Privacy Notice.

1. Data controller

AIKKA SAS, registered in France (RCS Paris, SIREN 993 624 816), 39 rue de la Gare de Reuilly, 75012 Paris, operates pharma-geo.com and the PharmaGEO platform. For all data-protection matters: admin@aikka.ai.

2. What data we collect

• Contact data you submit through forms: first name, last name, work email, company, role, and the brand or topic you want us to analyze.
• Usage data from the website: pages visited, timestamps, referrer, anonymized IP, browser, device. Collected via Google Analytics 4 on the public PharmaGEO Index page.
• Account data for app.pharma-geo.com customers: email, name, organization, role, password hash, plan tier, audit history.
• We do not collect special-category personal data. PharmaGEO analyzes public AI answers about pharma brands, not patient-level data.

3. Purposes and legal bases

Purpose	Legal basis	Data
Reply to demo, sample, or playbook requests	Pre-contract / legitimate interest	Contact data
Send the PharmaGEO Playbook PDF	Consent (checkbox)	Email, name, company
Operate the PharmaGEO platform for paying customers	Contract	Account data, audit history
Improve the website and product	Legitimate interest	Usage data
Security, fraud prevention, audit logs	Legitimate interest / legal obligation	IP, timestamps

What this table does not sayPurposes and legal bases only. Retention periods (§5), recipients (§4) and your rights (§6) are set out in the sections below and are not restated here.

4. Who we share data with

• Hosting: Amazon Web Services (AWS). Production servers and databases run in Stockholm, Sweden (eu-north-1); customer account data is stored there, in the EU. Our websites are delivered through Amazon CloudFront. A separate query service runs on AWS in the United States (us-east-1) to query AI assistants from the US; it handles brand questions only and processes no personal data.
• Form processing: Formspree (US, EU SCCs in place).
• Email: Google Workspace, and Resend for transactional email.
• Payments: Stripe. Card payments are handled by Stripe; we never store card numbers.
• Error monitoring: Sentry.
• Analytics: Google Analytics 4.
• LLM providers for product audits: OpenAI, Anthropic (Claude), Google (Gemini), Mistral AI, xAI (Grok) and Perplexity. We never send personal data into these prompts; we only query public information about brands.
• Web search and public web data for product audits: Tavily and Bright Data. No personal data is sent to them.
• We never sell personal data.

5. Retention

• Form submissions: 36 months from last interaction, then deleted or anonymized.
• Customer account and platform data: deleted within 30 days after the end of the contract. Billing records: kept 10 years to meet French accounting obligations.
• Server logs: 12 months.
• Analytics: 14 months for GA4.

6. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interest. You can withdraw consent at any time. Contact admin@aikka.ai. You can also lodge a complaint with the CNIL (cnil.fr).

7. Security

We follow industry-standard practices: TLS 1.2 or higher on all public endpoints, AES-256 encryption at rest for databases and backups, role-based access, MFA enforced on access to our cloud infrastructure (AWS), quarterly access reviews, and a documented incident-response plan, tested at least annually. Personal data breaches are notified to the supervisory authority (CNIL) within 72 hours where the GDPR requires it, and to affected customers without undue delay. Production environments are separated from staging. Vendors are reviewed annually. We are preparing a SOC 2 (Security) audit. Details are on our Security page, and service availability is published on our status page at status.aikka.ai.

8. Data Processing Agreement

For enterprise customers, AIKKA SAS signs a DPA aligned with Articles 28 and 32 of the GDPR, including EU Standard Contractual Clauses for any sub-processor outside the EEA, a sub-processor list, audit rights, and a transfer impact assessment. Personal data breaches are notified to the supervisory authority (CNIL) within 72 hours where the GDPR requires it, and to affected customers without undue delay. To request a DPA: admin@aikka.ai.

9. Cookies and analytics

We use a small number of cookies and similar browser storage.

• Strictly necessary: browser storage that keeps you signed in to the platform and remembers your cookie choice. These do not require your consent.
• Analytics: Google Analytics 4 cookies (_ga and _ga_K63E3RK9ZN), used only on the public PharmaGEO Index page (pharma-geo.com/index) to measure its audience. They are set only if you click "Accept" in the cookie banner. Until you choose, or if you click "Refuse", Google Analytics is not loaded and no analytics cookie is set. These cookies expire after 13 months at most. The signed-in platform does not use Google Analytics.
• Security: our sign-up page uses Google reCAPTCHA to block automated sign-ups. Google may set its own cookies when that page loads.

You can change your choice at any time with the "Cookie settings" link at the bottom of our pages. If you withdraw your consent, we stop Google Analytics and delete its cookies from your browser. We keep your choice for 6 months, then ask again.

10. How to contact us

AIKKA SAS, 39 rue de la Gare de Reuilly, 75012 Paris, France. RCS Paris, SIREN 993 624 816. Privacy and press enquiries: admin@aikka.ai. Security disclosures: security@aikka.ai.