CMspace and MyBoard Privacy Policy

1. Who is responsible

C&J CONSEILS, a French SARL with share capital of €500, SIREN 106 688 476, registered in Rennes (RCS), VAT FR69106688476, 4 rue Paul Féval, 35320 Crevin, France. Managers: Claire Vigneron and Justine Dorel. CMspace is its trade name.

For any question about your data: [email protected], or by post to the address above.

We do not have a data protection officer. Claire and Justine answer personally.

MONTACOMM (SAS, SIREN 935 032 805) provides us with technical support: it holds the developer accounts that connect CMspace to Meta, TikTok, LinkedIn, YouTube, Google Business Profile and Canva.

2. Our two roles

• For your own data (your account, your subscription, our exchanges), C&J CONSEILS is the data controller.
• For the data you upload about your clients (client records, contacts, content, invoices you issue, prospects, appointments), you are the controller. C&J CONSEILS is your processor: we process this data only to run the service, on your instructions, and we never use it for ourselves. The rules are set out in the data processing agreement attached to the Terms of Use. If one of your clients writes to us to exercise their rights, we forward the request to you.

3. The data we use, and why

Prospecting. If we wrote to you to present CMspace or MyBoard, it is because your professional activity is related to what we offer. We found your business contact details in public sources (Google Business Profile, Instagram or LinkedIn profile, company directory). You can object at any time: reply “stop” or write to [email protected], and we will not write to you again.

Email tracking. Our newsletters contain a small image and tracking links that tell us whether the email was opened and which links were clicked. This helps us improve the content. Every email contains an unsubscribe link.

We never sell your data. We do not use it for targeted advertising.

4. Google user data

When you connect a Google account, CMspace only requests the permissions needed for the feature you turn on. Each connection is optional.

• YouTube (youtube.upload, youtube.force-ssl, yt-analytics.readonly): upload to your channel the videos and thumbnails you schedule, read comments and reply to them from CMspace, and display channel statistics in read-only mode.
• Google Calendar, community manager (calendar.events, calendar.freebusy): create, update and cancel in your calendar the appointments booked on your booking page, and read your busy slots so they are not offered.
• Google Calendar, client workspace (calendar.events.readonly, calendar.freebusy): display your events in the MyBoard calendar, read-only. CMspace never writes to a client’s calendar.
• Google Contacts (contacts.readonly, contacts.other.readonly): import, when you ask, the names and email addresses in your address book to build your mailing lists.
• Google Business Profile: read the profile’s information and reviews, and reply to them at your request.

CMspace does not request any access to Gmail and never reads your emails.

CMspace’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This data is not sold, not used for advertising, and not used or transferred to train generalised artificial intelligence models. You can revoke access at any time from your Google account or from CMspace.

In the same way, you can import your Outlook contacts (Microsoft, Contacts.Read permission): only names and email addresses are read.

5. TikTok, Meta, LinkedIn, X and Canva data

When you connect a TikTok account, we access, through the official API, your profile (ID, display name, photo, bio, link, verification status), your statistics (followers, likes, number of videos), the list of your public videos and their statistics, and a token that allows publishing with your approval.

For Facebook, Instagram, LinkedIn, X, YouTube and Canva, the principle is the same: we read what is needed to display your accounts and statistics, and we only publish what you have scheduled or approved.

These platforms then receive the content you publish. They process it under their own rules. You can disconnect each account from CMspace (“Disconnect” button) or from the platform’s settings. The token is then deleted.

6. Artificial intelligence

Some text and content is processed by AI tools to help you write (captions, emails, articles, quotes), analyse a website or statistics, moderate the community space, transcribe a video or a dictation, and create images:

• Anthropic (Claude) for writing, analysis and moderation;
• OpenAI for video transcription (Whisper) and image generation;
• Groq for voice dictation.

AI is only used when you start the feature. We only send it what the request needs. We use these providers’ business offerings (API). Their terms state that this data is not used to train their models. It may be kept for a while on their side for security and abuse detection, then deleted after a limited period set by their terms. Always reread AI-generated text before publishing it.

Avoid sending sensitive data about your clients to the AI (health, opinions, etc.).

7. Who receives the data

Claire and Justine, and only when useful. Our chartered accountant, for invoices.

And our technical providers, who act on our behalf:

If you use SMS sending, it goes through your own Twilio account, which you connect yourself.

We may also disclose data where the law requires it (a request from a judicial authority, for example).

8. Transfers outside the European Union

Your data is stored in the European Union. Some providers are based in the United States and may access or process data there. These transfers are covered:

• by the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) when the provider is certified under it;
• otherwise, by the European Commission’s standard contractual clauses, included in each provider’s contract.

You can ask us for a copy of these safeguards at [email protected].

9. Cookies and trackers

cmspace.app uses no advertising cookies and no social network trackers. We therefore do not ask for your consent.

What we do use:

• sign-in cookies, essential to stay signed in to your workspace;
• the “trusted device” cookie, if you choose it with two-factor authentication;
• preferences stored in your browser (language, display);
• cookieless audience measurement on the public website: our own tool, which keeps a random number for the life of the tab (it disappears when the tab is closed), and Vercel Web Analytics, which sets no cookie. Neither stores your IP address or follows you across other websites. Application pages (your workspace) are not measured.

When you pay, the Stripe or PayPal payment page may set its own cookies, needed for payment security. Some pages show a YouTube video in “privacy-enhanced” mode (youtube-nocookie.com): YouTube may store information in your browser when you start the video.

Google Analytics was removed from cmspace.app on 5 October 2026.

10. Security

Here is what we have actually put in place:

• all connections are encrypted (HTTPS, with HSTS);
• the database and files are encrypted at rest by our host (Supabase, on AWS, in the European Union);
• data is isolated per account: access rules in the database prevent one account from reading another account’s data;
• access tokens for social networks and Google stay on the server and are never sent to the browser;
• two-factor authentication is available (authenticator app or passkey). We recommend turning it on;
• the email address is confirmed at sign-up;
• a full backup of the database is made every day by our host and kept for 7 days.

No system is perfect. If a breach of your data occurred, we would follow our procedure: notify the CNIL within 72 hours where the law requires it, and inform you directly if the risk to you is high. For your clients’ data, we inform you without delay, within 48 hours at the latest.

11. Your rights

At any time, you can:

• access your data and get a copy of it;
• rectify it;
• erase it;
• object to its use, in particular to prospecting and newsletters;
• restrict its use during a verification;
• retrieve it in a readable format (portability);
• withdraw your consent (newsletters, calendar): every email contains an unsubscribe link;
• give instructions on what happens to your data after your death.

Write to [email protected]. We reply within one month. We may ask you to prove your identity if we have a doubt.

Deleting your account: from your settings, or by email. We erase your data within 30 days. Only invoices remain, for the period required by law (10 years).

If you believe your rights are not being respected, you can lodge a complaint with the CNIL (the French data protection authority): www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

12. Minors

CMspace and MyBoard are professional tools. They are not intended for people under 15.

13. Changes

If this policy changes, we update the date at the top of the page. For a significant change, we will let you know by email.