Privacy & Cookies

1. Introduction

Muca is a brand operated by atelier re-facto SAS ("we", "us", or "our"), a company incorporated under the laws of France. We are committed to protecting your personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, or "GDPR") and the French Data Protection Act (Loi Informatique et Libertés of 6 January 1978, as amended).

This Privacy & Cookies Policy explains how we collect, use, store, and share your personal data when you visit our website (muca.tech) or interact with our services.

2. Data controller

The data controller responsible for your personal data is:

We have not appointed a Data Protection Officer (DPO) as we are not required to do so under Article 37 of the GDPR. For any question regarding the processing of your personal data, you may contact us at the address above.

3. Data we collect

We may collect the following categories of personal data:

• Contact information — name, contact address, company name, and application type, provided when you submit our contact form.
• Usage data — pages visited, time spent on pages, browser type, device information, approximate location, and truncated IP address, collected automatically through cookies and similar technologies.
• Communication data — content of messages you send us through our contact form or other direct contact channels.

We do not knowingly collect personal data from children under the age of 15 (the age of digital consent in France). We do not carry out any automated decision-making or profiling that produces legal effects concerning you.

4. Legal basis for processing

Under Article 6 of the GDPR, we process your personal data based on the following legal grounds:

• Consent (Art. 6(1)(a)) — for non-essential cookies, analytics, and marketing communications.
• Legitimate interest (Art. 6(1)(f)) — for the security of our website and the prevention of fraud or abuse.
• Contractual necessity (Art. 6(1)(b)) — to respond to your inquiries and provide the services you request.
• Legal obligation (Art. 6(1)(c)) — where processing is required to comply with applicable law (e.g., accounting, responding to lawful requests from public authorities).

5. How we use your data

We use the personal data we collect to:

• Respond to your inquiries and provide customer support.
• Improve and optimize our website performance and user experience.
• Analyze website traffic and usage patterns (subject to your consent).
• Comply with legal obligations and protect our legitimate interests.
• Send you information about our products and services, where you have given consent.

6. Cookies & tracking technologies

Cookies are small text files placed on your device when you visit our website. In accordance with Article 82 of the French Data Protection Act and the guidelines of the CNIL, we request your consent before placing any non-essential cookie.

You can withdraw or change your cookie preferences at any time through the cookie banner or your browser settings. You can also opt out of Google Analytics by installing the official browser add-on available at tools.google.com/dlpage/gaoptout. Please note that disabling strictly necessary cookies may affect the functionality of our website.

7. Data sharing & international transfers

We do not sell your personal data. We may share your data with trusted third-party service providers acting as processors on our behalf:

• Hosting — OVH SAS (France), which stores and serves the website infrastructure.
• Analytics — Google Ireland Limited (Ireland), which provides Google Analytics, subject to your consent.

These providers are contractually bound by a data processing agreement (Art. 28 GDPR) to process your data only on our documented instructions. We may also disclose your data where required by law, by court order, or to protect our rights.

Where your data is transferred outside the European Economic Area (EEA), we rely on appropriate safeguards under Chapter V of the GDPR, including EU Standard Contractual Clauses (SCCs), adequacy decisions of the European Commission, or the EU–US Data Privacy Framework.

8. Data retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Contact form submissions and related correspondence: up to 3 years after our last interaction, for commercial prospection purposes (CNIL recommendation).
• Analytics data: up to 13 months (CNIL maximum recommendation).
• Consent records: up to 3 years, to prove our compliance.
• Data required by law (e.g., accounting): for the duration required by the applicable statute.

9. Data security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These include HTTPS encryption in transit, restricted access on a need-to-know basis, and regular review of our security practices. No method of transmission over the Internet is, however, 100% secure.

10. Your rights

Under the GDPR and the French Data Protection Act, you have the following rights regarding your personal data:

• Right of access — obtain a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data ("right to be forgotten").
• Right to restriction — request limited processing of your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interest or direct marketing.
• Right to withdraw consent — withdraw consent at any time, without affecting the lawfulness of prior processing.
• Right to define directives — give us instructions regarding the fate of your personal data after your death, in accordance with Article 85 of the French Data Protection Act.

To exercise any of these rights, contact us at muca.tech/contact. We will respond within one month, as required by Article 12 of the GDPR. We may ask you to provide proof of identity before acting on your request.

If you consider that the processing of your data infringes the GDPR, you have the right to lodge a complaint with the French data protection authority (CNIL — 3 place de Fontenoy, 75007 Paris, www.cnil.fr) or with the supervisory authority of your habitual residence.

11. Updates to this policy

We may update this Privacy & Cookies Policy from time to time to reflect changes in our practices or applicable law. We will post the updated policy on this page with a revised "Last updated" date. We encourage you to review this policy periodically.

12. Legal notice (Mentions légales)

In accordance with Article 6 of the French Act n° 2004-575 of 21 June 2004 for confidence in the digital economy (LCEN), users of the muca.ai website are informed of the identity of the parties involved in its creation and follow-up.

Website editor

Director of publication

Hosting provider