Privacy Policy

C2SL (hereinafter “we”) is committed to protecting the privacy of visitors to its orila.co site. This policy explains, in full transparency, which data is processed when you use this site, in accordance with the General Data Protection Regulation (GDPR).

1. Data controller

2. Data collected on this site

This site is a presentation site. It contains no form and no advertising or tracking cookie. By browsing it, you do not transmit any personal data to us, and we collect none for commercial purposes.

We do, however, measure how the site is visited, using our own measurement tool, which we host ourselves and share with no third party. This measurement is anonymous and cookie-free: it records the page viewed, where you came from if applicable, the window width, the time spent, the scrolling, relative mouse positions within the page and any technical errors encountered. It places nothing on your device, does not identify you and cannot follow you from one site to another — which is why no consent banner is shown to you.

The site only keeps, in your browser's local storage, a purely technical display preference. This element is not a tracking cookie, is never transmitted to a third party and does not allow you to be identified.

Like any online service, our host processes technical connection data (IP address, browser type) for security and proper operation purposes. This data is not used by us to identify you.

3. When you use the demo or create an account

By clicking on “Try the demo” or creating an account, you access the ORILA application, which constitutes a separate service. The data you enter there (your clients, your contacts, your appointments, etc.) is processed there as part of the performance of the service contract, and governed by the terms presented at the time of registration.

4. Purposes and legal bases

• Display and security of the site — legitimate interest (providing a functional and secure site).
• Anonymous, cookie-free audience measurement — legitimate interest (knowing which pages are read and spotting failures).
• Technical display preference — proper operation of the service, without tracking.
• Reply to your messages (if you write to us at our contact address) — legitimate interest in replying to you.

No processing for prospecting or profiling purposes is carried out from this site.

5. Recipients and processors

We neither sell nor rent your data, and we never use it to train anything.

5.1 For this showcase site

The only processor involved is our host, Cloudflare, Inc., which ensures the delivery and security of the site.

5.2 For the ORILA application

The application relies on the providers listed below. Each one is involved only for the stated purpose and receives only the data required for it. Those marked “if you connect it” receive nothing until you have enabled that connection in your settings, with your own credentials.

• Cloudflare, Inc. — hosting of the application, storage of the files you upload (photos, logos, attachments, project documents) and technical operating logs.
• Neon, Inc. — database hosting: all of your account data is stored there, on infrastructure located in Europe.
• Brevo (France) — email delivery, on two counts: the emails related to your account (address verification, forgotten password, invitations, due-date notices) and the sending of your quotes, invoices and campaigns to your own recipients. Receives the email address, the name and the content of the message.
• Your own email provider, if you choose to send from your business address: the message then leaves through your mail server, not ours.
• Pennylane (France) — accounting platform, if you connect it. It then receives your finalised invoices: your client's identity and billing details, VAT number, company registration number, line items and amounts.
• Meta Platforms — WhatsApp business messaging, if you connect your own number. ORILA receives the messages addressed to you and files them under the matching record; ORILA sends no message through this channel.
• Qonto (France) — bank connection, if you connect it. ORILA reads your accounts and transactions (date, label, amount, reference) for reconciliation; no payment order can be issued. Other banks go through the manual upload of a statement, with no third party involved.
• PayPlug (France) — collection of your subscription and of online payments. Your bank details are entered at PayPlug and never pass through ORILA: we receive only the amount, the reference and the outcome of the transaction.
• Telegram — internal alert to our team when you submit feedback or a request from the application. Receives the title, an extract of the message, your name and that of your organisation. No other data from your account is concerned.

5.3 Artificial intelligence — what is planned, and its limits

No artificial intelligence feature is active to date and none of your data is transmitted to such a provider. We would rather announce beforehand than explain afterwards: here is precisely what is planned.

When you upload a file to bring in your existing data, ORILA may call on an artificial intelligence provider to recognise your columns and match them to the corresponding fields. That provider would then receive only your column headings and a sample of a few rows — never the whole file, never automatically, and only at your request.

Three limits govern this feature, and they allow no exception: nothing is saved without you having seen and approved it; you are informed before anything is sent and you may decline, in which case column matching remains entirely manual; and the feature is disabled in the public demo. The provider we have selected is Mistral AI, a French company, used through its European endpoint: your data would be processed in Europe and would not be used to train its models. This feature is not live yet; this page will be updated on the day it is.

6. Hosting and transfers outside the European Union

The application data (that of your ORILA account) is hosted on an infrastructure located in Europe. The delivery of the showcase site is provided by Cloudflare, a company established in the United States; any transfers of technical data are governed by the Standard Contractual Clauses approved by the European Commission.

Several of the providers listed in article 5 are established outside the European Union, or may process technical data there. Those transfers are governed by the same Standard Contractual Clauses. The providers you connect yourself (accounting platform, business messaging, bank) remain governed by the contract you entered into directly with them.

7. Retention periods

• Technical browser preference: until you delete it yourself.
• Email exchanges with our contact: the time necessary to handle your request, then limited archiving.
• Technical connection data (host): limited period for security purposes.

8. Your rights

In accordance with articles 15 to 22 of the GDPR, you have the following rights:

• Right of access to your data
• Right of rectification
• Right to erasure
• Right to restriction of processing
• Right to object
• Right to portability
• Right to withdraw your consent at any time

To exercise these rights, write to us at [email protected]. We reply within one month. You may also lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, 75007 Paris, cnil.fr).

9. Security

We implement appropriate technical and organizational measures: encryption of communications (HTTPS/TLS), restricted access to data, and hosting on a secure infrastructure.

10. Changes

This policy may change, in particular if we add a form, a new provider or an audience measurement tool relying on cookies (a consent mechanism would then be put in place). The date of the last update appears at the top of this page.