Privacy policy
What we collect, why, and what you can ask us to do with it.
Who we are
Exiliv (“we”) is responsible for the personal data described on this page. The data controller is [TO FILL: legal name of the publisher, legal form and registered address].
For any question or request about your data, write to team@exiliv.eu.
The short version
- We only collect what you give us: your email address when you join the waitlist, what you enter in the app, and your message when you write to us
- We use your data to run Exiliv for you, and for nothing else
- The website sets no cookies. The app uses only the cookies it needs to keep you signed in and remember your language. We count visits with cookie-free analytics and use no advertising or social-media trackers
- We don’t sell your data or share it for anyone else’s marketing
- Your data is stored in the European Union
- You can see, correct or delete your data at any time, and delete your app account yourself in Settings
What we collect
When you join the waitlist
- Your email address
- Your browser’s language setting (for example
en-GB), so we can write to you in French or English - The date and time you signed up, and that you signed up on this website
- If you choose to answer them: where you are in your journey, where you are based, and your city
- How you found us: the campaign tags in the link you followed (such as
utm_source), the website that sent you, and the page where you signed up
We use the optional answers to choose who joins each beta group and to make the product fit, and the “how you found us” details to learn which channels work.
When you join, we send you one welcome email and notify our team. When your beta access opens, we email you an invitation.
When you use the app
The app is in private beta: you sign in with the email address we invited, using a one-time code we email you.
- Your account: your email address, when you signed up and last signed in
- Your answers: where you’ll run the business from, whether you hold an EU, EEA or Swiss passport or another one, your stage, legal form, type of business, whether you charge VAT, your city, your registration and trading start dates, and whether you employ or plan to hire people. We use them only to build your checklist and its deadlines
- Your checklist: which tasks you’ve started or finished, their due dates, and the notes you write
- Expert requests: the task and message you send, with your email address
- Your settings: your language and whether you want deadline reminders
We send you emails about your account: sign-in codes and, unless you turn them off in Settings, a reminder a week before and the day before each deadline on your checklist. We never send marketing from the app.
Our team reads the questions founders ask the assistant, so we can fix what the checklist and the guides don’t answer. We don’t read your task notes.
When you send an expert request, our team receives it and passes your email address, the task and your message to the expert you chose, who replies to you directly. Our first expert is Nounda, a business advisory for international founders run by an Exiliv co-founder.
When you visit the site
Our hosting provider processes the technical data every website receives, such as your IP address, browser type and the pages you request, to deliver the site and protect it from abuse. We don’t use this data to identify or profile you.
We count page views on the website with Vercel Web Analytics. It sets no cookies and stores nothing on your device; visits are told apart by a short-lived anonymous hash that is discarded within 24 hours. The app isn’t counted.
When you email us
We keep your email address and message so we can reply and follow up.
Why we use it, and on what basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Tell you about the beta and launch | Waitlist data | Your consent, art. 6(1)(a) |
| Choose beta groups and learn which channels work | Optional answers and “how you found us” | Your consent, art. 6(1)(a) |
| Run the app: sign-in, your checklist, deadlines, notes and settings | Account, answers, checklist, settings | Providing the service you asked for, art. 6(1)(b) |
| Send deadline reminders | Email, due dates, task titles, language | Providing the service you asked for, art. 6(1)(b); you can turn them off in Settings |
| Pass your expert request to the expert you chose | Email, task, message | Your request, art. 6(1)(b) |
| Improve the checklist and guides from what founders ask the assistant | Your questions and our answers | Our legitimate interest in making Exiliv answer real questions, art. 6(1)(f) |
| Count visits to improve the website | Anonymous page views | Our legitimate interest in understanding how the site is used, art. 6(1)(f) |
| Reply to your messages | Your email and message | Our legitimate interest in answering you, art. 6(1)(f) |
| Deliver and secure the website and app | Technical data | Our legitimate interest in running a secure service, art. 6(1)(f) |
How long we keep it
- Waitlist data: until you ask us to remove it, and at most three years after your last contact with us
- App account and everything in it: until you delete your account. Deleting it in Settings removes your account, answers, checklist, notes, expert requests and reminder history at once. We also delete accounts that stay unused for three years
- Emails: as long as needed to follow up, and at most three years after our last exchange
- Technical data: for the short period set by our hosting provider’s own policy
Who processes it for us
| Provider | What they do | Where the data is |
|---|---|---|
| Supabase, Inc. | Stores the waitlist and app database; handles app sign-in | European Union (Paris, France) |
| Vercel Inc. | Hosts and delivers the website and app; counts website page views | Global network; Vercel is a US company |
| Resend, Inc. | Sends our emails (welcome, invitations, sign-in codes, reminders, team notifications) | United States |
| One.com | Hosts our email inbox | European Union |
Vercel is certified under the EU-U.S. Data Privacy Framework and also relies on standard contractual clauses. Supabase relies on standard contractual clauses under its data processing addendum. Resend receives only your email address and the message we send you. If we add a provider, we’ll list it here.
Experts you send a request to, such as Nounda, receive it as independent advisers, not as our providers.
Cookies
The website sets no cookies, stores nothing on your device and loads no third-party trackers. Our analytics are cookie-free. Fonts and images are served from our own domain.
The app, once you sign in, uses only cookies it needs to work. They’re strictly necessary, so they don’t need your consent:
| Cookie | Why | How long |
|---|---|---|
sb-…-auth-token |
Keeps you signed in | Until you sign out or your session expires |
exl_login_email |
Remembers which address we sent your sign-in code to, between the two sign-in steps | 15 minutes |
exl_locale |
Remembers the language you chose in Settings | One year |
Your rights
Under the GDPR you can ask us to:
- Give you a copy of your data
- Correct it
- Delete it (you can delete your app account yourself in Settings)
- Restrict or object to how we use it
- Send it to you in a portable format
You can also withdraw your consent to waitlist emails at any time, and turn off deadline reminders in Settings; this doesn’t affect anything we did before. Write to team@exiliv.eu from the address concerned and we’ll reply within one month.
If you think we haven’t handled your data properly, you can complain to the French data protection authority, the CNIL: online at cnil.fr, or by post to CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.
Changes to this policy
When our practices change, we’ll update this page and the date at the top. If a change affects how we use your data, we’ll email you before it applies.