Last updated: 16 October 2026. This document is provided in English. It is a draft and does not constitute legal advice.
The short version
- Rendering, editing and exports run in your browser. Projects and analyses are saved only on your device.
- When you ask for an analysis, the public text of the website you enter (or, if you tick the box, your screenshot) is sent to Cloudflare Workers AI through our server to write your marketing copy. We do not store it.
- We do not use advertising or tracking cookies.
- If you buy a plan, we store the minimum needed to deliver it: your purchase email, Stripe customer/subscription IDs, a hashed license key and your plan status.
Who is responsible
The data controller is Karl MEHANNA, 56 D avenue Anatole France, 10000 Troyes, France. Contact: support@cigara.app.
What we process and why
Using the editor
Images, text and projects are processed and stored locally in your browser (IndexedDB and localStorage). We cannot see them. You can delete them from the Projects panel, from the License page, or by clearing your browser’s site data.
AI marketing analysis (Launch Studio)
When you analyse a website, your browser asks Microlink to capture the public page and read its text (title, headings, paragraphs, button labels), then sends that text to our server, which forwards it to Cloudflare Workers AI (an open-source language model run by Cloudflare) and returns the generated copy. If you analyse an uploaded screenshot and tick “Let AI read my screenshot”, the image is sent the same way. We do not log or store the content; rate-limit counters use a hash of your IP address. Cloudflare states that it does not use Workers AI inputs to train models. To fetch a website’s logo, our server downloads that public image on your behalf. Your analysis results are saved only in your browser (IndexedDB) until you start a new one or clear your browser data. Legal basis: performance of the service you request (art. 6(1)(b)).
Capturing a website by URL (optional)
When you use “Capture a website”, your browser sends the address you entered to Microlink (microlink.io), a third-party screenshot service, which also receives your IP address as part of the request. We do not receive this data. Only use it for public pages. See Microlink’s own privacy policy for details.
Purchases
Payments are handled by Stripe (Stripe Payments Europe, Ltd. and its affiliates), which processes your payment details under its own privacy policy. We receive and store: your email address, Stripe customer and subscription identifiers, plan, status, renewal date, remaining credits, the time you accepted the immediate-access notice, and a one-way hash of your license key. Legal basis: performance of a contract (GDPR art. 6(1)(b)) and legal obligations for accounting (art. 6(1)(c)).
Security and abuse prevention
Our hosting provider (Cloudflare) processes IP addresses and technical request data to deliver and protect the site. Our server keeps short-lived rate-limit counters derived from a hash of your IP address and error logs that may include your browser type. Legal basis: legitimate interest in keeping the service secure (art. 6(1)(f)).
Analytics
If enabled, we use Cloudflare Web Analytics, which does not use cookies and does not track you across sites, to count page views in aggregate.
Emails
Stripe sends receipts and payment notifications. If enabled, we send transactional emails (your license key) through Resend. We do not send marketing emails without your consent.
How long we keep data
- License records: while your purchase is active, then up to 3 years for support and disputes, unless you delete them earlier.
- Unpaid checkout records: deleted automatically after 3 days.
- Rate-limit counters: hours. Export usage logs: about 40 days.
- Accounting records held by Stripe and by us: as required by law (10 years in France).
Processors and transfers
We rely on Cloudflare (hosting, database, Workers AI), Stripe (payments), Microlink (website capture) and optionally Resend (email). Some are located in or transfer data to the United States under appropriate safeguards such as the EU–US Data Privacy Framework or Standard Contractual Clauses.
Your rights
You can access, correct, delete or export your data, object to or restrict processing. Use the “Delete my license data” button on the License page, or email support@cigara.app. You can complain to your data protection authority — in France, the CNIL (www.cnil.fr).