Legal information
Privacy policy
Last updated: 15 October 2026
English translation of the French document. The services and conditions described are the same in both versions.
This policy describes how Oryon Technologies processes personal data on oryon-tech.com. It applies to visitors, people using the contact form, SEO Studio users and clients’ business contacts.
1. Data controller
The data controller is the sole trader Shems-eddine Chelgoui, trading as Oryon Technologies, 7 Rue Antoine Bazin, 69700 Givors, France. Contact: privacy@oryon-tech.com for personal-data requests, or contact@oryon-tech.com for other enquiries.
No Data Protection Officer (DPO) has been appointed, in accordance with Article 37 of the GDPR, which does not require one for this organisation. Requests can be sent directly to the data controller.
2. Processing activities
The public form lets you contact us. The client area lets invited users follow their projects, exchange messages and view documents. Installing SEO Studio from Shopify also allows account creation after store authorisation and email confirmation. No advertising tools, newsletter or audience analytics solution are used. When a form is submitted, the last public Oryon page leading to contact, if available, and the form language may be saved with the enquiry to assess which content generates enquiries. This context is indicative, may be missing and does not measure visits. No cookies, browser storage, advertising identifiers, campaign parameters or third-party website URLs are added for this reporting. These details are visible in the administration area and follow the enquiry retention period.
| Processing | Data | Purpose | Legal basis | Recipients | Retention | Transfers outside the EEA |
|---|---|---|---|---|---|---|
| Contact form / quote request | Name or business name, email, optional phone number, type of need, optional indicative budget, optional desired timeframe, message, selected correspondence language, form language and last public Oryon page before contact if available | Respond to the enquiry and prepare a quote if requested; assess which pages and content languages generate enquiries | Legitimate interest in responding to business enquiries and assessing the content that generates them (GDPR Article 6(1)(f)); steps prior to entering into a contract when a quote is requested (Article 6(1)(b)) | Oryon Technologies, hosting provider Vercel Inc. — 440 N Barranca Avenue #4133, Covina, CA 91723, États-Unis, transactional email provider Google Workspace (Gmail), and Supabase for storing enquiries when the portal is enabled | 3 years after the enquiry is closed | Hosting: Server functions are configured in Paris, France. Website delivery also uses Vercel’s global network. Some processing may take place outside the European Economic Area, including in the United States. Transfer provisions are set out in Vercel’s data processing agreement: https://vercel.com/legal/dpa. Email: Google Workspace may process data outside the European Economic Area, depending on the processing locations of Google and its subprocessors. Processing terms: https://cloud.google.com/terms/data-processing-addendum/ ; subprocessors: https://workspace.google.com/terms/subprocessors/ |
| Prospect and client management | Identity, contact details, exchange history, quotes and contracts | Manage the commercial relationship, invoicing and legal obligations | Legitimate interest (6(1)(f)); performance of the contract (6(1)(b)) after its conclusion; legal obligations (6(1)(c)) for accounting | Oryon Technologies; Supabase for client-area records when enabled; any accounting provider identified contractually | For the duration of the contractual relationship; invoices and billing records are retained for 10 years from the close of the financial year | Depending on the region and subprocessors of the enabled services; further information available on request |
| Client-area sign-in and exchanges | Email address, account identifier, session, projects, change requests and messages | Provide private access to the client file and follow the assignment | Performance of the contract (6(1)(b)); legitimate interest in securing access (6(1)(f)) | Oryon Technologies, Supabase Auth and Database, Google Workspace (Gmail) for sending sign-in codes and notifications | During the client relationship; documents required for legal obligations follow their own retention periods. Session cookies: 7 days, renewed during use and deleted on sign-out | Supabase: depending on its region and subprocessors; details: https://supabase.com/privacy. Email: Google Workspace may process data outside the European Economic Area, depending on the processing locations of Google and its subprocessors. Processing terms: https://cloud.google.com/terms/data-processing-addendum/ ; subprocessors: https://workspace.google.com/terms/subprocessors/ |
| SEO Studio: analysis and writing | Website address and public pages, business activity, topics, languages, drafts, sources, images and credits, editorial corrections and approvals | Prepare articles appropriate to the site, check their content and enable Oryon’s review | Performance of the contract or requested pre-contractual steps (6(1)(b)) | Oryon Technologies, Supabase and Vercel; OpenAI for research and writing; image-search providers for search keywords | During provision of the service and follow-up of ordered content; deletion or return on request, subject to records required for legal obligations | Providers may process data outside the EEA under their contractual safeguards. OpenAI: https://openai.com/policies/privacy-policy/ ; Supabase: https://supabase.com/privacy |
| SEO Studio: connection and publication on the client website | Site and blog identifiers, author name, encrypted access authorisations, approved versions, publication references and status | Check the connection and publish reviewed articles after the client’s separate authorisation | Performance of the contract (6(1)(b)); legitimate interest in securing access and keeping publication evidence (6(1)(f)) | Oryon Technologies, Supabase, Vercel and the platform selected by the client (WordPress, Wix, Webflow or Shopify) | Access credentials retained while connected and removed on disconnection. Published articles remain on the client website. Deletion requests and operations in progress are tracked separately | Depending on the selected platform and its subprocessors. Shopify: https://www.shopify.com/legal/privacy |
| Privacy requests sent by Shopify | Request type and reference, relevant store, deadline and follow-up; the affected customer’s identity only when needed to answer, in encrypted form | Handle access and deletion requests sent by Shopify and document their resolution | Legal obligations (6(1)(c)); legitimate interest in securing and recording their handling (6(1)(f)) | Oryon Technologies, Supabase, Vercel; report delivered to the relevant merchant through a verified channel | Encrypted identity becomes inaccessible after 30 days and is erased at the next daily cleanup, or earlier after handling. Minimised closed receipts: 365 days after resolution. Open requests: until resolution; necessary additional retention is separately justified | According to provider safeguards: https://supabase.com/privacy ; https://www.shopify.com/legal/privacy |
| SEO Studio subscription | Store or site identifier, billing provider, plan references, period, status and subscription verification date | Check the subscription and enable subscribed services; maintain contractual and accounting records | Performance of the contract (6(1)(b)); accounting obligations (6(1)(c)) | Oryon Technologies, Supabase, Vercel and the provider identified before subscription (Stripe or Shopify). Full payment-card details are processed directly by the provider | For the duration of the contractual relationship; invoices and billing records are retained for 10 years from the close of the financial year | Depending on the provider: https://stripe.com/fr/privacy ; https://www.shopify.com/legal/privacy |
| Online invoice payment, where offered | Invoice identifier, amount, currency, payment reference and status; payment information collected directly by Stripe | Collect and reconcile an invoice payment | Performance of the contract (6(1)(b)); accounting obligations (6(1)(c)) | Oryon Technologies and Stripe; no complete payment-card data is recorded by the Oryon portal | For the duration of the contractual relationship; invoices and billing records are retained for 10 years from the close of the financial year | Stripe may process data outside the EEA under its contractual safeguards; details: https://stripe.com/fr/privacy |
| Security and technical logs | IP addresses, server access logs, timestamps; for browser incidents on public pages: error category, public page, technical file path, deployed version, loading state and connection state | Website security, troubleshooting and abuse detection | Legitimate interest (6(1)(f)) — protection against abuse | Oryon Technologies and hosting provider Vercel Inc. — 440 N Barranca Avenue #4133, Covina, CA 91723, États-Unis | 90 days maximum | Server functions are configured in Paris, France. Website delivery also uses Vercel’s global network. Some processing may take place outside the European Economic Area, including in the United States. Transfer provisions are set out in Vercel’s data processing agreement: https://vercel.com/legal/dpa |
| Removing an old local preference | Possible presence of an old browser record; its contents are not read | Allow the user to remove this old record. No new tracker-related choice is recorded | User-requested deletion feature; no data is sent to Oryon Technologies | No recipients: detection and deletion remain in the browser | Old local preference only: until removed through cookie management or browser settings; no new choice recorded and no server-side copy retained | None |
Browser error reports are sent to the Oryon website for troubleshooting. They do not contain raw error messages, form contents or URL parameters. The system creates no cookie, visitor identifier or local storage; its requests omit cookies and the referring page address. It does not send reports from private pages.
The functional oryon_ui_locale cookie remembers the selected interface language for up to 180 days. The eight supported languages are French, English, Spanish, German, Italian, Portuguese, Dutch and Arabic. Separate Shopify connection, installation and billing language cookies last up to 10 minutes. Only the matching connection or installation context is removed on return; billing contexts remain until expiry for repeated returns. These preferences never authorise account access or a subscription. You can change the language using the selector or remove the browser cookie in your browser settings. For a signed-in account, an explicit language selection can also be saved with that account to choose the language of SEO Studio notifications; it is separate from article languages.
SEO Studio does not use Shopify’s customer or order APIs. Technical site access and payment information are not sent to the writing model. Image searches use keywords; selected images retain their source, licence and credits.
When a client configures transfer to Make, n8n or another destination, reviewed drafts and their images are sent there with separate authorisation. The client selects and administers that tool, whose processing conditions also apply.
Processing not currently implemented: audience analytics, advertising, newsletters, job applications and online appointment booking. This policy must be updated before any such processing is added.
3. Your rights
Under the GDPR and the French Data Protection Act, you have the following rights over your data: access, rectification, erasure, restriction, objection, portability where processing is based on consent or contract and carried out by automated means, and withdrawal of consent at any time without retroactive effect.
To exercise these rights, write to privacy@oryon-tech.com. We respond within one month, subject to the GDPR extensions for complex or numerous requests. An old local preference can be removed through the cookie-management controls on our Cookies page.
If, after contacting us, you believe your rights have not been respected, you can complain to the CNIL: https://www.cnil.fr/fr/je-suis-un-particulier or by post to CNIL, 3 Place de Fontenoy, 75007 Paris, France.
4. Security and transfers
The website is configured to use HTTPS in production. The hosting provider is Vercel Inc. — 440 N Barranca Avenue #4133, Covina, CA 91723, États-Unis. Hosting: Server functions are configured in Paris, France. Website delivery also uses Vercel’s global network. Some processing may take place outside the European Economic Area, including in the United States. Transfer provisions are set out in Vercel’s data processing agreement: https://vercel.com/legal/dpa. Google Workspace (Gmail) sends sign-in codes and website notifications. Google Workspace may process data outside the European Economic Area, depending on the processing locations of Google and its subprocessors. Processing terms: https://cloud.google.com/terms/data-processing-addendum/ ; subprocessors: https://workspace.google.com/terms/subprocessors/. Access to received enquiries is restricted to authorised people.
5. Changes to this policy
This policy is updated when the website’s processing activities change. The latest update date appears at the top of the page. Significant changes are announced on the home page before taking effect.