Privacy Policy
October 11, 2026
This policy explains which personal data we process when you visit munimen.ai, book a demo, join the beta or use the Munimen service, why, for how long, and what your rights are.
1. Controller
The controller is Kilian Bodet--Canac, a French sole proprietorship (EI) trading as GetYourStack, SIREN 101 741 965, 60 rue François Ier, 75008 Paris, France. For any question about your data: privacy@munimen.ai.
The content our customers connect or upload to the Service (documents, conversations, memory) is processed on their behalf: Munimen acts as a processor under the data processing agreement. To exercise your rights over that content, contact the company that uses Munimen.
2. Data processed, purposes and legal bases
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Visiting the site | IP address, browser, pages requested (technical logs) | Running and securing the site | Legitimate interest |
| Booking a demo | Name, email, company, chosen slot | Organizing and preparing the call | Pre-contractual steps |
| Joining the beta | Name, email, company, form answers | Selecting companies and getting back to you | Pre-contractual steps |
| User account | Name, email, picture, role, preferences, hashed password, authentication factors | Providing the Service and managing access | Performance of the contract |
| Sign-in security | IP address, device, sign-in events | Detecting abuse and protecting accounts | Legitimate interest |
| Usage analytics | Identifiers, actions in the Service, session replay with text and inputs masked | Understanding usage and improving the Service | Legitimate interest, with a right to object |
| Support and feedback | Name, email, messages exchanged | Answering you and improving the Service | Performance of the contract |
| Billing | Billing identity, address, VAT number (card details are entered at Stripe) | Collecting payment and invoicing | Performance of the contract, legal obligation |
3. Retention
- Technical and security logs: twelve months at most.
- Prospects (demo, beta): three years after the last exchange.
- Account: as long as it is active; data is deleted when the account is closed and is gone from backups within thirty days.
- Billing: ten years, as French accounting law requires.
- Support: for the duration of the relationship, then deleted within ninety days.
4. Recipients and subprocessors
Your data is never sold or rented. It is accessible to Munimen and to the following providers, each for its role and bound by a data processing agreement:
| Subprocessor | Role | Location | Safeguard |
|---|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) | Hosting, database, files, encryption, backups and compute for our in-house models | Paris, France | European Union |
| Mistral AI (France) | Default answer model, content extraction and structuring | European Union | European Union |
| Nango (United States) | Connection to the customer’s tools (OAuth) and relay of the calls to them | United States | Standard contractual clauses |
| Firecrawl (United States) | Reading the public websites the customer adds, and web search | United States | Standard contractual clauses |
| Resend (United States) | Sending the Service’s emails (verification, invitations, notifications) | Sending from Ireland; account and logs in the United States | Standard contractual clauses |
| Stripe Payments Europe Ltd (Ireland) | Payments, tax and invoicing | Ireland, United States | Data Privacy Framework and standard contractual clauses |
| PostHog, Inc. (EU Cloud) | Product usage analytics | Germany | European Union |
| Better Stack | Technical logs, monitoring and status page | European Union | European Union |
| Featurebase (CORDNET OÜ, Estonia) | Support, feedback and changelog | Netherlands, Germany, Ireland | European Union |
| Better Auth, Inc. (United States) | Sign-in security: abuse and breached-password detection | United States | Standard contractual clauses |
On the site, demo booking goes through Cal.com (United States) and the beta sign-up through Tally (Belgium): the information you enter there is sent to them. The Cal.com widget only loads when you ask for a demo.
5. Transfers outside the European Union
When data is processed outside the European Union, the transfer is covered by the European Commission’s standard contractual clauses, or by the Data Privacy Framework for certified companies. A copy of the safeguards is available on request.
6. Security
Data is hosted in France and encrypted in transit and at rest; indexed content is encrypted with a key dedicated to each organization. Access is limited to what is necessary. Details are on the Trust page.
7. Your rights
You have the right to access, rectify, erase, restrict and port your data, to object to its processing, and to set instructions for what happens to it after your death. You can exercise these rights at any time:
- by email: privacy@munimen.ai;
- by post: Kilian Bodet--Canac, 60 rue François Ier, 75008 Paris, France.
We answer within one month. If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
8. Cookies
The munimen.ai site uses no advertising cookies and no analytics. It sets one technical cookie that remembers your language. The Cal.com booking widget, loaded only when you ask for a demo, may then set its own cookies.
In the Service, strictly necessary cookies keep your session and preferences; the usage analytics described above rely on PostHog.
9. Changes
This policy may change, in particular when our providers change. The update date is shown at the top of the page; significant changes are notified to customers.
