Skip to content
Roboto
Log in Try Roboto

Privacy Policy

What Roboto collects, why, with whom, for how long — and how to take back control.

Last updated: August 14, 2026

This English version is provided for convenience. Roboto is operated under French law; in the event of any discrepancy, the French version prevails.

1. Data Controller

  • Name: NGATSE OBALA Jacques
  • Trade name: Roboto.fr
  • Status: Self-employed
  • Address: 10 Rue Gaston Paymal, 92110 Clichy, France
  • DPO/Privacy email: privacy@roboto.fr
  • Contact email: contact@jackywest.com
  • Phone: +33 6 98 72 04 56

2. Data Collected

A) Account data

  • Email
  • Last name / First name (if provided)
  • Password (hashed, never stored in plain text)
  • Billing address
  • Subscription history

B) Payment data

  • Managed by Stripe (Roboto does NOT store card numbers)
  • Stripe customer ID
  • Transaction history
  • Payment method (type: Visa, Mastercard, etc.)

C) Usage data

  • IP address
  • Browser and device type
  • Pages visited, session duration
  • Features used
  • Credits consumed
  • Login logs

D) Generated content

  • Prompts submitted by the user
  • Generated text/image/audio/video content
  • Saved documents
  • Chatbot conversations

E) Cookies

  • Strictly necessary (always active): session, authentication, anti-CSRF token, remembering your cookie choice.
  • Audience measurement (consent): Google Analytics.
  • Advertising and campaigns (consent): Meta Pixel, campaign identifiers fbclid and gclid.

No audience measurement or advertising cookie is set before your consent. The cookie-by-cookie details, as well as how to change your choice at any time, are on the Cookie Policy page.

3. Purposes of Processing

  • Creating and managing the user account
  • Providing and improving the service
  • Processing payments and billing
  • Customer support
  • Fraud prevention and security
  • Statistical analysis and product improvement
  • Marketing communications (with consent, opt-out possible)
  • Complying with legal obligations

4. Legal Bases (GDPR)

  • Contract performance: account, service, billing
  • Consent: newsletter, marketing cookies
  • Legitimate interest: security, product improvement, analytics
  • Legal obligation: retaining invoices, responding to authorities

5. Data Retention Periods

  • Account data: duration of the subscription + 3 years after deletion
  • Invoices and accounting data: 10 years (French legal obligation)
  • Connection logs: 1 year
  • Generated content: as long as the account is active, deleted 30 days after account deletion
  • Prompts: 90 days (for service improvement), anonymized thereafter
  • Cookies: 13 months maximum

6. Subprocessors and Partners

Partner Role Location Guarantees
o2switch SAS Hosting of the site and database France (EU) EU subprocessor, no transfer
Stripe Payments and subscriptions EU / United States PCI-DSS certified, DPF, SCC
AtlasCloud Routing of image and video generations (GPT Image 2, Seedance, VEO, Kling) United States SCC
fal.ai Secondary image and video models United States SCC
Google (Gemini) Conversational assistant for Creative Studio, synthetic voiceover, continuity analysis EU / United States DPF, SCC
OpenAI Transcription of voice dictation (Whisper) United States DPA, SCC
Amazon SES Transactional emails (confirmations, support, invoices) France (eu-west-3) EU subprocessor, SCC
Meta Advertising pixel — only after consent United States DPF, SCC
Google Analytics Audience measurement — only after consent United States IP anonymization, DPF

7. Transfers Outside the EU

  • The site and database remain in France (o2switch), as does email sending (Amazon SES, Paris region).
  • AI model providers are mostly based in the United States: the content of your generation requests is therefore transmitted there for processing.
  • Guarantees: Standard Contractual Clauses (SCCs) and, where the provider adheres to it, the Data Privacy Framework (DPF).
  • Data encrypted in transit (TLS) and at rest.

8. User Rights (GDPR)

  • Right of access: obtain a copy of your data.
  • Right to rectification: correct inaccurate data.
  • Right to erasure: request deletion of your data.
  • Right to restriction: restrict processing.
  • Right to data portability: receive your data in a structured format.
  • Right to object: object to processing on legitimate grounds.
  • Withdrawal of consent: at any time for processing based on consent.

Exercising Your Rights

  • Email: privacy@roboto.fr
  • Response time: 30 days maximum.
  • Proof of identity required.

CNIL Complaint

  • If a dispute remains unresolved, you can file a complaint with the CNIL.
  • Website: https://www.cnil.fr
  • Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

9. Cookies - Consent Management

A) Strictly Necessary Cookies (no consent required)

  • User session
  • Authentication
  • Security (CSRF)
  • Language preferences

B) Analytics Cookies (consent required)

  • Google Analytics (_ga, _gid)
  • Anonymized audience measurement

C) Marketing Cookies (consent required)

  • None currently.

Management: Consent banner on first visit, modifiable at any time via the "Manage cookies" link in the footer.

10. Data Security

  • Encryption in transit: TLS 1.3
  • Encryption at rest: AES-256
  • Restricted access: principle of least privilege
  • Authentication: 2FA available
  • Backups: daily, encrypted
  • Monitoring: intrusion detection
  • Security testing: regular

11. Breach Notification

  • In the event of a data breach, notification to the CNIL within 72 hours.
  • Notification to affected users without undue delay.
  • Contact email: security@roboto.fr

12. Minors

  • The service is intended for individuals aged 18 and over.
  • We do not knowingly collect data from minors.
  • If we discover data from minors, it will be deleted.

13. Policy Changes

  • This policy may be modified at any time.
  • Notification by email or on the site in case of substantial changes.
  • The date of the last update is displayed at the top of the page.