This policy describes how PRG Sys ("we") collects and processes the personal data of users of the Incarneo service, in compliance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi « Informatique et Libertés »).
Data controller
The data controller is PRG Sys, 47 rue Vivienne, 75002 Paris. For any questions regarding your data: rgpd@incarneo.com. The Data Protection Officer (DPO), Gabriel Vanroy, can be reached at rgpd@incarneo.com.
Data collected
We process the following categories of data:
- Account data: name, e-mail address, password (encrypted), affiliated Organisation.
- Usage data: credits consumed, generation history, technical logs.
- Uploaded content: avatar photographs, reference voice samples, text scripts.
- Generated content: audio and video files produced by the Service.
- Billing data: information required to issue invoices and process payment (handled by our payment providers).
Voice samples and photographs may constitute biometric data within the meaning of Article 9 of the GDPR. Their processing is based on your explicit consent and on the performance of the contract, and is subject to enhanced security measures. We neither create nor retain any reusable voice model or biometric template: only the reference sample you provide and the generated files are stored. You undertake to provide only content for which you hold the necessary rights and authorisations (see the Terms of Use).
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Provision of the Service (audio/video generation, account management) | Performance of the contract |
| Processing of avatars and reference voices | Explicit consent |
| Invoicing and accounting | Legal obligation |
| Security, prevention of abuse and fraud | Legitimate interest |
| Verification of an affiliate's registration with the official business register | Performance of the contract / legal obligation (invoicing) |
| Service improvement and statistics | Legitimate interest / consent |
We do not use your content (voices, images, scripts) to train artificial intelligence models without your prior and separate consent.
Retention periods
- Account data: for the duration of the contractual relationship, then archived for up to 3 years after the last activity.
- Uploaded avatars and reference voices: until deleted by the user or the account is closed.
- Generated audio and video content: retained for a maximum of 6 months, without prejudice to the user's ability to delete it at any time.
- Billing data: 10 years (accounting obligation), via our invoicing provider.
- Technical logs: 12 months maximum.
The user may delete their content at any time and freely close their account from their account area; closure results in the deletion of their data, subject to the statutory retention periods set out above.
Recipients and processors
Your data is accessible to our authorised staff and to processors acting on our instructions, under agreements compliant with Article 28 of the GDPR:
| Provider | Purpose | Location |
|---|---|---|
| Scaleway | Stockage des médias (avatars, voix, rendus) | France (UE) |
| HyperStack (NexGen Cloud) | Calcul GPU pour la génération audio et vidéo | Canada (hors UE) |
| Stripe | Paiement des crédits | UE / États-Unis |
| Qonto | Facturation | France (UE) |
| Postmark | Envoi des e-mails transactionnels | États-Unis |
| Umami | Mesure d'audience (statistiques anonymisées) | UE |
Media storage and generation computing (voice, image) are carried out within the European Union. Certain providers may process data in the United States — in particular Stripe (payment) and Postmark (transactional e-mails). These transfers are governed by appropriate safeguards (standard contractual clauses of the European Commission or an adequacy mechanism, such as the Data Privacy Framework).
Affiliate programme
When a user applies to join the affiliate programme, their SIREN number is transmitted to the official business register (API Recherche d'entreprises, operated by DINUM using INSEE data and the national business register) in order to verify their registration and retrieve the legal particulars required for invoicing: company name, legal form, registered office address, activity, VAT number and directors. This information comes from public registers and is retained with the account for the duration of the programme. The programme conditions are set out in the Affiliate terms.
Your rights
In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent at any time and to set out directives regarding the fate of your data after your death. You may exercise these rights by writing to rgpd@incarneo.com.
You also have the right to lodge a complaint with the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL) — www.cnil.fr.
Security
We implement appropriate technical and organisational measures (encryption of passwords and data flows, access control, storage of media in a secure space) to protect your data against any unauthorised access, alteration or disclosure.
Cookies and audience measurement
Incarneo sets without consent only those cookies that are strictly necessary for the operation of the Service. No advertising cookie or third-party profiling tracker is set. An affiliate cookie, described below, is set only with your explicit agreement.
| Type | Purpose | Consent |
|---|---|---|
| Session cookies | Authentication, security (CSRF protection), session persistence | Not required (strictly necessary) |
| Preference cookies | Remembering interface choices | Not required |
| Audience measurement (Umami) | Anonymised traffic statistics, with no cross-site tracking and no advertising cookie | Exempt (configuration compliant with CNIL recommendations) |
Affiliate (aff_ref) | Linking your registration to the person who introduced you to the Service, so that their commission can be paid — retained for 90 days | Required (never set without your agreement) |
Audience measurement is carried out with Umami, a privacy-friendly solution that sets no tracking cookie and does not allow visitors to be re-identified. You may configure your browser to refuse some or all cookies; blocking strictly necessary cookies may, however, prevent access to the Service.
Your choice is remembered for 365 days and may be changed at any time below.
Changes to this policy
This policy may be updated at any time. The applicable version is the one published on this page. In the event of a substantial change, users are informed by appropriate means.
This policy is a translation provided for information purposes only: in the event of any discrepancy, the French version alone shall prevail.