Privacy policy

Version of October 10, 2026 (the waitlist also records the channel through which you reached the site).

Data controller

Thomas Cohen, sole trader, 8 chemin des Hauts Graviers, 91370 Verrières-le-Buisson, France. Contact: contact@bemaestro.fr. No data protection officer has been appointed.

What never leaves your machine

Your projects (ideas, documents, generated code, version history) live on your computer. They do not pass through our servers. If you enable online backup, it goes to your own GitHub account, using your credentials, in a repository you own. The AI assistants you connect (Claude Code, Codex, Cursor, Mistral Vibe) operate under your subscription and their own terms.

Processing activities, one by one

1. The waiting list and referrals

When you sign up, we record the page language, your chosen email language and, if you provide it, the operating system you would like to use Maestro on. We use this information to adapt messages and prepare beta access. Your declared system is separate from optional usage measurements in the app. The signup form does not use your IP address to infer your country or language.

• Data: your email address, a referral code, the code of the person who referred you, if applicable, and the channel through which you reached the site (a campaign name or the domain of the site you came from, never the full page address).
• Purpose: to notify you when your turn comes, give priority to people who spread the word about Maestro, and learn which channels make Maestro known.
• Legal basis: pre-contractual steps taken at your request (GDPR, Article 6(1)(b)).
• Retention: until the beta ends, with removal available at any time on request.
• Recipients: Supabase (storage, data in the European Union), Resend (sending the confirmation email and invitation).

2. The Maestro account and license

• Data: your email address, your license (beta, then your chosen plan), and, if you connect GitHub, your GitHub username and avatar.
• Purpose: to sign you into the application (an email sign-in code, never a password), manage your invitation, and enable online backup and teamwork if you turn them on.
• Legal basis: performance of the contract (the terms of use).
• Retention: until you delete your account, which you can do yourself in the application's Settings. Deletion removes the account, profile, and license, as well as the usage measurements and reports linked to the account.
• Recipients: Supabase (storage, data in the European Union), Resend (sending sign-in codes).

3. Application usage measurements

• Data: technical events (session starts, screens visited, stages completed, errors, AI assistants used), application version, operating system, language, and a random installation identifier. When you are signed in to your Maestro account, these events are linked to your account. An installation with no signed-in account sends the same events, without any link to an account.
• What is never sent, linked or not: your ideas, your documents, your code, your messages to assistants, the names of your products and the paths of your files.
• Purpose: to understand what works, what breaks, and what gets in the way, so we can improve the product; and, when something breaks for you, to see where without asking you for screenshots, so we can help you faster.
• Legal basis: our legitimate interest in improving the product and supporting people in the beta (GDPR, Article 6(1)(f)). Sharing is on by default and can be turned off at any time in the application's Settings (“Help improve Maestro”), which counts as an objection.
• Turning it off: turning off sharing erases the events that had not yet been sent and replaces the installation identifier. It also removes the link between your account and the events already received, as soon as your account is signed in to the application: if you are offline or signed out, Maestro says so and does it at the next sign-in (deleting the account erases these events in any case). Once the link is removed, the events already received become anonymous and can no longer be traced back to you.
• Retention: a rolling 12 months, followed by automatic deletion. Deleting your account deletes the events linked to it.
• Recipients: Supabase (storage, data in the European Union). Only the publisher views them, through a tool reserved for him.

Emails from Thomas

Product news, testing invitations, and follow-ups each have an independent email preference based on your consent. You can change them in the application, under “Emails from Thomas”, or through the personal link included in messages. That link also lets you request help, a thirty-day pause, or a stop to these emails. Sign-in codes remain available. Preferences are kept until you change them, request erasure, or delete your account. Supabase stores them and Resend sends the messages, as described below.

Choosing “Let me know when this issue is fixed” voluntarily sends the report message and account identity to track its resolution. It does not enable any other email category.

4. Support

• Data: messages you send us (the “Report a problem” button in the application, or email), together with, for in-app reports, the technical log you see before sending.
• Purpose: to reply to you and fix problems.
• Legal basis: our legitimate interest in providing product support.
• Retention: while your request is being handled, then for no more than 12 months.
• Recipients: Hostinger (email inboxes), Supabase (reports sent from the application).
• Link to your account: a report sent from the application while you are signed in and usage sharing is on is linked to your account. It is deleted along with your account.

5. Website analytics

• Data: page views and visit source (referring site, campaign), device type, browser, and country; all aggregated, without cookies, individual identifiers, or cross-site tracking (Vercel Web Analytics, served by the website host). When detailed journey measurement is enabled, guided-tour steps viewed and sign-up confirmations are also counted. These events contain no email address, entered content, or referral code. The public guide that linked to the form, the form’s placement and the site language may accompany the confirmation. No browsing history is stored in your browser.
• Purpose: to know which pages are read and where visits come from, and understand the journeys that lead to sign-up, so we can improve the website.
• Legal basis: our legitimate interest in measuring website traffic using data that cannot identify you.
• Retention: only aggregate statistics are retained.
• Recipient: Vercel (see transfers below).

Transfers outside the European Union

Data for the processing activities above is stored in the European Union (Supabase, AWS data center in Ireland). Some providers are established outside the EU:

• Vercel Inc. (United States), website hosting and analytics: certified under the EU–US Data Privacy Framework.
• Plus Five Five, Inc. (Resend, United States), email delivery: certified under the Data Privacy Framework, supplemented by standard contractual clauses.
• Supabase, Inc. (Singapore / United States): European Commission standard contractual clauses.
• GitHub / Microsoft (United States), only if you connect GitHub: certified under the Data Privacy Framework.

Your rights

You have rights of access, rectification, erasure, restriction, objection, and portability, as well as the right to withdraw consent at any time without affecting the lawfulness of prior processing. You may also provide instructions regarding your data after your death, under Article 85 of French Law No. 78-17 of January 6, 1978. You can exercise these rights by contacting contact@bemaestro.fr.

You may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at cnil.fr.

Minors

Maestro is intended for people aged fifteen and over. Under Article 45 of French Law No. 78-17, a child under fifteen cannot consent alone: consent must be given jointly by the child and the holder or holders of parental responsibility.

Cookies and trackers

This site sets no cookies and loads no remote fonts. Its traffic is measured without cookies or cross-site tracking (details in processing 5 above). When you choose a language in the header, that choice is stored in your browser's local storage, on your explicit action. This preference is used only for the language choice: it does not track your visits and does not rely on your IP address. You can clear it in your browser's site data. The storage of and access to trackers on this site are governed by article 82 of French law no. 78-17 of 6 January 1978.

The application's usage measurements (processing 3 above) do not go through this site: they are described with their legal basis in that processing and can be turned off at any time in the application's Settings.