Privacy policy

Who is responsible for what

OPS FLOW CONSEIL, the publisher of this site (see the legal notice), acts in two distinct capacities, and the distinction changes who you should talk to.

• Data controller for its website, its prospects and its client accounts. We decide on these processing activities, so you address us directly.
• Data processor for the data of players in a session. The company organising the session is the one deciding to have its teams play: it is the controller, and we act on its behalf. A player wishing to exercise their rights should first contact their employer; should the request reach us, we pass it on.

Processing activities, one by one

Enquiries sent through the contact form

• Data: your name, your email address, your message.
• Purpose: answering your enquiry.
• Legal basis: steps taken prior to a possible contract, and our legitimate interest in replying to those who write to us.
• Recipients: ourselves, and our mail hosting provider.
• Retention: your message is not stored in any database — it reaches us by email and stays in our inbox for as long as it takes to handle your enquiry and, where applicable, the business relationship arising from it.

Automated-submission protection log

The form is protected against bots. When a submission is rejected by those protections, a line is written to a technical log. This is a purpose of its own, and it deserves to be stated plainly.

• Data: the IP address and — where the rejection comes from a bot trap or from abnormally fast typing — the name, the email address and the truncated message.
• Purpose: detecting abuse and, above all, recovering a legitimate message that the filter wrongly discarded.
• Legal basis: our legitimate interest in protecting the form and losing no genuine enquiry.
• Retention: 30 days, enforced nightly by an automated task.

Client accounts

• Data: for the organisation, its company name, address, business registration and VAT numbers; for each user, their first and last name, email address and password, the latter never stored in clear text.
• Purpose: opening access to the service, running sessions, invoicing.
• Legal basis: performance of the contract between us, and our accounting obligations.
• Retention: the duration of the contractual relationship, then, for accounting records only, the archiving period required by law.

Sessions and players

• Data: the name entered by the player when joining the session, their role in the chain, and all of their in-game decisions.
• Purpose: running the session and producing the debriefing report.
• Legal basis: the one chosen by the client company, on whose behalf we act.
• Retention: the duration of the contractual relationship with the client company; this data is deleted at its request.

Game technical log

• Data: the IP address, the date, the action performed and the data exchanged with the server.
• Purpose: security, incident diagnosis, and reconstructing a disputed session.
• Legal basis: our legitimate interest in operating a reliable service.
• Retention: the IP address is erased after 15 days, without exception. Log entries are deleted 30 days after the end of the session concerned — and a session left inactive for 30 days is closed automatically, which guarantees that this deadline always comes.

Our hosting providers' logs

Our hosting providers keep their own connection logs, which contain IP addresses. These fall under their contracts and their obligations, not ours: we neither use them nor set their retention period.

Who your data is shared with

We neither sell nor transfer any data. Beyond ourselves, only the providers needed to run the service are involved:

• o2switch — hosting of the website and mail service, in France.
• Stackhero — hosting of the game's real-time service, in France, on infrastructure provided by Scaleway (Online SAS).

No data is transferred outside the European Union. The site calls no third-party service when a page loads: the typefaces are served from our own servers, precisely so that your IP address goes nowhere.

Cookies

This site sets two cookies, and only two:

• a session cookie, which holds your browsing together from page to page: signing in to the application areas, but also protecting the contact form;
• a real-time subscription cookie, which lets both the game screen and the facilitator screen receive updates from the session in progress.

Both are strictly necessary: without them, there is neither sign-in nor session. This is why no consent banner is shown to you — the law does not require one for these cookies.

We use no audience-measurement tool, no advertising tracker and no social-network pixel. Should that change, this page would be amended and your consent sought before anything is set.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data.

To exercise them, use our contact form — that is the channel we monitor. You may also write to us at our registered office, given in the legal notice. We may ask you to prove your identity where the request leaves room for doubt.

If our answer does not satisfy you, you have the right to lodge a complaint with the French data protection authority (CNIL), whose contact details are available on cnil.fr.

Automated decision-making

No decision producing legal effects concerning you is made by automated means. Machine-driven players, in a session that includes them, are a game mechanic: they decide nothing about you outside the simulation.

Security

Exchanges with the site are encrypted, passwords are never stored in clear text, and all data is hosted in France. We also limit what we collect in the first place: data we do not hold cannot leak.

Changes to this policy

This page may change, particularly if the service does. The date of last update appears below, and we only write it when the text has genuinely changed.

Last updated: 27 August 2026