Privacy Policy

This policy explains how Exostack SARL (SIREN 922 481 981, Paris, France), publisher of Carillon, processes the personal data of the people who visit the Carillon website and who use a Carillon account. For this data, Exostack is the controller.

The data your apps send about their own users (push tokens, external identifiers, tags and delivery records) is processed by Exostack as a processor on behalf of the Customer that operates the app. That processing is governed by the Data Processing Agreement. If you use an app that relies on Carillon, contact the company that publishes the app.

What we process, why, and on which basis

Data	Purpose	Legal basis
Name, email address, password (stored as a one-way hash), account creation and update times	Creating and operating your account	Performance of the contract
Organization name, address slug, membership and role; invitations (invited email address, role, inviter, expiry)	Letting organizations manage their team	Performance of the contract
Session records: IP address and browser user agent at sign-in, expiry; sign-in codes for the command-line tool; access tokens for agents connected to the hosted MCP endpoint	Keeping you signed in and securing access	Performance of the contract and legitimate interest in security
The Terms of Service version you accepted and the time of acceptance	Proving which contract applies	Legitimate interest and legal obligation to prove the contract
IP address, timestamp and random event identifier for US visits to carillon.dev/tv	Attributing visits to connected-TV advertising campaigns (see below)	Legitimate interest
Sign-up attribution labels and advertising click identifier (see below)	Measuring which campaigns bring new accounts	Legitimate interest
Emails we send: invitations, password resets, billing notices, delivery incident notices and provider credential notices	Operating the service	Performance of the contract
Messages you send to support	Answering you	Performance of the contract and legitimate interest
Technical logs and metrics produced by the service	Operating, securing and troubleshooting the service	Legitimate interest

Rate limiting uses the IP address of each request in memory, to protect the service; it is not written to the database.

Sign-up campaign label

Links to Carillon may carry a source label (source, s or utm_source), a campaign label (campaign or utm_campaign) and a creative label (creative or utm_content). When you create an account, these labels are stored with your account to measure which campaigns bring new accounts, on the basis of our legitimate interest. Labels accept 1-32 ASCII letters, digits, dots, underscores and hyphens and are stored lowercase. Use campaign categories, not personal identifiers, in these labels.

An advertising click identifier supplied as gclid, twclid or rdt_cid may also be stored with your account for the same attribution purpose and legitimate-interest basis. It accepts up to 128 ASCII letters, digits, dots, underscores and hyphens and keeps its original letter case. During navigation, the website carries it as click_id. These click identifiers stay in our database in the European Union. ChatGPT advertising links may also carry an opaque oppref reference, preserved without modification for the server-side campaign measurement described below.

Missing values are stored as direct, and invalid values as invalid. Attribution is recorded once at account creation and kept with the account. Organization acquisition records also retain the creator's signup attribution and first live push date until the organization is erased.

Sign-up attribution sets no attribution cookie, uses no browser storage and assigns no visitor identifier. These labels are not sent to an advertising platform. Leaving the site and coming back without a labelled link loses the attribution. The separate, US-only measurement on carillon.dev/tv is described below.

ChatGPT campaign measurement

For accounts attributed to a ChatGPT advertisement with a ChatGPT click reference, we send organization registration and first successful live push events to OpenAI, United States, to measure campaign effectiveness. The transmitted data are the ChatGPT click reference, event type, timestamp, an organization-based event identifier and our public website address. No email address (including hashed email), IP address, browser user agent, Device Data or notification content is included.

The legal basis is our legitimate interest in measuring campaign effectiveness. Transmission takes place from our server; this integration installs no advertising script, pixel or cookie in the browser. Test-mode pushes do not count as activations. You may object to this processing as described under “Your rights”.

Television campaign measurement

When you visit carillon.dev/tv from the United States, the server forwards your IP address, a timestamp and a randomly generated event identifier to Vibe Media Inc., United States. Vibe uses these data to attribute the visit to a household exposed to a connected-TV advertisement. The legal basis is our legitimate interest in measuring the effectiveness of our television campaigns.

This transmission is limited to visitors located in the United States. No event is sent to Vibe for visitors in the European Union, the United Kingdom, Switzerland or any other country. The route redirects visitors to the Carillon website with campaign labels.

The transmission is server-to-server: no advertising script or cookie is placed in your browser. Public website analytics are described below. Vibe receives no Carillon account data, app users' data, device data or notification content through this measurement. You may object to processing based on legitimate interest as described under “Your rights”.

Public website analytics

We use Plausible Analytics to count visits to our public website and documentation and understand aggregate usage. Plausible is hosted in the European Union and uses no cookies or persistent visitor identifiers. It processes network and browser information to produce aggregate statistics. Plausible is designed to comply with the GDPR, and these cookieless analytics do not require a cookie consent banner. See Plausible's data policy for details.

Our integration sends public page paths and campaign labels (source, medium, campaign, creative and term). It excludes advertising click identifiers, other query parameters, fragments and referrers. It does not track account forms or the authenticated dashboard, and sends no account data, Device Data or notification content. Form, download and outbound-link tracking are disabled.

Cookies and browser storage

When you sign in, the dashboard sets an authentication cookie (__Host-carillon.session_token and the related cookies of the authentication library). They are strictly necessary for the service, HttpOnly, Secure and limited to the dashboard host. The dashboard does not store session tokens in browser storage.

The public pages set no cookie and serve their fonts from the Carillon host. They load the Plausible analytics script described below.

Payments

Paid plans are purchased through Stripe Managed Payments, where Stripe acts as the merchant of record and sells through Link. Stripe collects the payer's name, email address, billing address and payment details directly at checkout and processes them as an independent controller under its own privacy policy. Exostack creates a Stripe customer record that carries the Carillon organization identifier, and sends Stripe the organization's usage totals. Exostack sends Stripe no device data, app names or notification content. Exostack receives the subscription and invoice status back from Stripe.

Optional Google and GitHub sign-in

When offered, you may choose to sign in with Google or GitHub. Carillon receives your provider account identifier, name, email address, verification status and profile image, and stores the linked account and encrypted provider tokens to operate this sign-in method. This processing is for the performance of the account contract. The provider processes your sign-in request and connection metadata under its own privacy policy. We send it no device data or notification content. You can continue to use email/password or a configured passkey.

Recipients

Recipient	Role	Location
Plausible Analytics	Aggregate visits to public website and documentation pages	European Union
Vibe Media Inc.	Connected-TV campaign attribution for US visits to carillon.dev/tv only (IP address, timestamp and random event identifier)	United States
Google and GitHub (optional)	Account authentication, when you choose this method	International; see Google’s privacy policy and GitHub’s privacy statement
Scaleway SAS	Hosting, database, transactional email, logs and metrics	European Union
Stripe (Link)	Merchant of record for paid plans	International, including Ireland and the United States; see Stripe’s Privacy Center

Personnel of Exostack access personal data only when needed to operate the service or answer a request. Exostack does not sell personal data and does not use account data or Device Data for advertising. Website campaign measurement is limited to the attribution described in this policy.

Transfers outside the European Union

Exostack hosts the service in the European Union. Stripe may process payment data outside the European Union under the safeguards described in its own privacy policy. If you choose Google or GitHub sign-in, that provider may process authentication data outside the European Union as described in its privacy policy. For the US-only television campaign measurement described above, Vibe Media Inc. receives visitor IP addresses, timestamps and random event identifiers in the United States. This does not involve Device Data or account data.

Retention

Data	Retention
Account, organization and membership data	While the account exists, then deleted from active systems within 30 days of account closure, except where retention is required by law
Sessions	Expire seven days after the last use. Expired session records are deleted by daily maintenance.
Invitations	Expire 48 hours after they are sent. Records remain until deleted through the dashboard or the organization is closed.
Terms acceptance and sign-up label	With the account
Technical logs and traces	7 days
Metrics	31 days
Database backups	14 days

Your rights

You can ask for access to, correction of, or deletion of your personal data, ask for its restriction or portability, and object to processing based on legitimate interest. You can correct your name in the dashboard. For any other request, write to support@carillon.dev.

If you are not satisfied with the answer, you can lodge a complaint with the CNIL, the French supervisory authority (cnil.fr).

Changes

Each version of this policy is dated. Exostack will inform account holders by email of a change that affects how their data is used.