Privacy

Privacy notice

Last updated: 25 September 2026

This notice describes every piece of personal data Outfold Systems stores, the table or the bucket it lands in, why it is kept and how to get it back or deleted. It is written from the code that runs this surface rather than from a template, so the lists below are the actual fields, not a category summary.

1. Who is responsible

The data controller is Ether's, a French sole proprietorship registered under SIREN 879 425 049, trading as Outfold Systems.

• Address: Ether's, Paperboy 6372, 20 quai de Lorraine, 11100 Narbonne, France
• Contact for anything in this notice: contact@alexandrecorne.com

There is no data protection officer. Alexandre Corne handles these requests himself.

2. What this notice covers

It covers the Outfold Systems pages, which are /ai and everything under it on alexandrecorne.com: the landing page, the Businesses page, the enquiry form, the sign-in page, the client area at /ai/me, the intake questionnaire and the documents it produces, together with the API endpoints those pages call.

The rest of alexandrecorne.com is a personal landing page with its own privacy policy, linked from its own footer. Elite Outsiders, byForja and byCaliber each have their own too.

One page falls between the two. The Businesses interest form at /business on alexandrecorne.com carries the Outfold Systems name but sits outside /ai. It writes your name, email address, note, IP address and browser user agent to a separate table (business_interest_leads) in the same database. It is listed here so the picture is complete.

3. Where the data is held, and who can read it

Everything described below is stored on Cloudflare infrastructure: a Cloudflare D1 database for the rows, and a Cloudflare R2 bucket for the files you upload. Cloudflare, Inc. is a United States company and serves this from its global network.

Alexandre Corne is the only person with access. There is no team, no shared inbox and no support tool. He works from Da Nang, Vietnam, and reads this data from there. Cloudflare and Resend are the only other parties that hold any of it, in the roles described in section 6. The password breach check described in section 4.3 receives a five-character fragment of a hash and your network address, and nothing else.

4. What is collected, surface by surface

4.1 The enquiry form on /ai/contact

What you type goes straight into our own database. No third-party form service is involved. Stored in realai_leads:

• Name, email address, company, website and the message you write.
• Your IP address and your browser user agent, recorded with the submission.
• A timestamp, and a status we update as the enquiry moves along.

Why: to answer you and to take the steps you asked for before any engagement (Art. 6(1)(b) GDPR). The IP address and user agent are kept for abuse prevention (Art. 6(1)(f), legitimate interest): the form accepts at most eight submissions per IP address per hour.

4.2 The interest form on /ai/business

Same table, same rate limit. Stored: name, email address, your note, IP address, browser user agent, timestamp. The note is tagged so these are told apart from the enquiries above.

4.3 Signing in to the client area

Sign-in uses an email address and a password. Anyone can create an account on the sign-in page. An account you create yourself only reaches a waiting screen until your address is verified, which you do by choosing your password through a link we email you (Forgot password?) or hand you; the client area then opens after a call. When you create an account, ask for a link, or set a password from one:

• A row is written to auth_credentials: your email address, a hash of your password, whether we have verified the address, how the account was created, and the times it was created, last changed and last used to sign in.
• Your password is never stored. Only a salted scrypt hash is kept, sealed with a secret key that is not in the database, so nobody reading the database can recover your password or test guesses against it. We cannot read your password and we cannot send it to you: if you lose it, we send you a link to choose a new one.
• A link to choose a password, which we email you when you use Forgot password? or hand you ourselves, is recorded in auth_setup_tokens: your email address, who issued it (you, or us), its expiry and the time it was used. The link itself is never stored, only a SHA-256 hash of it. Asking for a link for an address we have nothing on file for sends nothing, and the answer looks the same either way, so the page cannot be used to find out who is a client. At most three links an hour are emailed to one address.
• Failed attempts are counted per email address and per network address in auth_throttle, so that password guessing can be stopped. The counters are kept under a keyed hash, not in the clear, and are cleared within two days.
• When you choose a password, the first five characters of its SHA-1 hash are sent to the Pwned Passwords service (haveibeenpwned.com) to check whether the password appears in a known data breach. The password itself, and the rest of the hash, never leave our servers. If the password is in a breach you are asked to pick another.
• Rows written by the earlier sign-in by emailed link or code (magic_link_tokens and pending_logins, before 25 September 2026) are still in the database, unused, until they are deleted by hand.

4.4 The session cookie

One cookie, __Host-rai_session. Strictly necessary: it is what keeps you signed in, and it is set only after you sign in. HttpOnly, Secure, SameSite=Lax, for up to thirty days, ended after fourteen days without use, or immediately when you sign out or change your password.

Its value is a random identifier that means nothing by itself and contains no personal data. We store, next to a hash of that identifier: your email address, when the session started, was last used and ends, your IP address and your browser user agent, so that a session can be recognised and ended (in auth_sessions). A cookie named rai_session, set by the earlier sign-in by emailed link, is deleted from your browser when you sign in or out and is no longer accepted.

There are no other cookies on this surface. No analytics cookie, no advertising cookie, no consent banner, because there is nothing to consent to.

4.5 The client area on /ai/me

Reads two tables and shows you only your own rows:

• realai_clients: your email address, name, company, the stage the engagement is at, a link to your intake, private notes, timestamps.
• realai_deliverables: the title, kind, status, link and due date of what is being produced for you.

4.6 The intake questionnaire on /ai/me/intake

An intake record is created the first time you open the page, and linked to your client row. Stored:

• creators: your name, brand name, email address, website, a slug built from your brand name, and a status.
• creator_answers: one row per question, holding the answer as you saved it. Answers autosave as you go, so a partial questionnaire is stored too.

4.7 The files you upload

The questionnaire accepts images: profile picture, banner, signature, logo, a screenshot of your home page and one of your funnel. Up to eight megabytes each, images only.

• The file itself goes to the Cloudflare R2 bucket ac-creator-assets, under a key that contains your intake identifier.
• creator_assets records the kind, the storage key, the content type, the size and a colour palette extracted from the image by your own browser at upload time.
• Files are served back only to you, through an endpoint that checks your session first. The bucket is not public.
• Worth knowing: when you upload a replacement of the same kind, the database row is replaced but the previous file stays in the bucket. Ask and it is deleted.

4.8 The two documents

From your answers, two documents are computed and frozen: a "before" and an "after". Each is stored whole in creator_outputs as a snapshot with the time it was generated. The page you read never recomputes them, which is why a later change to the engine cannot alter a document you have already been shown.

4.9 The activity log

Two small tables record what happened and when: realai_events (enquiry received, account created, signed in, password set or changed, a link to choose a password issued by us) and creator_events (intake started, section completed, file uploaded, documents generated). Some rows carry a detail field that can contain your email address or the identifier of your enquiry.

4.10 Server logs

Cloudflare processes the standard request metadata of any web request, including IP address, user agent and country, for security, rate limiting and performance. That processing follows Cloudflare's own retention policy, not ours.

5. What is not done here

No analytics of any kind runs on these pages. Not Google Analytics, not Plausible, not Cloudflare Web Analytics, not Meta Pixel, not Hotjar. There is no first-party analytics table either, no heatmap, no scroll tracking, no outbound-click tracking and no email open pixel.

No advertising, no profiling, no cross-site tracking, no fingerprinting. Your data is never sold and never shared with an advertiser. No automated decision produces a legal effect for you: the documents in section 4.8 are computed from your own answers and are read by a person.

There is no newsletter on this surface, so nothing you send here subscribes you to anything.

6. Who else touches the data

• Cloudflare, Inc. (United States), as host and as the operator of the database and the file storage. Privacy policy
• Resend (United States), to deliver two kinds of email: the link to choose a password, sent to you when you use Forgot password?, and the notification we receive when you write to us in the client area. Resend receives the address the email goes to, the subject, the body of the message (the link, or an excerpt of your message) and two internal labels. It receives nothing else. Privacy policy
• Have I Been Pwned (Pwned Passwords), to check that a password you choose has not appeared in a known data breach. It receives the first five characters of a SHA-1 hash of the password and the connection data of our server request, never the password and never your email address. Privacy policy
• Google Fonts. Your browser fetches the Inter typeface from Google's servers when you open one of these pages, which means Google sees your IP address and user agent. The font files are not self-hosted. Privacy policy
• Cal.com, for booking a call. The booking page at /call embeds the Cal.com scheduler, so Cal.com receives your connection data when that page loads, and the details you enter only if you book. The "Book a call" link on the Businesses page opens Cal.com directly. Privacy policy
• YouTube. The video previews on the landing page are still images stored on this site. A player from youtube-nocookie.com loads, and YouTube sees your request, only after you click one of them. Privacy policy

7. Transfers outside the EEA

Cloudflare, Resend, Google and Cal.com are United States companies, so personal data is processed outside the European Economic Area. The password breach check is also run outside it. Those transfers rely on the safeguards those providers put in place, in particular the European Commission's Standard Contractual Clauses.

Separately, the controller himself accesses this data from Vietnam, as stated in section 3.

8. How long it is kept

Stated as it actually works today, not as an intention:

• Your password hash is kept for as long as the account exists.
• A link to choose a password stops working after one use, and after one hour when we email it to you or seven days when we hand it to you. Its row is deleted thirty days after it expires.
• A session ends after thirty days, after fourteen days without use, or at once when you sign out or change your password. Its row is deleted once it has ended.
• Failed-attempt counters are deleted within two days.
• Enquiries are kept while the enquiry is live and afterwards as a business record.
• Client rows, intake answers, uploaded files and generated documents are kept for the duration of the engagement and afterwards.
• No scheduled deletion job runs on this surface. Expired sign-in records (sessions, links and attempt counters) are cleared as the site is used. Everything else is deleted by hand, and it is done when you ask.

9. Your rights

Under the GDPR you can ask to access your data, correct it, have it erased, restrict or object to how it is used, receive it in a portable format, and withdraw consent where consent is what allows the processing. Under the French Loi Informatique et Libertés you can also leave directives about what happens to your data after your death.

Write to contact@alexandrecorne.com. The answer comes within one month. Because there is no automated export tool, an access or portability request is answered by hand, from the tables named in section 4, which is why they are named.

If you think your rights have not been respected, you can complain to the CNIL, the French supervisory authority, at cnil.fr, or to the authority where you live.

10. Security

• Everything is served over HTTPS.
• Passwords are never stored: only a salted scrypt hash, sealed with a key that is kept outside the database. A password must be at least fifteen characters and is refused if it appears in a known data breach.
• Links to choose a password, session identifiers and hand-off tickets are stored only as a hash, never in a readable form, and a link works once.
• The session cookie is a random identifier: it cannot be forged or edited, and a session can be ended on our side at once.
• Rate limits sit on the forms (per IP address) and on sign-in (per email address and per network).
• The client-area endpoints refuse anonymous callers, and refuse an intake identifier that does not belong to the signed-in client, whether or not that identifier exists.

No system is beyond reach. If something goes wrong that affects your data, you will be told.

11. Age

This is a business service and it is not aimed at children. Do not use these forms or the client area if you are under 18.

12. Changes

This notice changes when the surface changes. The date at the top is the last revision. Questions: contact@alexandrecorne.com.