Legal information

Privacy Policy

This policy explains which personal data Entresonge processes on the cinelude.com site and in the Cinelude application, why, for how long, with which providers, and how to exercise your rights. It describes what the site and the application actually do as at the date of its last update.

This English version is provided for information only. In the event of any discrepancy, the French version prevails.

Last updated: October 10, 2026

01Controller

Controller: Entresonge, a simplified joint-stock company with a single shareholder (SASU) with share capital of €5,000
Registered office: 58 allée de la Pièce du Lavoir, 91190 Gif-sur-Yvette, France
Registration: Évry Trade and Companies Register, no. 108 107 970
Representative: Antoine Langloys, President
Contact: [email protected]

Entresonge is the controller for the processing described here. For the personal data that customers upload themselves into their Workspace, Entresonge acts on their behalf, as processor, under the conditions provided for by the terms of sale. Entresonge has not appointed a data protection officer.

02The essentials

Neither the site nor the application contains advertising or advertising trackers.
The public site counts its visits with an in-house tool. For every visitor, that counting is done with no cookie and no identifier: only daily totals are kept.
With your consent only, a measurement cookie of our own adds a random identifier, in order to count unique visitors, return visits and journeys through our pages. Declining does not restrict access to the site, and you can change your mind at any time through the “Manage cookies” link in the footer of every page.
The application has no audience measurement tool.
The site does not create accounts. The application is accessible by invitation only.
The application sends none of your content to any artificial intelligence service.
The monitoring covers public videos and public information.
The data is hosted in France, with OVHcloud. The few providers involved are listed further down.
Your data is never sold, rented or transferred.

03Data, purposes, legal bases and retention

Each processing operation is described below. The legal bases refer to article 6 of Regulation (EU) 2016/679 (GDPR).

Requests sent from the site

Data: Name, email address, link to your channel if you provide it, message and date of sending. If you write directly to the contact address: your email address and your message.
Purposes: Reply to your request, review a request for access and, where appropriate, prepare a proposal.
Legal bases: Steps taken at your request before entering into a contract (art. 6(1)(b)) for a request for access or for an offer; the legitimate interest of Entresonge in replying to the messages it receives (art. 6(1)(f)) in other cases.
Retention: For the time of the relationship, then deletion no later than three years after the last contact. The copy kept on the server of the site holds only the 500 most recent requests. If a contract is entered into, the data that is useful is kept for the term of the contract, then for the statutory limitation and archiving periods (ten years for the accounting records).

The name, email and message fields are needed in order to reply to you. An invisible field filters out automated submissions: a message that fills it in is ignored and is not recorded.

Visits to the public site, with no cookie

Scope: The public pages of cinelude.com, when the showcase of the site is open. This counting applies to every visitor, whether or not you have consented to the detailed measurement. The app.cinelude.com application has no audience measurement tool.
Data: For each public page displayed, your browser sends to the server of the site the address of the page viewed and, when you arrive only, the address of the page you come from (the referrer) together with any “utm” campaign carried by the address. At the time of the request, and without keeping them, the server reads your IP address and the “User-Agent” header: it keeps only labels, the country, the region and the city where Cloudflare passes them on, the family of device, of browser and of system, and your preferred language.
No tracker: No cookie, no storage on your device, no identifier, no fingerprint: nothing is read from or written to your device for this counting. Your IP address and your “User-Agent” header are not recorded. No tracking from one visit to the next, no profile.
Counters kept: Daily totals only, on Paris time: views per page and per language; estimated visits, an arrival coming from elsewhere counting as one visit; entry page; classified source (direct access, entresonge.com, search engines, social networks, artificial intelligence assistants, emails, other sites by domain); cleaned “utm” campaign; country, region and city; device, family of browser, system and preferred language; hour of arrival. For the articles of the journal: the number of readings carried through to the end and the reading time. Lastly the conversions: clicks towards the access request form and towards the application, requests actually sent, broken down by source.
Purpose: Know how much the site is visited in order to improve it.
Legal bases: Audience measurement exempt from consent within the meaning of the guidelines of the CNIL, based on the legitimate interest of Entresonge in knowing how much its own site is visited (art. 6(1)(f)).
Recipients: Only the authorized person who administers the site consults these totals. No transmission to a third party. They are kept on the same server, in France, with OVHcloud.
Retention: Thirteen months at most, then the counters are erased. The “Right now” indicator holds only the views of the last five minutes, in the memory of the server, without being recorded.

The “Do Not Track” and “Global Privacy Control” signals of your browser are respected: when one of them is on, this counting sends nothing. Robots and the authorized person signed in to administer the site are not counted. Since nothing is read from or written to your device and only totals are kept, this counting does not ask for your consent.

Detailed measurement of the public site, with your consent

Condition: This measurement takes place only if you have clicked “Accept” in the banner shown when you arrive on cinelude.com. Before you choose, nothing is stored or measured on this basis. The “Accept” and “Decline” buttons carry the same weight, and declining does not restrict access to the site in any way.
Tracker: A cookie of our own, “cinelude_mesure”, which contains a random identifier. Its duration is set when it is created, thirteen months at most, and is never extended.
Data: For each identifier: the first and the last visit, the number of visits, a visit ending after thirty minutes with no page viewed, then for each visit its start, its end, the number of pages viewed, the journey followed (the paths of the pages, nothing else), the source, the country and the device. Neither your IP address nor your raw “User-Agent” header is kept. No name and no address are attached to this identifier.
Purposes: Count unique visitors, tell return visits apart and understand the journeys through our pages.
Legal basis: Your consent (art. 6(1)(a) of the GDPR and article 82 of the French Data Protection Act).
Retention: The data attached to an identifier is kept twenty-five months at most after its last visit; a daily purge erases whatever goes beyond that period.
Withdrawal: At any time, through the “Manage cookies” link in the footer of every page: the cookie is erased and all the data attached to its identifier is deleted. Your choice is asked again after six months in any event.
Recipients: Only the authorized person who administers the site has access to it. No transmission to a third party. This data is kept on the same server, in France, with OVHcloud.

Once you have given that explicit consent, the “Do Not Track” and “Global Privacy Control” signals no longer stop anything but the anonymous counting described above: your consent prevails for that detailed measurement alone. Robots and the authorized person signed in to administer the site are not counted there either.

Accounts of the application

Data: Email address, first name and last name, telephone number and photograph if you provide them, avatar color, role, Workspace, date of creation and date of your last visit. The password is never kept in clear text: only its hash (scrypt) is. If you enable two factor authentication: its secret, encrypted, and the hashes of your backup codes. If you sign in with Google: the identifier of your Google account.
Purposes: Open and manage your access, identify you, apply your rights within the Workspace, secure your account and show you what is new since your last visit.
Legal bases: Performance of the contract entered into with you or with the customer who invited you (art. 6(1)(b)); for the members of a team and for guests, the legitimate interest of Entresonge in providing the service requested by the person who invites them (art. 6(1)(f)).
Retention: For as long as the account exists. When it is closed, this data is deleted; its copies held in the backups disappear as those backups rotate.

Sign-in sessions

Data: Hash of the session token, device in a short form (for example “browser · system”), dates of opening, of last activity and of expiry. The full signature of the browser is not kept.
Purposes: Keep you signed in and let you see and close your sessions in Settings, Security tab.
Legal basis: Performance of the contract and legitimate interest in securing the accounts (art. 6(1)(b) and 6(1)(f)).
Retention: One year at most for owner and author accounts; thirty days, extended on each use, for readers, guests and the desktop and mobile applications. Twenty sessions at most per account.

Content uploaded to the application

Data: What you put there: notes, documents, tasks, calendar, boards, images, sounds, voice memos and their transcription, videos, rushes imported into Cinelude, imported books, remarks, settings. This content may contain personal data of third parties.
Purposes: Keep it, display it, share it according to your choices, keep its history (up to forty versions per document), export it and restore it.
Legal basis: Performance of the contract (art. 6(1)(b)). Entresonge processes this content on behalf of the customer, who remains responsible for what is uploaded there.
Retention: For as long as you keep it. A deleted item stays thirty days in the Trash, then it is erased. At the end of a contract, the content is returned on request, then deleted, as the terms of sale provide.

Invitations, shares and service emails

Data: Email address of the invited person, name of the person who invites, title of the shared document, level of access and any expiry date. The invitation link is personal and single use: only its hash is kept.
Purposes: Send the emails needed for the service: activation of an account, invitation to a share, confirmation and notice of a change of address, alert for a new sign-in from an application, enabling or disabling of two factor authentication, use of a backup code. No advertising email is sent.
Legal basis: Performance of the contract and legitimate interest in securing the accounts (art. 6(1)(b) and 6(1)(f)).
Retention: An invitation link expires after seven days, an address confirmation link after one hour. Shares last until they are withdrawn or until their expiry date.

If you publish a page to the web from the application, it becomes readable by anyone who has its address. It is not offered to search engines, unless you choose otherwise.

Monitoring of public content

Data subjects: Creators whose public channels or accounts are followed, and the authors of public comments under their videos.
Data: Public name of the channel or of the account, avatar, published videos and their public information (title, description, date, duration, chapters, counters), subtitles and transcriptions, thumbnails. For public comments: displayed name, text, number of likes, date, with at most twenty comments per recent video.
Sources: Public pages and public data of YouTube, and public profiles of short video social networks, read without signing in to any account; counters obtained through the official programming interface of YouTube.
Purposes: Study what is published on a subject or a market, learn from structures and methods, prepare one’s own creations.
Legal basis: The legitimate interest of Entresonge and of its customers in studying content that its authors have made public (art. 6(1)(f)), limited to that public information.
Retention: For as long as the channel or the account remains followed by the monitoring. A data subject may object at any time: their data is then withdrawn from the monitoring.

Video transcriptions are computed on the hardware of Entresonge, with no outside service. The analysis records of the monitoring are prepared outside the application by the Entresonge team, with artificial intelligence tools to which it submits this public content. No account data and no content uploaded by a user is sent to them by the application. The assistance block of the publisher only prepares an instruction that you carry over yourself into the tool of your choice: Cinelude sends nothing.

Security and prevention of abuse

Data: IP address, email address entered and number of sign-in attempts or of contact form submissions, held in memory. Technical logs of the server, which may contain an IP address blocked after too many failures or the address of a recipient where an email fails to be sent.
Purposes: Limit repeated sign-in attempts and abusive submissions, diagnose incidents.
Legal basis: The legitimate interest of Entresonge in protecting the service and its users (art. 6(1)(f)).
Retention: Ten minutes for the contact form and fifteen minutes for sign-ins, with nothing written to disk; the logs of the server are erased by rotation beyond a fixed volume.

Backups

Data: The whole database of the application and the files uploaded, accounts included.
Purposes: Restore the service and the content in the event of an incident, and check updates on working copies held on the computers of Entresonge, under the same rules of confidentiality.
Legal basis: The legitimate interest of Entresonge in ensuring the continuity of the service (art. 6(1)(f)).
Retention: On the server, the two most recent backups, made each night. A further copy is kept on a computer of Entresonge and in its online storage, over a rolling seven days.

Entresonge takes no decision based solely on automated processing and carries out no profiling of its users. The sending and disk space counters applied to the accounts serve only to protect the server.

04Third party services at your request

Some features involve a third party service. That service then receives data under its own responsibility, according to its own privacy policy:

Video thumbnails. The thumbnails of the videos are loaded by your browser directly from the image servers of YouTube, a Google service, which therefore receives your IP address.
Players and embedded content. The YouTube video player, loaded in enhanced privacy mode, and the content embedded from other services load only after you click.
Voice memos. Live transcription uses the speech recognition of your browser. Depending on the browser, the sound may be processed by its publisher, for example Google for Chrome. Cinelude receives only the text.
Signing in with Google, where it is offered: Google confirms your email address and sends an account identifier, only for an account already opened in Cinelude.
Publishing, where this feature is open: if you connect your account on a video platform or on a social network, its access tokens are kept encrypted, apart from the rest of the database. The video, its title and its text are sent to that platform only after you confirm.

The Cinelude server also queries public sources (news feeds, encyclopedias, public archives, the preview of a link that you paste, a community database of sponsored segments) with only the terms or addresses needed, without passing on your identity.

05Recipients and processors

The data is accessible only to the authorized staff of Entresonge, within the limits of their duties, and to the people with whom you share content. Entresonge uses the following processors, which process the data only for their own service:

OVHcloud: Hosting of the server, of the database and of the files of the site and of the application, in France.
Cloudflare: Network placed in front of cinelude.com and app.cinelude.com: routing of the traffic, HTTPS encryption and protection against attacks.
Resend: Sending of the service emails of the application and of the notifications of the contact form.
Microsoft: Online storage (OneDrive) of the further copy of the backups.

OVHcloud · Cloudflare · Resend · Microsoft · Google

The data may be disclosed to the administrative or judicial authorities where the law requires it. It is never sold, rented or transferred for commercial purposes.

06Transfers outside the European Union

Cloudflare, Resend, Microsoft and Google are companies established in the United States, or whose parent company is established there. Some data (IP address, email address, content of a service email, backups) may therefore be processed outside the European Union or be made accessible there.

These transfers are covered by the safeguards provided for in chapter V of the GDPR: the adequacy decision of the European Commission on the EU-US Data Privacy Framework, for the companies that join it, or failing that the standard contractual clauses adopted by the Commission. You can obtain information about these safeguards by writing to [email protected].

07Cookies and other trackers

A tracker is a piece of information stored on or read from your device: a cookie, the local storage of the browser, and so on. Article 82 of the French Data Protection Act (loi Informatique et Libertés) requires your consent to be obtained before anything is stored, except for the trackers strictly necessary for the service that you request.

No advertising cookie and no social network cookie is stored, neither on the site nor in the application. Apart from the detailed audience measurement described below, the site and the application use only trackers that are strictly necessary or exempt from consent. The visit counting of the public site, for its part, neither stores nor reads any tracker: it does not touch your device and keeps only daily totals. The application uses no audience measurement tool.

The detailed audience measurement of the public site is the only one that stores a cookie subject to your consent. A banner asks you for it when you arrive on cinelude.com, with two buttons of the same weight, “Accept” and “Decline”. Nothing is stored before you choose, and declining does not restrict access to the site. You can change that choice at any time through the “Manage cookies” link in the footer of every page: the cookie is then erased and all the data attached to its identifier is deleted (see Data, purposes, legal bases and retention).

On cinelude.com

cinelude_mesure
Cookie
Holds the random identifier of the detailed audience measurement: unique visitors, return visits and journeys through our pages. Stored only after your “Accept”, erased as soon as you change your mind.
Duration: thirteen months at most, set when it is created and never extended · Category: detailed audience measurement, subject to your consent
cinelude:consentement
Local storage
Remembers your answer to the banner, “Accept” or “Decline”, so that you are not asked again on every page. This information stays on your device.
Duration: six months, then the banner asks again · Category: record of your choice, exempt
__Host-cinelude_atelier
Cookie
Authenticates the authorized person who administers the site. Never stored for visitors.
Duration: thirty days at most · Category: authentication, strictly necessary
Cloudflare security cookies
Cookie, where applicable
Stored by Cloudflare only when a security or robot detection check is triggered.
Duration: short, set by Cloudflare · Category: security, strictly necessary

In the application

cinelude_session
Cookie
Keeps you signed in. Not accessible to the scripts of the page, sent only over HTTPS.
Duration: one year at most, depending on your role · Category: authentication, strictly necessary
cinelude_oauth_state, cinelude_oauth_application
Cookies
Protect the round trip of signing in with Google and bring you back to the desktop application that requested it.
Duration: ten minutes · Category: authentication, strictly necessary
cinelude-langue
Cookie
Remembers the language of the interface that you have chosen.
Duration: one year · Category: preference expressed by you, exempt
cinelude-recette
Cookie
Flags the test mode reserved for the Entresonge team, which marks the documents created during its tests. Never stored for users.
Duration: seven days · Category: internal operation, exempt
Local storage
Browser
Display preferences (theme, navigation, views), drafts in progress, recent searches and the history of the last hundred pages, specific to your account. This data stays on your device.
Duration: until you erase it · Category: operation requested by you, exempt
Local database and cache
Browser and applications
In the desktop and mobile applications: notes, tasks and calendar available offline, access to the rushes left on your device, cache of the pages.
Duration: until you sign out or erase it · Category: operation requested by you, exempt

You can delete or block these trackers from the settings of your browser, and set the measurement cookie through the “Manage cookies” link in the footer of every page. Without the session cookie, you can no longer stay signed in; the rest keeps working, without your preferences.

08Security

Entresonge implements appropriate technical and organizational measures, in particular:

encryption of exchanges over HTTPS;
passwords kept in the form of a hash, two factor authentication available, single use backup codes;
sessions kept in the form of a hash, visible and revocable by each user;
personal invitation links, single use and limited in time;
Workspaces kept separate between customers, files served only after a check of the rights;
tokens of the publishing accounts encrypted and stored apart;
limits on sign-in attempts and on contact form submissions, check of the origin of the submissions.

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, Entresonge informs you under the conditions provided for by article 34 of the GDPR.

09Your rights

You have the following rights over your personal data:

Access · art. 15: Find out whether data concerning you is processed and obtain a copy of it.
Rectification · art. 16: Have inaccurate data corrected or incomplete data completed. Your profile can also be edited in Settings.
Erasure · art. 17: Obtain the deletion of your data, under the conditions provided for by the GDPR.
Restriction · art. 18: Have the use of your data suspended, for example while a challenge is being verified.
Objection · art. 21: Object, on grounds relating to your particular situation, to the processing based on legitimate interest, including the monitoring of public content.
Portability · art. 20: Receive the data that you have provided in a structured and commonly used format. The application offers open exports of your documents and of your Workspace.
Post mortem instructions: Set instructions on the retention, the erasure and the disclosure of your data after your death (article 85 of the French Data Protection Act).

10Exercising your rights

Write to [email protected] or by post to Entresonge, 58 allée de la Pièce du Lavoir, 91190 Gif-sur-Yvette, France, stating your request and the email address that you use with Cinelude.

Entresonge replies within one month of receiving the request. That period may be extended by two months because of the complexity or of the number of requests; you are then informed within the first month. Exercising your rights is free of charge. Where there is reasonable doubt about your identity, further information may be requested from you, solely in order to verify it. Where the request concerns content uploaded by a customer, Entresonge passes it on to that customer and helps them answer it.

For the detailed audience measurement, no name and no address are attached to the identifier of the cookie: Entresonge cannot recognize you on a written request alone. Your rights are therefore exercised first through the “Manage cookies” link in the footer of every page, which erases the cookie and deletes all the data attached to its identifier. You can also write to the address above, stating the value of the identifier of the “cinelude_mesure” cookie, which the settings of your browser show you.

11Complaint to the CNIL

If, after contacting Entresonge, you consider that your rights are not respected, you can lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), the French data protection authority:

Online: www.cnil.fr
By post: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07

12Minors

Cinelude is intended for businesses and is not aimed at children. If you think that a minor under the age of fifteen has sent us personal data, write to [email protected]: it will be deleted.

13Changes

Entresonge may amend this policy in order to take account of a change in the site, in the application, in its providers or in the regulations. The version in force is the one published on this page; the users of the application are informed of any significant change.

Update of 10 October 2026: the detailed audience measurement of the public site, which is subject to your consent, and the banner that collects that consent are described above. The visit counting with no cookie, for its part, is unchanged.