Privacy

Lastnod is published by Eric Mehdi Mollenthiel, sole trader, under the trade name Mollenthiel Studio (SIREN 795 225 226), 103 avenue Lacassagne, 69003 Lyon, France. Contact for any question about your data: team@lastnod.com.

This page states what data we process, why, where it stays, who has access to it, for how long, and how you withdraw an access. It supplements the general terms and conditions of the service (article 11) and the data processing agreement annexed to them.

1. What you place in your space

Your projects, tasks, notes, files, the work of your agents and what they read in the accounts you open to them belong to you. For this data, you are the controller and we are your processor, under the data processing agreement annexed to the terms. We use it only to operate your service, on your instructions: no advertising, no prospecting, no sale, no training of an AI model, no reuse for other customers, except for the lessons you choose to share (point 5).

The conversations with your agents are reviewed every week by your company's Organizer to improve their instructions, never to evaluate anyone. It reviews them in your space, with your AI subscription, from a summary of the relevant passages that your control center prepares without AI. Your company can turn off this review.

Your space is separate from that of any other customer: its own database, secrets and accounts. In the hosted version, your agents work in an environment of your own, at our hosting provider (currently OVHcloud, in France). In the installed version, they work on your server, and your control center remains with us. We protect your data with care, without being able to promise absolute security (article 6 of the terms).

2. Your Google mailbox, your Drive and your calendar

When you say yes to connecting your Google account, your agent creates, in your name and in your own Google account, a Google application that belongs to you alone. It is this application, and not a Lastnod application, that receives the access you grant on Google's screen.

• What your agents can do: the access granted on Google's screen: read your messages, sort them and place draft replies in them (your agents send no message), read and modify the files in your Drive, read and modify your calendar.
• Why: to do the work you entrust to them (sorting and summarizing your messages, preparing a reply, finding a document, organizing an appointment). What your agents retain from it for their work (a summary, a note, a working file) is stored in your space. You remain responsible for what you entrust to them and for what you approve (article 6 of the terms).
• Your AI: to do this work, your agents send what they read to your own Claude subscription, from Anthropic, which you connected yourself. If you also connect ChatGPT, from OpenAI, your agents only call it for what Claude does not do, such as creating an image, with only the text needed for that request. That provider processes it under your contract and your settings with it, outside our data processing agreement. We advise you to refuse there the use of your conversations for training its models. This setting is found in the privacy settings of your Claude account (and ChatGPT, if you have connected it).
• Where the keys are: the credentials of your Google application and the authorization it receives are stored by your agent in the vault of your installation. They are not displayed and do not pass through any conversation.
• Who has access on our side: no one under normal circumstances. We have no permanent account in your space. Our deployment console keeps a technical access to your installation to operate it (update, backup, repair); it is not used to view your messages, your files or your calendar. We read your data only if you yourself open a support access, for the duration you choose, twenty-four hours at most (article 13 of the terms), or, where necessary, for security, to examine a reported abuse (article 10 d) or to comply with the law.
• What we never do with it: no advertising, no sale, no transfer to a data broker, no credit assessment, no training of an AI model, no reuse for another customer.
• For how long: the access lasts as long as you leave it connected. What your agents have stored in your space remains there until you delete it or until the end of the service (point 11).
• Withdrawing access: at any time, in your Google account, on the page "Third-party apps and services with access to your account" (myaccount.google.com/connections): remove the application; access stops immediately. You can also delete the application's Google Cloud project, or ask your agent to do so.

Lastnod's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google API Services User Data Policy: https://developers.google.com/terms/api-services-user-data-policy

3. Linked messaging services and networks

If you link Discord, Telegram, Slack, LinkedIn or WhatsApp, your agents read and write there through our gateway, for you alone. It keeps the content of messages only for as long as necessary, within the periods set in article 14 of the terms; a file your agents send you only passes through it, without being kept there. Its log keeps only the actions, never their text or the content of a file. You remain bound to each provider by its own terms and disconnect each service from your space. We do not use any message, file or post that passes through the gateway to train an AI model. The details (what is received, for how long, who has access to it, WhatsApp and Meta, deletion) are on our page "Messages we process for our customers". Mastodon, Bluesky and dev.to are published from your space, with your own credentials, stored encrypted, without passing through our gateway or through an account of ours.

4. Your tickets

A ticket you send us from your space, with its messages and its screenshots, is read by us and by our AI agents, solely for handling the ticket. Your telephone number and your email address may appear in it, whatever the type of ticket: we process them on our own behalf, to handle the ticket, like those of your subscription (article 11 of the terms). Do not include any secret or data of other persons, and crop or mask a screenshot before attaching it. Screenshots are deleted when the ticket is closed, after a short period that allows it to be reopened (article 15 of the terms).

5. Shared lessons

If your company turns on lesson sharing in its settings, your Organizer sends us, as a ticket, the working rules that may serve all customers, written without any data from your company: no name, no extract of conversation, no document, no content or figure of your business. Your control center checks each lesson before it is sent to remove the addresses, numbers and names it recognizes in your space. Each lesson sent appears in your tickets, exactly as it was sent.

• Who is responsible: we are, on our own behalf, in order to improve the method and the modules common to all customers (article 15 d of the terms).
• Basis: our legitimate interest in improving our service (article 6, 1, f of the GDPR). Sharing takes place only if your company has turned it on.
• Data: no personal data is expected in a lesson. If a lesson nevertheless contains any, we delete that data. The link with your installation serves only to give you the follow-up of your ticket; it does not enter the method.
• For how long: a lesson that is retained becomes a rule of the common method, written in our own words, with no link to your company; the ticket that carried it follows the retention period of your other tickets.
• Your choice: your company withdraws sharing at any time in its settings, with no effect on lessons already received. You may object to this processing by writing to team@lastnod.com.

6. Your subscription

• Data: name, email address, company and its registration number, billing address, plan, invoices, payment history, and your declaration that you are acting for your professional activity.
• Why: to open and manage your subscription, invoice you, write to you about it. Basis: the performance of the contract; for invoices, a legal obligation.
• For how long: the duration of the subscription, then the accounting records for ten years.

7. Payment

Your payments are collected by Stripe (Stripe Payments Europe, Limited, Ireland). You enter your card on Stripe's page: we neither see nor keep its number. Stripe acts for us as a processor for payment collection, and as an independent controller for its own obligations (fraud and money laundering prevention, security), under its policy: https://stripe.com/privacy. Data may be transferred to Stripe in the United States, under the EU-U.S. Data Privacy Framework and the standard contractual clauses of the European Commission.

8. The waiting list

The sign-up form records your email address, your two optional answers, the language of the page, the date of your sign-up and the consent text displayed. Why: to notify you when Lastnod opens, in your language, on the basis of your consent. For how long: until the opening announcement, or at most three years without contact, then deletion. The only planned email is the opening announcement, with a one-click unsubscribe link.

9. After an account is closed for a breach

When we permanently close an account for an established breach of the terms (use to create a competing product, circumvention of limits, abuse, or any other use or behavior that causes or seriously risks causing harm to us, to our service, to our suppliers, to our customers or to third parties, such as fraud or a false declaration at subscription: articles 8 and 10 of the terms), we keep an exclusion list to prevent a new subscription contrary to these terms.

• Data: email address of the account holder, company registration number, the customer's references at Stripe and the fingerprint of their card provided by Stripe (a code that recognizes the same card, without its number), reason and date of the closure. Nothing that was in your space.
• Why: to recognize a new subscription or an invitation from the same person, the same company or someone acting on its behalf, and to submit it to our approval. The listing is always decided by a person; a recognized subscription is stopped and then examined by a person, to whom you may write to present your situation.
• Basis: our legitimate interest in enforcing our terms and in protecting our service and our customers (article 6, 1, f of the GDPR).
• For how long: five years from the closure, then deletion.
• Your rights: you are informed of the listing at the time of the closure; you may request access, rectification or a review, and object to this processing, by writing to team@lastnod.com. We may maintain the listing if compelling legitimate grounds justify it, or for the defense of our rights (article 21 of the GDPR).

10. Who receives your data

Us; our hosting provider (currently OVHcloud, OVH SAS, in France), for our servers and their backups; Stripe, for payment; the AI provider of our own agents (currently Anthropic), when it processes for us your tickets or your subscription; the authorities, when the law requires us to; and the services you yourself choose to connect (your AI, your Google account, your messaging services), each for what you entrust to it, under its own terms, for which we are not responsible. For the data in your space, we notify you before any change of processor (article 11 of the terms). No data is sold.

11. At the end of the service

On request, you receive the complete export of what belongs to you, in open formats, within fifteen days. After it is delivered, or thirty days after the end of the service if no export is requested, we delete your control center and, in the hosted version, your agents' environment, with the keys to your connected accounts; backup copies are purged within the periods of the data processing agreement. What remains: security logs, without content, for twelve months; contractual and accounting documents, for ten years. In the installed version, what is on your server remains yours.

12. Your rights

Access, rectification, erasure, restriction, objection and portability, by writing to team@lastnod.com. For the data in your space, including that of your connected accounts, you first exercise them yourself from your space, and we help you on request. You may lodge a complaint with the CNIL (www.cnil.fr).

13. Cookies

As of the date of this page, the lastnod.com website uses no tracking cookie, no tracker, no third-party font and no third-party script; only a technical session cookie, necessary to protect the form, may be set. Your space uses only the cookies necessary for you to sign in. Stripe's payment page sets its own cookies, under its policy. If we ever add audience measurement or another tracker, this page will say so, and your consent will be requested where the law requires it.

14. Changes to this page

This page may change with the service or the law; its date of update appears at the top. A significant change that affects the data in your space is announced to you in writing before it applies, like a change to the terms (article 17 of the terms).