Legal
Last updated: 22 August 2026 · Applies to actcovered.com and the ActCovered application.
1. Legal Notice (Mentions légales)
Publisher. ActCovered is published by EZIOM, a French simplified joint-stock company (société par actions simplifiée — SAS), registered in France under SIREN 922 234 216, with its registered office at 200 rue de la Croix Nivert, 75015 Paris, France.
Publication director. Hugo Morales — contact: hello@actcovered.com.
Hosting. The site and the application are hosted by Hostinger International Ltd, 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, on shared hosting with servers located in France — www.hostinger.fr. Your compliance file is stored in a MySQL database on that hosting.
Intellectual property. All content on this site (texts, design, wordmark, software) is the property of the publisher unless stated otherwise. Any reproduction without prior written consent is prohibited. The documents ActCovered generates for you — your register, policy and binder — are yours.
2. Privacy Policy
We build a compliance product; we hold ourselves to the standard we sell. This policy describes how we process personal data under Regulation (EU) 2016/679 (“GDPR”).
2.1 Data controller
EZIOM SAS (details above) is the controller for the processing described below. Contact for all privacy matters: hello@actcovered.com. We have not appointed a Data Protection Officer; the publication director handles these requests personally.
2.2 What we collect, why, on what legal basis, and for how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account email address, company name | Authentication by sign-in link, account management, service email | Performance of the contract (Art. 6(1)(b)) | Until you delete your account, then erased within 30 days |
| Compliance file content — AI register, usage policy, training log with the employee names and roles you enter, evidence events | Providing the service | Performance of the contract (Art. 6(1)(b)); for your employees' data we act as your processor | Until you delete the record or the account, then erased within 30 days |
| Sign-in tokens | Letting you sign in without a password | Performance of the contract | The token expires within minutes and is single-use; expired rows are deleted |
| Readiness Check: email address, the five answers, the resulting score and status, referring page, a SHA-256 hash of your IP address | Sending you the report you asked for, and following up about ActCovered; the IP hash is used only to detect abuse of a public form | The report is sent because you asked for it: you typed your address and pressed “Email my report” (Art. 6(1)(b), steps taken at your request). The follow-up afterwards rests on legitimate interest (Art. 6(1)(f)) in business-to-business prospecting, and so does the IP hash, for preventing abuse of a public form. You can object to the follow-up in one click from any message, and we stop permanently. | 12 months after your last contact with us, then deleted automatically |
| Billing data — name, billing address, VAT number, invoices (card details are handled by Stripe and never reach our servers) | Payments, invoicing, accounting | Contract, and legal obligation (Art. 6(1)(c)) | 10 years for accounting records, as French law requires |
| Server and email logs | Security, debugging, delivery troubleshooting | Legitimate interest (Art. 6(1)(f)) | 12 months maximum |
| Suppression list — a SHA-256 hash of the email address of anyone who asked not to be emailed | Making sure an unsubscribe stays honoured | Legal obligation and legitimate interest | Kept indefinitely, because forgetting it would undo the request. The address itself is not stored, only the hash. |
We do not store your IP address in readable form anywhere in the product. We do not sell data, and we do not share it for advertising.
Your team's data. When you add employees to your training log, you are the controller and we are your processor: we process those records only on your instructions, to run the service. The terms of that relationship are set out in our Data Processing Agreement, which you can read and print without asking us for it.
2.3 Processors and international transfers
We keep a deliberately short list, and we publish it with the date it was last changed on the sub-processor page. In summary:
- Hostinger International Ltd (Cyprus) — Web hosting and the MySQL database that stores your compliance file · France (EU).
- Stripe Payments Europe, Ltd (Ireland) — Payments, invoicing and the customer billing portal · Ireland (EU), with group transfers under Standard Contractual Clauses.
- Brevo SAS (France) — Transactional and product email — sign-in links, receipts, readiness reports · France (EU).
- Plausible Insights OÜ (Estonia) — Audience measurement on the public site · Germany (EU).
Personal data is stored and processed in the European Union. Where a processor's group companies outside the EU may access data in support (Stripe is the practical case), that access is covered by the European Commission's Standard Contractual Clauses and the processor's own supplementary measures. We do not use Supabase; an earlier version of this site did, and that dependency has been removed along with the data it held.
2.4 Cookies and similar technologies
We use no advertising cookies, no cross-site trackers and no consent banner, because there is nothing to consent to on the public site.
- The session cookie. When you request a sign-in link and follow it, we set one first-party session cookie (
ext-actcovered-ehvsia-session). It contains an opaque session identifier — not your email, not your data — and it is what keeps you signed in as you move between pages. It is HttpOnly, SameSite=Lax and, in production, Secure. It expires after 2 hours of inactivity, or when you sign out. This is a strictly necessary cookie: the application cannot work without it, so no consent is required, and refusing it means you cannot sign in. - The CSRF cookie. A companion first-party cookie holds the token that proves a form was submitted from our own pages. Same lifetime, same strict necessity.
- The sign-in link itself. The link we email is a single-use token in the URL, not a cookie. It expires within minutes and stops working after one use.
- Partner attribution. If — and only if — you arrive through a partner link carrying
?aff_click=or?ref=, those two values are kept in first-party cookies for 30 days so we can credit the partner if you later buy. They contain no profile and are never read by any other site. Clearing your cookies removes them. - Analytics. Audience measurement is Plausible, hosted in the EU: no cookies, no fingerprinting, no personal data, and nothing that follows you to another site.
2.5 Your rights, and where to exercise them
You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent at any time. For an ActCovered account, three of them are built into the product rather than being a promise:
- Access (Art. 15) and portability (Art. 20). Your account page has a “download my data” export: every record we hold for your account — profile, AI register, policy versions, training log, evidence events, billing summary — in a structured, machine-readable file, immediately and without asking us.
- Erasure (Art. 17). The same page deletes your account and everything in it. The deletion is real: your file, your register, your policies and your training records are removed, and anything held in a backup rotates out within 30 days. The account record itself is stripped of every personal field and closed. We keep only what accounting law requires — invoices, detached from you and keyed to a one-way hash of your address rather than the address itself.
- Rectification (Art. 16). Everything in your file is editable in place, including your email address.
For the rights we cannot put behind a button — restriction, objection, or any request about a Readiness Check submitted without an account — email hello@actcovered.com and we will answer within 30 days. If you took the Readiness Check and want your row deleted or your address suppressed, say so and we will do both.
You may also lodge a complaint with the CNIL (cnil.fr), or with the supervisory authority of your own country.
2.6 Security
Traffic is encrypted with TLS. Passwords do not exist here — authentication is by single-use, short-lived email link, which removes the entire category of leaked-password incidents. Access to the production database is limited to the publication director. Our technical and organisational measures are described in full in Annex 2 of the DPA, and we tell you about a personal data breach without undue delay, as Articles 33 and 34 require.
3. Terms of Service
3.1 The service
ActCovered provides software tooling to help organisations document their use of AI systems in connection with Regulation (EU) 2024/1689 (the “EU AI Act”), as amended by Regulation (EU) 2026/1744: an AI register, a policy generator, a training log and evidence exports. ActCovered provides compliance tooling and document templates, not legal advice. Using the service does not by itself make you compliant with any law, and we make no representation that it does; for a binding interpretation, consult a qualified lawyer.
3.2 Accounts and acceptable use
The service is intended for business use. Authentication is by email link, so keeping access to your mailbox secure is your responsibility, as is the accuracy of what you record. You agree not to use the service unlawfully, not to attempt to access another customer's file, and not to resell access without our agreement.
3.3 Plans, billing, cancellation
Prices are shown on the pricing page and exclude VAT, which Stripe computes at checkout. The monthly plans are billed in advance and can be cancelled at any time from the billing portal in the app; cancellation takes effect at the end of the period you have already paid for, without a refund for that period. The Compliance Dossier is a one-off purchase that does not expire. The done-for-you audit is a one-off service delivered within 10 business days of the intake session, with 4 slots a month so the promise stays deliverable. Prices may change with 30 days' notice; a change never applies to a period you have already paid for.
3.4 Withdrawal
The service is reserved for professionals, so the consumer right of withdrawal does not apply as a matter of course. There is one exception, in articles L.221-3 and L.221-18 of the French Consumer Code: a professional with five or fewer employees, contracting for something outside their main field of activity, has the same fourteen-day right of withdrawal a consumer would have.
If that is you: the fourteen days run from the day the contract is concluded for a service, and from the day you receive the goods for anything delivered. To exercise it, write to hello@actcovered.com saying unambiguously that you are withdrawing — any wording does, and you do not have to give a reason. We refund within fourteen days of being told, by the same means you paid.
The one case where it stops applying, because article L.221-28 1° says so and because it would otherwise be a way to take a document and keep it for nothing: if you ask us to begin before the fourteen days are up and you acknowledge expressly that you will lose the right of withdrawal once the service is fully performed, then once we have fully performed it, it is gone. In practice that means downloading the Compliance Dossier's unwatermarked export, or holding the delivered audit file. Starting the work without finishing it does not do that — you still withdraw, and you owe us only the proportion already performed.
3.5 Availability and liability
We aim for high availability but do not guarantee uninterrupted service. To the maximum extent permitted by law, our total liability is capped at the amounts you paid us in the twelve months preceding the claim, and we are not liable for indirect damages — including regulatory fines, which follow from your own compliance decisions and not from our software.
3.6 Termination
You may delete your account at any time from your account page. We may suspend an account for abuse, non-payment or unlawful use, with notice where practicable. On termination your data is erased within 30 days, except what we must keep by law; export it first — the export button is on the same page.
3.7 Governing law
These terms are governed by French law. Any dispute that cannot be resolved amicably falls under the jurisdiction of the courts of the publisher's registered office.