Data protection

Privacy policy

Version of 27 October 2026.

This policy explains what data massatis.com and our Instagram, TikTok and Facebook accounts collect, why, who it is shared with and what your rights are. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

Controller

Antoine Delalande, Massatis (sole proprietorship being set up), 8 impasse de la Pêcherie, 74200 Anthy-sur-Léman, France — contact@massatis.com.

Data we collect

  • Signing up for the presentation: your email address and, if you give it, your first name.
  • Applying for the training: first name, email, phone (optional), professional background, how far you have watched the presentation, location and motivation, and whether someone referred you (yes or no) and, if so, your referrer's name or code.
  • Requesting a quote: company, name or role, email, phone (optional), headcount, preferred period and message.
  • Booking a call: the information requested by Calendly's booking calendar, embedded in our booking page, including your name, your email, your phone number and the time slot you choose. So that you don't have to type them again, the calendar also receives the first name and email given in your application, and the name of the campaign that brought you (utm_* parameters).
  • With every form: the language, the page, the referral code and campaign parameters if any, and your consent, with its version and date.
  • Conversation with Gamsi, the website's assistant, if you accept it: your questions and its answers, the page, the language, a random visit identifier and your consent, with its version and date; if you ask to talk to the team, your first name, your email or phone number and your message.
  • On our Instagram, TikTok and Facebook accounts: your username and public profile, your comments and messages and, on Instagram, the keyword you write (for example PEAU or SOIN) to receive a link by private message. These networks also give us aggregated statistics about the audience of our accounts.
  • Technical logs from the hosting provider, which include your IP address.
  • Audience measurement, if you accept it: pages viewed, scrolling and videos watched, where the visit came from (campaign parameters), the type of device and browser, and the approximate city; your IP address is used by Google to locate the city and is not kept. Never your name, your email or your referral code.

Please do not write any health information in the free-text fields, in the conversation with Gamsi, or in a comment or message on our accounts: they are not meant for it, and a comment is public. If you do so anyway, we do not copy that information into our tracking files or internal notifications, and may delete the comment to protect you.

Why, and on what basis

  • Sending you access to the presentation and a few emails about the training: your consent, which you can withdraw at any time through the unsubscribe link in every email.
  • Handling your application, quote request or call, and following up: the pre-contractual steps you ask for. An application does not sign you up to any promotional email.
  • Replying to your comments and messages on our accounts, and sending you by private message the link you ask for with a keyword: our legitimate interest in replying to people who write to us. Writing a keyword does not sign you up to any promotional email or message.
  • Answering your questions on the website with Gamsi, our artificial intelligence assistant, and passing on to the team the message you leave with it: your consent, given in the conversation before the first question, for the current visit; you can stop whenever you like, and closing the tab erases the conversation. Gamsi makes no decision about you: it informs and points you in the right direction.
  • Knowing which referrer or campaign brought you, paying the referral bonus due, understanding the audience of our accounts through the networks' aggregated statistics and protecting the forms and the assistant from abuse: our legitimate interest.
  • Measuring visits to the website to improve it: your consent, which you can withdraw at any time through the “Cookies” link at the bottom of every page.
  • Showing Calendly's calendar straight away on our booking page: your consent, given in the cookie banner, which you can withdraw at any time through the “Cookies” link at the bottom of every page. Without it, the calendar only loads if you click “Show available times”, and only for that time.

Who receives your data

Your data is never sold or rented. Antoine Delalande processes it with the following providers, each for its own task only:

  • Hostinger: hosting of the website and of the server that receives the forms (this server is in France); n8n, installed on that server, passes on the forms and the questions asked to Gamsi, without keeping those questions.
  • Bunny.net (BunnyWay d.o.o., Slovenia, European Union): hosting and streaming of the presentation video; its player sets no cookies; your IP address is only used to send you the video, and we only receive viewing statistics, without your identity.
  • Brevo (France): contact management and email sending.
  • Airtable (United States): tracking of requests and applications, without any health information.
  • Calendly (Calendly LLC, United States): call booking. Its calendar is embedded in our booking page and only loads with your consent, given in the cookie banner, or after you click “Show available times”. Once loaded, it sets its own cookies and calls its own trackers (including those of Google, Facebook and Segment), under its own privacy policy.
  • OpenAI (ChatGPT Business) and Anthropic (United States): artificial intelligence assistants, under a business contract, that help us prepare replies and follow-ups; your data is not used to train their models. Anthropic also powers Gamsi's answers, from the conversation's messages alone: neither your IP address nor your visit identifier is passed on to it.
  • Discord (United States): our internal notifications, limited to a first name, an identifier, the status of the request and a link, never the content of your messages.
  • Telegram: our internal notifications, with the same limits: a first name, an identifier, the page or the status of the request and a link, never your contact details or the content of your messages.
  • ManyChat (United States): on Instagram, automatically sending, by private message, the link you ask for with a keyword, then our replies if you write to us.
  • Buffer (United States): scheduling our posts on social networks and the statistics of our accounts.
  • Backblaze (European Union): encrypted backup copies of the server.
  • Google (Google Ireland Limited, Ireland, and Google LLC, United States): audience measurement of the website (Google Analytics), only with your consent.

On our accounts, Instagram and Facebook (Meta Platforms Ireland Limited, Ireland) and TikTok (TikTok Technology Limited, Ireland, and TikTok Information Technologies UK Limited, United Kingdom) also process your data, as separate controllers, under their own policies (Instagram, Facebook, TikTok). For the statistics of our accounts, TikTok and Massatis are joint controllers: TikTok informs you about this data and handles your requests (essence of this arrangement). The same applies with Meta for our Facebook page (Meta addendum); Instagram may also be a joint controller with us for the statistics it gives us.

Transfers abroad

Part of the data is processed in the European Union, in particular in France, whose level of protection Switzerland recognises. Another part is processed in the United States (Airtable, Calendly, OpenAI, Anthropic, Discord, ManyChat, Buffer, Google): these transfers rely on the provider's certification under the Data Privacy Framework (EU–US and Swiss–US) where it holds one, and otherwise on the European Commission's standard contractual clauses, recognised by the Federal Data Protection and Information Commissioner (FDPIC). ManyChat's support teams may also access your data from Serbia, Armenia and Brazil, on the basis of the standard contractual clauses in its contract. Telegram, based outside the European Union, states that it keeps the data of European accounts in the Netherlands; our notifications there contain neither your contact details nor the content of your messages. Instagram, Facebook and TikTok may also transfer data outside the European Union, under their own policies.

How long we keep data

  • Prospects (sign-up, application, quote or message left with Gamsi, not followed up): three years at most after our last exchange, then deleted.
  • Private message conversations and contacts created by ManyChat: three years at most after your last message or comment, then deleted from our tools; 30 days at most after the keyword SOIN.
  • Conversation with Gamsi: we do not record it; it stays in your browser until you close the tab. Anthropic deletes the messages within 30 days, unless the law or the fight against abuse requires it to keep them longer. The counter that protects the assistant from abuse, linked to the visit identifier, is deleted 24 hours after your last question.
  • Public comments: on the network concerned, until you or we delete them.
  • Clients and students: for the duration of the relationship, then ten years for accounting records, as the law requires.
  • The consent you give in a form: as long as the data it relates to.
  • Encrypted backup copies of the server: six months at most.
  • Referral code and campaign parameters kept in your browser: until you close the tab.
  • Audience measurement: 14 months in Google Analytics for visit details, anonymous totals after that; _ga cookies: 13 months at most; your cookie choice: six months.
  • Calendly's cookies and trackers: the period set by Calendly, under its own policy.

Storage in your browser

The website itself sets no advertising cookies. Only with your consent, it measures its visits with Google Analytics: two cookies, _ga and _ga_<identifier>, which contain a random identifier, for 13 months at most; without consent, no Google script is loaded.

On the booking page, Calendly's calendar loads with the consent you give in the banner, or after you click “Show available times”; before that, nothing is sent to Calendly. Once loaded, it sets its own cookies on its own domain (calendly.com) and calls its own trackers, including those of Google, Facebook and Segment, for the period set by Calendly.

Your choice, for audience measurement as for the calendar, is kept for six months in a cookie (massatis_cookies) and can be changed at any time from the “Cookies” link at the bottom of every page. Withdrawing applies from then on, not to what has already been measured or sent; cookies already set by Calendly can be deleted from your browser settings.

The website also keeps in your browser:

  • your currency choice (localStorage);
  • the referral code (ref) and campaign parameters (utm_*) of the last link you followed: for the tab session only (sessionStorage), then erased; nothing is kept on your device beyond that;
  • the conversation with Gamsi, your answer to its “Your data” screen and the visit identifier (sessionStorage): erased when you close the tab;
  • on the presentation page, where you stopped the video, so you can pick up where you left off: up to seven days, kept by the player in your browser and sent to no one.

You can delete this data at any time in your browser settings.

Your rights

You can ask for access to your data, its correction, deletion, restriction of processing or portability, object to its processing and withdraw your consent at any time, without affecting what was done before. Write to contact@massatis.com: we reply within 30 days.

In particular, you can object at any time to processing based on our legitimate interest, including our replies on social networks and the statistics of our accounts.

For the data that Instagram, Facebook and TikTok process themselves, you can also exercise your rights directly with them.

You can also contact the Federal Data Protection and Information Commissioner (FDPIC) or the data protection authority of your country of residence (in France, the CNIL).

Changes

This policy is updated when our processing changes; the date at the top of the page shows the version in force. Before Massatis uses an account on another network, this policy is updated to cover it.