1. Data controller and roles
CINE SERVICES SARLAU, identified in the Legal Notice, determines processing for LeQGC account creation and administration, software access, support and security. When a user independently decides to record details of professional contacts, brands or collaborators in their workspace, that user may determine the purposes of processing those third-party details; CINE SERVICES then supplies the technical service used to store and manage them. Paddle independently processes buyer transactions as reseller in accordance with its own documentation.
2. Personal data categories
Depending on use of the Service, data may include: account identity, email and login identifiers, language and preferences; assigned roles and permissions; workspace information entered by users (brands, professional contact names and email addresses, opportunities, tasks, collaborations, dates, amounts, notes and deliverables); avatars or uploaded files; support requests and technical information needed to operate and protect the Service; subscription and transaction references required to manage access.
Depending on the features used, data may also include: date of birth if entered (optional); the plan, complimentary access granted by the team (dates, plan, reason), referral code, referrals and the related rewards or discounts; the cancellation reason if given (optional); pack purchases (pack, transaction reference, amount, date, accepted terms version and immediate-delivery consent); gear shop clicks; community content and interactions (posts, replies, images, reactions, votes, challenges, reports, blocks, warnings and suspensions); progress data (rank, distinctions, challenges, seasons, recaps viewed, closings completed); email preferences.
Full payment card details are handled through the Paddle seller checkout rather than the LeQGC CRM.
3. Purposes and lawful grounds
Account administration, access rights and workspace functions are processed to provide the requested service. Protection against misuse, security and incident handling rely on applicable legitimate interests or relevant legal obligations. Certain processing is necessary for handling legally required requests. Users entering third-party contact data must have an appropriate legal basis for their own use of those details.
Plans and complimentary access: managing account rights and the portfolio's LeQGC mention, on the basis of performance of the contract. Cancellation reason: improving the service, on the basis of legitimate interest; the answer is optional and cannot be read back from the application.
Customer referral: where the programme is offered, LeQGC records the referral link used, the referrer and the referred person, and the relevant payment information (first payment, withdrawal period, any refund or dispute), so that Paddle, as seller (Merchant of Record), applies the 30% discounts set out in the terms of service (for an annual plan, a fixed amount equal to 30% of three months at the plan's monthly price, deducted from the annual payment): for the referred person from their first payment; for the referrer, earned in full as soon as the referred person's first payment is past their 14-day withdrawal period without a refund, and applied from the referrer's next renewal. The legal basis is performance of the programme, which the referrer joins by sharing their link.
Pack purchases: delivery, licence management, proof of the order and of the immediate-delivery consent, on the basis of performance of the contract and legal obligations.
4. Community, progress and emails
Community: publishing and displaying content to members, on the basis of performance of the contract; moderation, report handling and abuse prevention, on the basis of legitimate interest and legal obligations. The display name (nickname, or first name and initial), avatar and rank, unless the member chooses to hide it, are visible to other members.
Progress (ranks, distinctions, challenges, seasons, monthly recap): these features are computed from the member's activity in their own workspace, on the basis of performance of the contract. Only small markers are stored (for example a recap already viewed, a challenge completed or a season distinction earned). These computations produce no decision with legal effects. Sharing a recap is always the member's own choice, and amounts can be removed from it.
Emails: account and subscription emails (sign-in, renewal reminders, purchase information) rely on performance of the contract and legal obligations. The weekly recap relies on legitimate interest and can be turned off at any time in settings.
Launch waitlist: if you join the waitlist (email address and, if you wish, first name and niche, plus the source of the visit), this data is used only to send you LeQGC's opening email and its launch offers, and for the referral described below. A confirmation email is sent first: only confirmed addresses, or addresses registered with express consent before this confirmation was introduced, receive the opening email. The legal basis is your consent, given by submitting the sign-up form under a notice stating its purpose, and timestamped; you can withdraw it at any time with the one-click unsubscribe link in every email or by writing to confidentialite@leqgc.com. The data is kept until launch and then for six months at most, or until you unsubscribe if that happens first; after an unsubscribe, only a minimal record may be kept so that we do not write to you again. The emails are sent by Resend, as email processor.
Waitlist referral: everyone on the waitlist gets a personal referral link. LeQGC records who referred whom and the confirmation status of each referred sign-up, sends the referrer an email for each confirmed referred sign-up and then an email when five are confirmed, and gives them a private tracking link. The reward is two months of the Pro plan free of charge, once per person. The legal basis is performance of the referral programme, which the person joins by sharing their link; unsubscribing stops these emails. This data is kept with the waitlist data (until launch and then six months at most) or until unsubscribe; records of rewards granted are kept as long as needed for accounting and fraud prevention.
Referral anti-fraud ledger: to prevent a reward from being obtained more than once or a person from referring themselves, LeQGC keeps only a keyed hash (HMAC-SHA-256) of the normalised email address of people who have already received a reward, were counted as referred, or whose account was deleted, never the address itself. The legal basis is legitimate interest in fraud prevention. These hashes are kept for three years and then purged.
5. Shop, packs and brand directory
Gear shop clicks: LeQGC records the member's identifier, the product clicked and the time of the click, to produce statistics on interest in each product and adjust the selection, on the basis of legitimate interest. This data can only be read by authorised team members and is not passed to Amazon. You can object at confidentialite@leqgc.com.
Amazon links: LeQGC sends no personal data to Amazon. The link only contains the product reference and LeQGC's partner identifier. On clicking, the user goes to Amazon's website, which processes their data and uses its own cookies under its own policy, including to attribute the commission. The “Ma liste” saved list stays in the browser and is not sent to LeQGC.
Brand directory (Pro subscribers only): it lists generic contact email addresses that brands themselves publish for business enquiries, collected from their websites and official pages, excluding named personal addresses. This business-to-business processing relies on legitimate interest. A brand or a person concerned may object or ask for an address to be removed at confidentialite@leqgc.com.
Gmail connection (Pro plan, optional): when the subscriber connects their Gmail account, LeQGC only asks Google for permission to send email on their behalf (gmail.send) and for their email address. LeQGC does not read their inbox. Messages leave only after their approval, except payment reminders (D+7, D+15 and D+30 after the due date) when the Pro subscriber has switched on the automatic reminders option themselves: they can switch it off at any time, and reminders stop as soon as the invoice is recorded as paid or the subscriber indicates that the brand has replied. On the basis of performance of the contract, LeQGC keeps an encrypted access token, the connected address and, for each send, the recipient, subject, date, status and Gmail message identifiers, to perform the send and show the send log; the message text is kept only until it is sent. The subscriber can disconnect Gmail at any time from LeQGC or from their Google account: access is then revoked and the token deleted. LeQGC's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy.
ChatGPT and Claude connector (Pro plan, optional): a Pro subscriber can link their LeQGC account to their own ChatGPT (OpenAI) or Claude (Anthropic) assistant. The connection relies on an authorisation (OAuth) that the subscriber grants on a LeQGC page, and only these two applications are accepted. At the subscriber's request, the assistant then reads and changes the data of their own account only (collaborations and deliverables, brands and contacts, invoices and payments, planner, tasks, rates, portfolio, brand directory, scheduled emails without their text), and can schedule an email from the subscriber's Gmail connection to a contact already saved, at least ten minutes ahead and cancellable until it is sent. It cannot delete anything or access the subscription, password, Gmail connection or settings. Data sent in this way to OpenAI or Anthropic, which may process it in the United States, is sent on the subscriber's initiative; these services process it under their own terms and privacy policies. On the basis of the performance of the contract, LeQGC keeps for ninety days a log of each call (assistant, action, date, success or refusal, never the content), which the subscriber can view in Settings. The subscriber can remove access at any time from Settings › Connections or from their assistant.
6. Recipients and processors
Information necessary for the Service is processed by the publisher, by authorised team members according to their permissions, and by technical providers acting on instructions: Cloudflare, Inc. (USA) for hosting and delivering the application; Supabase, Inc. (USA, database configured in Ireland) for the database, authentication and storage; Resend (USA) for sending transactional emails; Zoho Mail (data centre in the European Union) for the @leqgc.com mailboxes; Google for Google sign-in where the user chooses it, for sending some messages through Gmail (in particular forwarding withdrawal requests and, where Resend is unavailable, transactional emails) and for displaying brand website icons (favicons).
Paddle sells subscriptions and packs purchased through its checkout and processes information needed for orders, payments, buyer billing, taxes and refunds under its own Buyer Terms and privacy notice, as a separate controller. For the customer referral, LeQGC shares with Paddle only the information needed to apply the discount. Amazon receives no data from LeQGC. LeQGC does not sell workspace data to advertisers. With the visitor's consent, Google and Meta receive audience-measurement and advertising data (see « Cookies and browser storage »).
7. Processing locations and international access
The project's database is configured in an Irish region. CINE SERVICES operates from Morocco. Certain technical providers, supplementary services or authorised people may process or access personal information from other countries. International data transfer rules apply according to the activities and jurisdictions involved. Database location is not a claim that all data and all access remain exclusively in the European Union.
Several providers are based in the United States or transfer data there (Cloudflare, Supabase, Resend, Google, Meta). Depending on the provider, transfers rely on its participation in the EU–U.S. Data Privacy Framework or on the European Commission's standard contractual clauses included in its data processing terms. Information about these safeguards can be requested at confidentialite@leqgc.com.
8. Retention and erasure
Account and workspace information is processed for as long as necessary to deliver the Service and administer access. Following the end of an access right, workspace information still retained may be accessible through the account recovery portal. Limited records may also be retained when necessary to evidence transactions, comply with legal obligations, maintain security or handle disputes, applying retention criteria proportionate to those purposes.
Community content: it stays online until deleted by its author or by moderation. Deleted content is no longer visible to members; it may be kept with restricted access to handle reports and disputes, and is then erased with the account. Reports and moderation history are kept as long as needed to justify the decisions taken. Shop clicks: kept while the account exists, then erased with it or when the product is removed from the catalogue. Pack purchases: kept for the life of the account and then, in limited form, for the period needed to prove the order and the consent given. Referral: waitlist referral data follows the waitlist retention; records of rewards and discounts granted are kept as long as needed for accounting and fraud prevention; the anti-fraud ledger is purged after three years.
Erasure requests are assessed according to identity, the relevant data category, individuals' rights and applicable exceptions. Backup copies and technical logs may be subject to separate retention and deletion cycles. Please contact support to request export or erasure.
9. Individual rights
Depending on applicable law, individuals may request access, rectification, erasure, restriction, portability or objection, and withdraw consent where processing relies on consent. Requests concerning personal details entered into a user's CRM may require involvement of that user in their capacity as the person determining the processing.
Contact: confidentialite@leqgc.com or support@leqgc.com; https://leqgc.com/support.
Identity checks may be requested where justified; photo identification is not required as a routine condition. Individuals may lodge complaints with a competent supervisory authority where the law provides that right, for example the CNIL in France.
10. Security and automated decision-making
Account authentication and role-based access controls are used to restrict access to workspaces. The Service is not presented as performing automated decisions with comparable legal effects on users. Keyword detection in the community only flags content to the moderation team, which takes the decisions. No IT service can be guaranteed entirely risk-free. Please report suspected unauthorised access to support.