	Storage of files and data (Cloudflare R2), delivery of media content (media.cygon.tech) and network security	Worldwide network, data encrypted at rest	EU–US DPF and standard contractual clauses
Brevo SAS	Sending of service-related e-mails (SMTP relay)	France (EU)	No transfer outside the EU
Cordnet OÜ (Featurebase)	Collection of feedback and user support	European Economic Area (Netherlands, Germany, Ireland)	No transfer outside the EU
Google (Google Ireland Ltd / Google LLC)	Audience measurement (Google Analytics 4), Search Console, advertising (Google Ads), anti-bot protection (reCAPTCHA)	EU and United States	EU–US DPF and standard contractual clauses
Microsoft Corporation	Behavioural analysis (Microsoft Clarity)	United States	EU–US DPF and standard contractual clauses
Stripe (Stripe Payments Europe, Ltd)	Payment and billing processing	EU and United States	EU–US DPF and standard contractual clauses

‍

Stripe acts as a processor for the processing of payments made on our behalf; it may also act as an independent controller for its own purposes of fraud prevention and compliance with its legal obligations. Stripe is PCI-DSS certified, the security standard applicable to payment data.
We do not sell or rent your personal data. It may be disclosed to administrative or judicial authorities where required by law.

5. Transfers of data outside the European Union

The application, the database and the authentication services, as well as our providers Brevo and Featurebase, process your data within the European Union or the European Economic Area.

Some other providers (Webflow, Cloudflare, Google, Microsoft, Stripe) may process data in the United States. These transfers are governed by:

the European Commission's adequacy decision of 10 July 2023 regarding the EU–US Data Privacy Framework (DPF) — a decision whose validity was upheld by the General Court of the European Union on 3 September 2025 — each of these providers being certified under the DPF; and as an additional safeguard, the standard contractual clauses adopted by the European Commission.

This twofold mechanism aims to ensure a level of protection of your data equivalent to that guaranteed within the European Union, including in the event that the DPF should evolve.

6. Cookies and trackers

The Site uses cookies, in particular for audience measurement (Google Analytics 4, Microsoft Clarity, Webflow native measurement), advertising (Google Ads) and anti-bot protection (Google reCAPTCHA). Microsoft Clarity records browsing sessions (mouse movements, clicks, pages viewed); by default, sensitive content (passwords, banking details, personal fields) is masked and not collected.

Non-strictly-necessary cookies are only set after your consent, obtained via the banner displayed on your first visit, which allows you to accept, refuse or customise them category by category. You can change your choices at any time. Details can be found in our Cookie Policy.

7. Security

INSPYRSTUDIO implements appropriate technical and organisational measures to protect your data: password hashing, management of authentication and access on infrastructure we control (OVH, France), encryption of media content at rest, encrypted communications (HTTPS), restricted access to authorised personnel, and the use of providers offering recognised security guarantees.

8. Your rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights over your data:

‍Right of access: obtain confirmation that your data is being processed and obtain a copy of it.‍
Right to rectification: have inaccurate or incomplete data corrected.‍
Right to erasure: request the deletion of your data in the cases provided for by law.‍
Right to restriction of processing.‍
Right to object to processing, in particular for direct marketing purposes.‍
Right to data portability: receive the data you have provided to us in a structured, commonly used and machine-readable format.‍
Right to withdraw your consent at any time, where processing is based on it, without affecting the lawfulness of processing carried out before the withdrawal.‍
Right to give directives concerning the fate of your data after your death.

To exercise these rights, write to us at contact@cygon.tech. We may ask you for proof of identity in the event of reasonable doubt as to your identity. We respond within one month, which may be extended by two months for complex requests.

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the French data protection authority (Commission nationale de l'informatique et des libertés, CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at www.cnil.fr.

9. Changes to this policy

INSPYRSTUDIO may amend this policy to adapt it to legal, regulatory or technical developments. The applicable version is the one published on the Site on the date of your consultation. In the event of a substantial change, we will inform you by an appropriate means.

‍