Privacy policy

Version dated September 5, 2026 (clarifications on cookie-free analytics and optional support).

Data controller

Thomas Cohen, sole trader, 8 chemin des Hauts Graviers, 91370 Verrières-le-Buisson, France. Contact: contact@bemaestro.fr. No data protection officer has been appointed.

What never leaves your machine

Your projects (ideas, documents, generated code, version history) live on your computer. They do not pass through our servers. If you enable online backup, it goes to your own GitHub account, using your credentials, in a repository you own. The AI assistants you connect (Claude Code, Codex, Cursor, Mistral Vibe) operate under your subscription and their own terms.

Processing activities, one by one

1. The waiting list and referrals

When you sign up, we record the page language, your chosen email language and, if you provide it, the operating system you would like to use Maestro on. We use this information to adapt messages and prepare beta access. Your declared system is separate from optional usage measurements in the app. The signup form does not use your IP address to infer your country or language.

• Data: your email address, a referral code, and the code of the person who referred you, if applicable.
• Purpose: to notify you when your turn comes and give priority to people who spread the word about Maestro.
• Legal basis: pre-contractual steps taken at your request (GDPR, Article 6(1)(b)).
• Retention: until the beta ends, with removal available at any time on request.
• Recipients: Supabase (storage, data in the European Union), Resend (sending the confirmation email and invitation).

2. The Maestro account and license

• Data: your email address, your license (beta, then your chosen plan), and, if you connect GitHub, your GitHub username and avatar.
• Purpose: to sign you into the application (an email sign-in code, never a password), manage your invitation, and enable online backup and teamwork if you turn them on.
• Legal basis: performance of the contract (the terms of use).
• Retention: until you delete your account, which you can do yourself in the application's Settings. Deletion removes the account, profile, and license.
• Recipients: Supabase (storage, data in the European Union), Resend (sending sign-in codes).

3. Usage measurements (telemetry)

• Data: anonymous technical events (session starts, screens visited, stages completed, errors), application version, operating system, language, and a random installation identifier. This identifier is never linked to your account or email: we see what an installation does, not who you are.
• Purpose: to understand what works, what breaks, and what gets in the way, so we can improve the product.
• Legal basis: your consent, requested on first launch and withdrawable at any time in Settings.
• Retention: a rolling 12 months, followed by automatic deletion.
• Recipients: Supabase (storage, data in the European Union).

Optional support in Maestro

A separate option, off by default, allows us to link to your account the first observed signed-in launch, recent visits, application version, operating system, and main getting-started milestones. No project name, path, or content is transmitted. These observations help us offer relevant assistance; they are never linked to the anonymous telemetry identifier, and stages completed before your consent are not reconstructed.

You can withdraw this choice in “Support and emails”. Withdrawal stops tracking and requests deletion of the observations on the server. If you are offline, Maestro indicates that confirmation must be retried. Deleting your account also deletes this data.

Product news, testing invitations, and follow-ups each have an independent email preference based on your consent. You can change them in the application or through the personal link included in messages. That link also lets you request help, a thirty-day pause, or a stop to Pupitre emails. Sign-in codes remain available. Preferences are kept until you change them, request erasure, or delete your account. Supabase stores them and Resend sends the messages, as described below.

Choosing “Notify me when this issue is fixed” voluntarily sends the report message and account identity to track its resolution. It does not enable usage tracking or other email categories. The technical log remains separate from this identified follow-up.

4. Support

• Data: messages you send us (the “Report a problem” button in the application, or email), together with, for in-app reports, the technical log you see before sending.
• Purpose: to reply to you and fix problems.
• Legal basis: our legitimate interest in providing product support.
• Retention: while your request is being handled, then for no more than 12 months.
• Recipients: Hostinger (email inboxes), Supabase (reports sent from the application).

5. Website analytics

• Data: page views and visit source (referring site, campaign), device type, browser, and country; all aggregated, without cookies, individual identifiers, or cross-site tracking (Vercel Web Analytics, served by the website host). When detailed journey measurement is enabled, guided-tour steps viewed and sign-up confirmations are also counted. These events contain no email address, entered content, or referral code.
• Purpose: to know which pages are read and where visits come from, and understand the journeys that lead to sign-up, so we can improve the website.
• Legal basis: our legitimate interest in measuring website traffic using data that cannot identify you.
• Retention: only aggregate statistics are retained.
• Recipient: Vercel (see transfers below).

Transfers outside the European Union

Data for the processing activities above is stored in the European Union (Supabase, AWS data center in Ireland). Some providers are established outside the EU:

• Vercel Inc. (United States), website hosting and analytics: certified under the EU–US Data Privacy Framework.
• Plus Five Five, Inc. (Resend, United States), email delivery: certified under the Data Privacy Framework, supplemented by standard contractual clauses.
• Supabase, Inc. (Singapore / United States): European Commission standard contractual clauses.
• GitHub / Microsoft (United States), only if you connect GitHub: certified under the Data Privacy Framework.

Your rights

You have rights of access, rectification, erasure, restriction, objection, and portability, as well as the right to withdraw consent at any time without affecting the lawfulness of prior processing. You may also provide instructions regarding your data after your death, under Article 85 of French Law No. 78-17 of January 6, 1978. You can exercise these rights by contacting contact@bemaestro.fr.

You may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at cnil.fr.

Minors

Maestro is intended for people aged fifteen and over. Under Article 45 of French Law No. 78-17, a child under fifteen cannot consent alone: consent must be given jointly by the child and the holder or holders of parental responsibility.

Cookies and trackers

This site sets no cookies and loads no remote fonts. Traffic is measured without cookies or cross-site tracking (see processing activity 5 above). When you choose a language in the header, that choice is saved in your browser’s local storage following your explicit action. This preference is used only for language selection: it does not track your visits or rely on your IP address. You can remove it by clearing this site’s data in your browser. The application usage measurements described above rely on your consent. Storing and reading trackers is governed by Article 82 of French Law No. 78-17 of January 6, 1978.