Privacy policy

Version dated 27 September 2026 · For business customers only.

1. Data controller

Flavian Combes, a sole trader operating under the trade name Cybersignal, 60 rue François 1er, 75008 Paris, France, is the controller for the processing described here for ChangeWatch. Contact: changewatch@cybersignal.fr.

2. Data and sources

We process business contact details, name and company, emails and correspondence, submitted URLs, monitoring settings, subscription and billing information, payment references and statuses, check results, alerts, summaries and information needed for support. Technical connection, execution and deliverability data may be processed for operation and security.

Data comes from your forms, communications and subscriptions, configured public pages and technical service events. Public pages may contain personal data; do not provide pages or sensitive information unnecessary for lawful business monitoring. Full card details are entered with Stripe and are not directly stored by ChangeWatch.

3. Purposes and legal bases

• Pre-sales enquiries and assistance: answering questions and preparing setup, based on pre-contractual steps requested by the person concerned or the legitimate interest in responding to an organisation’s representative.
• Subscription and service delivery: managing the customer relationship, subscription, setup, checks, email alerts, weekly summaries and support, based on performance of the contract with the person concerned or the legitimate interest in providing the service to their organisation.
• Invoicing and payment monitoring: fulfilling contractual commitments, handling incidents and meeting legal, tax and accounting obligations.
• Fraud prevention, security and defence of rights: protecting the service, investigating anomalies, handling disputes and preventing abuse, based on the corresponding legitimate interests and applicable legal obligations.

Information needed to respond, invoice or configure the service must be provided for those purposes. Optional fields are marked. This website does not provide user account creation; subscriptions are administered with the team and relevant providers. The pre-sales form remains optional before purchase.

4. Recipients and providers

Access is limited to the operator, authorised persons and necessary providers according to their duties. Authorities and advisers may receive information required by law or needed to defend rights. Providers may act as processors or, for certain purposes of their own, as separate controllers, depending on their terms and the processing involved.

• Stripe: payment pages, recurring subscriptions, billing data and transaction monitoring. Stripe privacy policy.
• Cloudflare Turnstile: anti-spam checks for the form, processing technical browser data needed for this protection. The resulting token is passed to Formspree for validation. Cloudflare privacy policy.
• Formspree: receiving and forwarding form enquiries. Formspree privacy policy.
• Apify: running monitoring, configuring URLs and processing results and associated technical data. Apify privacy policy.
• Resend: sending service emails, including alerts and summaries, and handling deliverability information. Resend privacy policy.
• GitHub Pages / GitHub: hosting the public website and processing technical browsing data. GitHub privacy policy.

5. Locations and transfers

Data is not necessarily hosted only in France. Depending on their infrastructure and participants, some providers may process data outside France or the European Economic Area. Relevant transfers must be covered by applicable mechanisms: an adequacy decision where it actually covers the recipient, standard contractual clauses and, where necessary, supplementary measures. Providers’ policies explain their arrangements. You can contact us for information about the safeguards applicable to the processing of your data.

6. Retention

• Pre-sales enquiries: while the enquiry is being handled and during useful follow-up correspondence; data no longer useful for that follow-up is deleted or anonymised.
• Customer data and configuration: during the contractual relationship and for the time needed to close the service. Data needed for a dispute or legal obligation is then separated into restricted-access archives.
• Results, alerts and reports: for as long as useful to provide and verify the service; histories no longer needed are deleted or anonymised, unless retention is justified by law or litigation.
• Security and deliverability logs: for the time needed for diagnosis, abuse prevention and incident handling, extended only where justified by an incident or obligation.
• Invoices and accounting records: for the applicable statutory retention period. Evidence of the contract is retained for the relevant limitation periods.

These criteria are applied according to the nature of the data, its necessity and the relevant obligations, without indefinite retention as a default. You may request details about retention of your data. Providers may retain some information for their own obligations, in accordance with their policies.

7. Your rights

Under the conditions set out in applicable regulations, you have rights of access, rectification, erasure and restriction. You may object, on grounds relating to your situation, to processing based on legitimate interests, and exercise data portability where its conditions are met. These rights may be limited by a legal retention obligation or the need to defend legal claims.

Send your request to changewatch@cybersignal.fr, specifying the data concerned. Proportionate evidence of identity may be requested if there is reasonable doubt about your identity. You may also lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), the French data protection authority.

8. Security and confidentiality

Appropriate measures are implemented to limit access to data and protect communications and processing. No transmission or infrastructure can guarantee zero risk. Do not send secrets or full card details in the form or support messages. Report any suspected incident to our contact address.

Blog comments

When you submit a comment, we process your name, email address and comment content for moderation and follow-up related to that comment. Only comments approved after moderation are published, with the commenter’s name; the email address is not displayed publicly. Supabase is the technical provider used to store and process these data. They are retained for as long as necessary for moderation, comment-related follow-up and compliance with our applicable obligations. This system does not send names, email addresses or comment content to Google Analytics or Google Ads.

9. Cookies and optional analytics

With your consent, ChangeWatch uses Google Analytics 4, provided by Google, to measure page visits and certain commercial actions: clicks towards Stripe plans, visits to pricing or contact sections, and enquiries accepted by Formspree. A click towards Stripe is not a sale. This optional processing is based on your consent. It is not required to browse the website, subscribe or use the form.

Without consent, the Analytics tag is not loaded and no measurements are sent to Google Analytics. The banner lets you accept all, reject all or choose audience measurement and advertising separately. The “Manage cookies” link in every page footer lets you change your choice and withdraw consent. Withdrawal stops future measurement; Analytics and Ads cookies accessible to the website are removed where technically possible. It does not retrospectively delete data already sent.

Your choice, whether acceptance or refusal, is stored for six months in this browser’s local storage solely to apply your preference. If the browser blocks storage, the choice applies only to the open page. Without JavaScript, neither Google tag loads. Clearing browser storage or using another browser triggers a new request for consent.

After consent, Analytics uses browser identifiers and cookies _ga and _ga_*, technical device information and page-view and action events. The website code sets Analytics cookies to expire after 180 days, without automatically extending them on every visit. This is separate from data retention within the GA4 property.

Events defined by ChangeWatch contain no name, email, phone number, message or URL entered in the form. Page addresses sent are restricted to known public paths, without query parameters or fragments; the referring page address is not sent. This also limits the information available for visit attribution. With your explicit consent, Google Ads (AW-18472426652) also measures advertising and permits ad personalisation. Enhanced conversions and form-data sharing are not enabled. With advertising consent, Google Ads performs base measurement and receives a conversion event only when Formspree accepts an enquiry. GA4 independently measures the enquiry with audience-measurement consent. No enquiry fields are attached to these events.

Google receives Analytics and advertising data after consent. Its infrastructure may involve processing outside the European Economic Area; section 5 also addresses transfers. See the Google privacy policy and the Google data processing terms.

Advertising consent includes storage, advertising-related data and ad personalisation. A previous Analytics-only consent is renewed before Ads can load. Ads may use first-party _gcl_* cookies and Google cookies according to its configuration; their lifetimes and server-side retention are distinct from the GA4 settings below. See Google’s cookie information. Withdrawal removes accessible first-party Analytics and Ads cookies, but cannot delete Google-domain or HttpOnly cookies. No contact details or form fields are sent to Google.

The GA4 property settings verified by the controller are 2 months for event data and 14 months for user data. Resetting retention on new activity is enabled: new measured activity moves the user identifier’s retention expiry to 14 months after that activity. This reset concerns user data, not the event retention period. These settings do not limit retention of standard aggregated reports. Google’s explanation of retention.

In ChangeWatch’s GA4 property, Google Signals and user-provided data collection are disabled. Enhanced measurement is enabled; the tag is separate from the document containing the form and receives only the page information and events defined by the website, to limit automatic measurement to useful data. The settings have been verified by the website operator.

The form retains its AJAX submission to Formspree and Cloudflare Turnstile anti-spam protection, independently of your Analytics choice. These services process the data needed for contact and security described above. Payment pages hosted by Stripe apply their own policy; no Stripe payment library is embedded in this website.

10. Changes to this policy

This policy may change to reflect applicable processing and rules. The version date appears at the top of the page. Customers will be appropriately informed of substantial changes affecting them.