Privacy policy

Data controller: Enumalon SAS (SELLOM by Enumalon), 584 Avenue du Lac, 07350 Cruas, France, contact@sellom.io. Last updated: 2026-10-15

Courtesy version. This policy is written in French. This English text is an adaptation provided for your convenience. If the two differ, the French version prevails.

1. Data controller

Enumalon SAS (Aubenas trade register 101 694 347, SIRET 101 694 347 00010) publishes the SELLOM by Enumalon service. It is responsible for the processing described here. Contact for your data: contact@sellom.io.

2. Data, purposes, legal bases and retention

2.1 Account and email address

Purpose: to create and secure your account and to send you your sign-in links, your reports and service emails.
Legal basis: performance of a contract or pre-contractual steps (GDPR art. 6(1)(b)).
Retention: as long as the account exists. A free account with no sign-in and no measurement for 24 months is deleted together with its tests, after a warning email sent 30 days before. An account linked to a payment, a dossier, a scheduled send or a purchase is deleted 3 years after the subscription ends or, failing that, 3 years after its last use, or earlier on your request, subject to accounting records (2.4). Earlier deletion on request to contact@sellom.io.
Processor: Resend Inc. (United States), sending of emails.

2.2 Measurements and domains analysed

Purpose: to produce your measurements and compare their results over time.
Legal basis: performance of a contract (art. 6(1)(b)) for accounts; legitimate interest (art. 6(1)(f)) for a free test without an account.
Retention: measurements of an account: as long as the account exists. Free tests without an account: 90 days, then deleted.
Note: a domain is not in itself personal data. It becomes so if it is linked to an identifiable person. AI answers may quote people: see 2.11.

2.3 IP address

Purpose: security, abuse prevention, limit of one free test per day.
Legal basis: legitimate interest (art. 6(1)(f)).
Retention: the per-IP counter for the free test expires after 24 hours. The IP address recorded with a measurement or a sign-in request is kept for 12 months, then deleted.

2.4 Payment and invoicing

Purpose: to collect the subscription, calculate VAT and issue invoices.
Legal basis: performance of a contract (art. 6(1)(b)) and legal accounting obligation (art. 6(1)(c)).
Retention: 10 years for accounting records (art. L. 123-22 of the French Commercial Code).
Processor: Stripe Payments Europe Ltd (Ireland), payment and VAT calculation (Stripe Tax). Sellom never stores card numbers.

2.5 Audience measurement

Tool: Plausible Analytics, self-hosted on an OVH server in France. It is the only audience measurement tool. Sellom uses neither Microsoft Clarity nor Google Analytics.
How it works: counting of visits and of a few actions (running a test, opening a report, copying lines), without cookies and without tracking across sites. This data contains neither the tested domain, nor a test identifier, nor an email address.
Legal basis: legitimate interest (art. 6(1)(f)). No consent is required.

2.6 Notice that free tests have reopened

Purpose: to write to you once when free tests reopen, if you asked for it.
Legal basis: pre-contractual steps taken at your request (art. 6(1)(b)). No subscription to offer emails results from it.
Retention: the plain address is erased as soon as the message is sent. A keyed hash stays for 30 days after sending, then is deleted. A request never served is deleted 30 days after it was created.

2.7 Support messages

Purpose: to answer your questions and complaints.
Legal basis: performance of a contract (art. 6(1)(b)) or legitimate interest (art. 6(1)(f)).
Retention: 3 years after the request is closed.
Processors: see the table in article 3 (reception and mailbox for contact@sellom.io).

2.8 Emails with tips, news and offers

Purpose: to send you, if you asked for them, Sellom emails with tips, news and offers: a reminder about a first report, a presentation of the Business and Agency plans, a message after a long period without signing in. These messages are not needed for the service. Your reports, sign-in links, payment confirmations and monitoring alerts continue without them.
Legal basis: consent (GDPR art. 6(1)(a) and art. L. 34-5 of the French Postal and Electronic Communications Code), given through a box that is unchecked by default in My account. Declining has no effect on access to the service.
Data used to decide on a message: email address, language, date the email was confirmed, date of last sign-in or last measurement, existence of a completed report (its domain and one of its questions), existence of a purchase or subscription, your usage choice if you set one. No message of this kind is sent after a purchase or subscription. No automated decision with legal effects is taken.
Frequency: at most two messages in the 30 days after your consent, then at most one per 30-day period.
Withdrawal: at any time, free of charge and without signing in, with the "Stop receiving these messages" link in each message, with your mail client's unsubscribe button, or by unchecking the box in My account. It takes effect immediately: pending messages are cancelled. Withdrawal does not affect earlier messages.
Evidence: for each change we keep the date, the version of the text you accepted and the source (account box, unsubscribe link, complaint reported by you through your email service). This is deleted with your account.
Tracking: these messages contain no tracking pixel and no tracking link.
Retention: until you withdraw consent. Sending decision log: 12 months. Planned or sent message metadata: 24 months. Unsubscribe tokens: 12 months.
Processor: Resend Inc. (United States), sending of messages and return of bounces and complaints, 2021 SCCs.

2.9 Usage choice

Purpose: to tailor the advice you agreed to receive: the Business plan for "Track my own brand", the Agency plan for "Prepare reports for my clients". Without a choice, these two messages are not sent.
Legal basis: consent (art. 6(1)(a)), through an optional choice you make yourself in My account. It is never inferred from your email address, your domain or your measurements.
Retention: until you change or clear it ("I prefer not to say"), or until your account is deleted.

2.10 Address suppression list

Purpose: to stop writing to an address whose message permanently bounced or whose holder reported a message as unwanted, and so to respect your objection.
Legal basis: legitimate interest (art. 6(1)(f)): respecting people's refusal, avoiding useless sending and protecting sending reputation.
Data: keyed hash (HMAC-SHA256) of the address, reason (permanent bounce or complaint), date. The address itself is not kept in this list. The hash remains pseudonymised personal data: your rights apply.
Retention: 12 months for a permanent bounce, 36 months for a complaint. This list remains after your account is deleted so that your objection stays respected.

2.11 People quoted in AI answers

Answers from AI models may quote people, for example the head of a company. These people did not give us their data: it comes from the answers published by the models (GDPR art. 14).
Data: name and role as quoted in the answer.
Purpose and legal basis: to give our customer a faithful measure of its visibility, legitimate interest (art. 6(1)(f)).
Retention: these extracts are kept as published by the models, together with the measurement that contains them: 90 days for a test without an account, otherwise for as long as the account exists (see 2.1).
Your rights: anyone quoted may ask for the extract to be erased, or object to its processing, at contact@sellom.io.
Individual notice: we cannot write to every person quoted, as this would involve disproportionate effort (art. 14(5)(b)); this page serves as the notice.

2.12 Retention in the event of a dispute

Data needed to establish, exercise or defend a legal claim may be kept beyond the periods above, separated from other data, until the end of the dispute and of the applicable limitation period (GDPR art. 17(3)(e)).

2.13 Public result card

From your account, you can publish a result card: a public page showing the citation rate of a measurement. This is your own action, never automatic.
Data published: the domain, the brand name, the rate, the number of answers and questions, and the date of the measurement. No question, answer, source, competitor or email address appears. If the brand name is a person’s name, it becomes public.
Purpose and legal basis: letting you share your result, on your initiative; consent (art. 6(1)(a)), which you withdraw by deleting the card.
Access: the page can only be reached through its address, which is long and cannot be guessed. Search engines do not index it. Anyone who has the address can view it and pass it on.
Removal: you can remove the card at any time from your report, or by writing to contact@sellom.io; the address then stops responding. A copy already made by a third party (screenshot, repost) is outside this removal.
Retention: until the card is removed, or until the test or account it belongs to is deleted. A removed card is no longer accessible and its content is erased immediately.
LinkedIn: the share button opens LinkedIn with the card’s address. Sellom sends nothing else; LinkedIn then processes your data under its own policy.

2.14 Reading the analysed site

To write the questions of a measurement, our crawler SellomBot reads the public pages of the site entered: the home page, a few presentation pages, robots.txt, llms.txt and the sitemap. It identifies itself under its name (SellomBot page) and, if the site refuses that name, tries once more presenting itself as a browser. It reads robots.txt and states in the report what that file blocks; it reads the pages needed for the measurement even if that file blocks them, on behalf of the user who requests it. The text read is sent to an AI model (Mistral AI, through OpenRouter), which draws from it a profile of the business: activity, offers, target customers, locations, brand names.

Data: these pages are public and may quote people (head of the company, team, contact). If the brand name is a person’s name, it is personal data. These people did not give us their data: it comes from public pages (GDPR art. 14). The profile is about the business’s activity, not the people.
Purpose and legal basis: writing the questions of the measurement requested; legitimate interest (art. 6(1)(f)).
Retention: to write the questions, Sellom does not keep the text of the pages read, only the profile drawn from it and the addresses of the pages read. A domain’s profile is kept as long as it is used for measurements.
Your rights: the owner of a site, or anyone concerned, may ask for the profile to be corrected or erased, or object to its processing, at contact@sellom.io. A site owner can also ask, at the same address, that their site no longer be read by SellomBot (SellomBot page).
Individual notice: we cannot write to every person quoted on the pages read, as this would involve disproportionate effort (art. 14(5)(b)); this page serves as the notice.
Site not read: when the site cannot be read, Sellom asks the AI assistants three questions about the site’s name: what they know about it, its offer, its competitors. That name may be a person’s. The answers are kept like the others (see 2.11): 90 days for a test without an account, for as long as the account exists otherwise. A person who is named can ask for the answers about them to be removed at contact@sellom.io; the request is handled within 72 hours.
Corrections in a dossier: when a subscriber prepares or checks a correction, SellomBot reads the relevant page of the domain in their dossier. Sellom keeps an extract of at most 400 characters of that page, its address, the date, the response code and the result of the reading, and a fingerprint of its content, in the dossier, for as long as the account exists (see 2.1). Legal basis: performance of the contract (art. 6(1)(b)).

3. Processors

3.1 AI providers queried during a measurement

A measurement sends standardised questions to the following models, through OpenRouter:

These questions concern the domain or brand analysed. They are written from public extracts of its website, read by SellomBot (2.14); Mistral AI writes the company profile and the questions. They never contain your email address, your name or your account data. The free test queries OpenAI, Google and Perplexity. The current list is on the Methodology page.

4. Transfers outside the European Union

Stripe, Resend, OpenRouter, Cloudflare, the US AI providers and, depending on the case, Google process data in the United States. Where a recipient is certified under the EU-US Data Privacy Framework, the transfer relies on that certification. Otherwise it relies on the European Commission’s standard contractual clauses (2021) signed with it. For questions sent to AI models, only public data about a domain or brand is sent, never data from your account. You can obtain a copy of the safeguards at contact@sellom.io.

The application, its database and audience measurement remain hosted in France (OVH).

5. Your rights (GDPR, art. 15 to 22)

• Access, rectification, erasure, portability, restriction (art. 15 to 18 and 20): by email to contact@sellom.io, answer within one month.
• Objection (art. 21(1)): to processing based on legitimate interest, by email to contact@sellom.io.
• Withdrawal of consent and objection to marketing (art. 7(3) and 21(2)): “Stop receiving these messages” link at the bottom of every tips or offers email, or the unchecked box in My account.

If the answer does not satisfy you, you may lodge a complaint with the CNIL, cnil.fr/fr/plaintes, or with the data protection authority of your country of residence.

6. Artificial intelligence

Sellom reports are produced with the help of artificial intelligence models. Each report says so and lists the models that answered. The answers quoted are those of those models and are not written by Enumalon SAS. Sellom takes no automated decision that produces legal effects on individuals.

Results are indicative. They are not an automated decision within the meaning of GDPR art. 22 and bind no party.

7. Cookies

Sellom sets only strictly necessary cookies. Details are in the Cookies and trackers policy.

8. Security

Enumalon SAS applies appropriate technical and organisational measures to protect your data: TLS encryption in transit, hashing of sensitive data at rest, isolated environments, access controls. In the event of a personal data breach, the CNIL is notified within 72 hours (GDPR art. 33) and, if the risk to you is high, you are informed (art. 34).

9. Changes to this policy

This policy may change. The applicable version is the one published on this page with its date. Substantial changes are notified by email to active subscribers at least 30 days before they take effect.

10. Contact

SELLOM by Enumalon, Enumalon SAS, 584 Avenue du Lac, 07350 Cruas, France. Email: contact@sellom.io

Last updated: 2026-10-15