Privacy Notice.

1. Data controller

AIKKA SAS, registered in France (RCS Paris, SIREN 993 624 816), 39 rue de la Gare de Reuilly, 75012 Paris, operates pharma-geo.com and the PharmaGEO platform. For all data-protection matters: admin@aikka.ai.

2. What data we collect

• Contact data you submit through forms: first name, last name, work email, company, role, and the brand or topic you want us to analyze.
• Usage data from the website: pages visited, timestamps, referrer, anonymized IP, browser, device. Collected via Google Analytics 4 and ContentSquare on a privacy-compliant configuration.
• Marketing data: a LinkedIn Insight Tag is loaded after consent to measure ad performance.
• Account data for app.pharma-geo.com customers: email, name, organization, role, password hash, plan tier, audit history.
• We do not collect special-category personal data. PharmaGEO analyzes public AI answers about pharma brands, not patient-level data.

3. Purposes and legal bases

Purpose	Legal basis	Data
Reply to demo, sample, or playbook requests	Pre-contract / legitimate interest	Contact data
Send the PharmaGEO Playbook PDF	Consent (checkbox)	Email, name, company
Operate the PharmaGEO platform for paying customers	Contract	Account data, audit history
Improve the website and product	Legitimate interest	Usage data
Marketing analytics (LinkedIn Insight Tag)	Consent	Pseudonymous IDs
Security, fraud prevention, audit logs	Legitimate interest / legal obligation	IP, timestamps

4. Who we share data with

• Hosting: AWS (Frankfurt, eu-central-1) and Cloudflare (EU edge). Data stays in the EU.
• Form processing: Formspree (US, EU SCCs in place).
• Email: Google Workspace and a transactional sender for the Playbook PDF (EU-based when possible).
• Analytics: Google Analytics 4 (anonymize IP enabled), ContentSquare (EU), LinkedIn Insight Tag (consent gated).
• CRM: HubSpot (EU data residency).
• LLM providers for product audits: OpenAI, Anthropic, Google DeepMind, Perplexity. We never send personal data into these prompts; we only query public information about brands.
• We never sell personal data.

5. Retention

• Form submissions and CRM contacts: 36 months from last interaction, then deleted or anonymized.
• Customer account data: duration of contract + 5 years for legal and accounting purposes.
• Server logs: 12 months.
• Analytics: 14 months for GA4, 13 months for ContentSquare.

6. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interest. You can withdraw consent at any time. Contact admin@aikka.ai. You can also lodge a complaint with the CNIL (cnil.fr).

7. Security

We follow industry-standard practices: TLS 1.3 in transit, AES-256 at rest, encrypted backups, role-based access, MFA mandatory on admin tools, quarterly access reviews, and a documented incident-response plan with 72-hour breach notification. Production environments are separated from staging. Vendors are reviewed annually. PharmaGEO is built to be SOC 2 ready, with a roadmap to ISO 27001.

8. Data Processing Agreement

For enterprise customers, AIKKA SAS signs a DPA aligned with Articles 28 and 32 of the GDPR, including EU Standard Contractual Clauses for any sub-processor outside the EEA, a sub-processor list, audit rights, breach notification within 72 hours, and a transfer impact assessment. To request a DPA: admin@aikka.ai.

9. Cookies and analytics

We use a small number of cookies: a strictly necessary session cookie, GA4 with anonymized IP, ContentSquare for UX analytics, and a LinkedIn Insight Tag loaded only after explicit consent. You can refuse non-essential cookies via the consent banner without losing access to the site.

10. How to contact us

AIKKA SAS, 39 rue de la Gare de Reuilly, 75012 Paris, France. RCS Paris, SIREN 993 624 816. All enquiries (privacy, security disclosures, press): admin@aikka.ai.