GDPR

Privacy policy.

Confidentiality is not a promise: it is a structural constraint of the platform.

Data controller

Brainmood, SAS, 16 rue Cuvier, 69006 Lyon, represented by its founding team.

Personal data contact: contact@brainmood.fr

The founding principle: no individual reading

Responses collected via the Brainmood platform are pseudonymous, with no nominative profile. Readouts are exclusively aggregated, above a minimum threshold: no individual reading, neither for the employer nor for Brainmood.

  • Pseudonymous collection : no nominative profile is created during measurement campaigns.
  • Anti-reidentification thresholds : no result is displayed below the defined threshold. This threshold reduces reidentification risk without, by itself, guaranteeing protection against every form of cross-referencing.
  • Confidentiality of support work : no individual information is shared with the client company's management without the explicit consent of the person concerned.

Data collected via the site

  • Contact form : last name, first name, work email address, company, position, message.
  • Application form : last name, first name, email address, phone, résumé, cover letter, message.
  • Toolkit access : email address and selected language, to provide access to protected files and send the access link or related transactional messages. An internal administrative notification is also sent to process the request; access is kept in a cookie for up to 30 days; no marketing subscription is created.
  • Technical and navigation data : request, browser and page-view information used for security, traffic measurement and performance; see the Cookies section below.

Purposes and legal bases

  • Consent (art. 6.1.a GDPR) : contact and application forms; Google measurement cookies allowed through the banner.
  • Legitimate interest (art. 6.1.f) : site security, spam protection.
  • Pre-contractual measures (art. 6.1.b) : processing requests with a view to possible support work.

Recipients and processors

The Brainmood team handles requests received through the forms. Technical services involved include Vercel (hosting, traffic and performance), Resend (transactional emails) and Google (tag management and traffic measurement). These services may process data outside the European Economic Area. Contact us for details of recipients and applicable contractual safeguards.

Retention periods

  • Contact data : 3 years from the last contact.
  • Application data : 2 years from receipt, unless you object.
  • Technical data (IP) : 12 months maximum.

Beyond these periods, data is deleted or irreversibly anonymized.

Your rights (articles 15 to 22 of the GDPR)

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time. To exercise them: contact@brainmood.fr (reply within 30 days).

Complaints may be lodged with the CNIL : 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 · 01 53 73 22 22 · cnil.fr

Cookies and site measurement

Google Analytics, loaded through Google Tag Manager, measures traffic and journeys on this site. Measurement cookies are denied by default and allowed after you agree. Journey events added by Brainmood cover calls to action, downloads, form starts and confirmed submissions. They send only predefined categories: no name, email, company or form text is included in these events.

Google Tag Manager loads when the site opens. In the advanced consent mode used here, Google may receive technical signals without measurement cookies before you agree or after you decline, such as consent status, timestamps, browser information and the referring page. Declining cookies therefore does not block all communication with Google. Advertising storage, advertising data use and ad personalization remain denied.

Vercel Web Analytics measures traffic and Speed Insights measures loading performance. These tools operate separately from the Google cookie choice and may send technical and navigation information to Vercel even when you decline Google cookies.

Your choice is stored in browser local storage under brainmood_cookie_consent; its status is communicated to Google to adjust its tags. ‘Manage cookies’ in the footer of every page reopens preferences and lets you decline after accepting. Withdrawal applies to future collection and does not erase measurements already sent.

If your browser prevents the choice from being saved, Google measurement with cookies remains denied for the current page and a message explains this. To also remove existing cookies or stored preferences, use your browser settings.

For details of the settings and retention periods currently applied to traffic and performance measurements, contact contact@brainmood.fr.

Service documentation: Google Consent Mode · Vercel Web Analytics · Vercel Speed Insights.

CNIL: withdrawing cookie consent (in French).

Data security

  • Encrypted communications (HTTPS/TLS)
  • Security headers (CSP, HSTS, X-Frame-Options)
  • Request rate limiting
  • Validation and sanitization of user input
  • Data access restricted on a need-to-know basis

Updates

Brainmood reserves the right to modify this policy at any time. The online version prevails. Last updated: September 8, 2026.