Privacy

Privacy notice

Last updated: 28 August 2026

This notice describes every piece of personal data Outfold Systems stores, the table or the bucket it lands in, why it is kept and how to get it back or deleted. It is written from the code that runs this surface rather than from a template, so the lists below are the actual fields, not a category summary.

1. Who is responsible

The data controller is Ether's, a French sole proprietorship registered under SIREN 879 425 049, trading as Outfold Systems.

• Address: Ether's, Paperboy 6372, 20 quai de Lorraine, 11100 Narbonne, France
• Contact for anything in this notice: [email protected]

There is no data protection officer. Alexandre Corne handles these requests himself.

2. What this notice covers

It covers the Outfold Systems pages, which are /ai and everything under it on alexandrecorne.com: the landing page, the Businesses page, the enquiry form, the sign-in page, the client area at /ai/me, the intake questionnaire and the documents it produces, together with the API endpoints those pages call.

The rest of alexandrecorne.com is a personal landing page with its own privacy policy, linked from its own footer. Elite Outsiders, byForja and byCaliber each have their own too.

One page falls between the two. The Businesses interest form at /business on alexandrecorne.com carries the Outfold Systems name but sits outside /ai. It writes your name, email address, note, IP address and browser user agent to a separate table (business_interest_leads) in the same database. It is listed here so the picture is complete.

3. Where the data is held, and who can read it

Everything described below is stored on Cloudflare infrastructure: a Cloudflare D1 database for the rows, and a Cloudflare R2 bucket for the files you upload. Cloudflare, Inc. is a United States company and serves this from its global network.

Alexandre Corne is the only person with access. There is no team, no shared inbox and no support tool. He works from Da Nang, Vietnam, and reads this data from there. Cloudflare and Resend are the only other parties that hold any of it, in the roles described in section 6.

4. What is collected, surface by surface

4.1 The enquiry form on /ai/contact

What you type goes straight into our own database. No third-party form service is involved. Stored in realai_leads:

• Name, email address, company, website and the message you write.
• Your IP address and your browser user agent, recorded with the submission.
• A timestamp, and a status we update as the enquiry moves along.

Why: to answer you and to take the steps you asked for before any engagement (Art. 6(1)(b) GDPR). The IP address and user agent are kept for abuse prevention (Art. 6(1)(f), legitimate interest): the form accepts at most eight submissions per IP address per hour.

4.2 The interest form on /ai/business

Same table, same rate limit. Stored: name, email address, your note, IP address, browser user agent, timestamp. The note is tagged so these are told apart from the enquiries above.

4.3 Signing in to the client area

Sign-in uses a single-use link sent by email, not a password. When you request one:

• A row is written to magic_link_tokens: your email address, the expiry (fifteen minutes), the time the link was used, your IP address, your browser user agent.
• The link itself is never stored. Only an HMAC-SHA-256 hash of it is kept, so nobody reading the database can reconstruct a working link.
• If you start the sign-in on one device and open the link on another, a row is written to pending_logins: a random identifier generated by your browser, your email address, an expiry (ten minutes), the times it was verified and claimed, your IP address, your browser user agent.
• At most five sign-in requests per email address per hour.
• A link is only ever sent to an address that already exists as a client. Any other address gets the same reply and no email, so the page cannot be used to find out who is a client.

4.4 The session cookie

One cookie, rai_session. Strictly necessary: it is what keeps you signed in, and it is set only after you open a sign-in link. HttpOnly, Secure, SameSite=Lax, seven days, or until you sign out.

Its value contains your email address and an expiry timestamp, signed with a server key so it cannot be edited. It is signed, not encrypted: anyone holding the cookie can read the address inside it. It carries nothing else, and it is not used to track you.

There are no other cookies on this surface. No analytics cookie, no advertising cookie, no consent banner, because there is nothing to consent to.

4.5 The client area on /ai/me

Reads two tables and shows you only your own rows:

• realai_clients: your email address, name, company, the stage the engagement is at, a link to your intake, private notes, timestamps.
• realai_deliverables: the title, kind, status, link and due date of what is being produced for you.

4.6 The intake questionnaire on /ai/me/intake

An intake record is created the first time you open the page, and linked to your client row. Stored:

• creators: your name, brand name, email address, website, a slug built from your brand name, and a status.
• creator_answers: one row per question, holding the answer as you saved it. Answers autosave as you go, so a partial questionnaire is stored too.

4.7 The files you upload

The questionnaire accepts images: profile picture, banner, signature, logo, a screenshot of your home page and one of your funnel. Up to eight megabytes each, images only.

• The file itself goes to the Cloudflare R2 bucket ac-creator-assets, under a key that contains your intake identifier.
• creator_assets records the kind, the storage key, the content type, the size and a colour palette extracted from the image by your own browser at upload time.
• Files are served back only to you, through an endpoint that checks your session first. The bucket is not public.
• Worth knowing: when you upload a replacement of the same kind, the database row is replaced but the previous file stays in the bucket. Ask and it is deleted.

4.8 The two documents

From your answers, two documents are computed and frozen: a "before" and an "after". Each is stored whole in creator_outputs as a snapshot with the time it was generated. The page you read never recomputes them, which is why a later change to the engine cannot alter a document you have already been shown.

4.9 The activity log

Two small tables record what happened and when: realai_events (enquiry received, sign-in link requested, signed in) and creator_events (intake started, section completed, file uploaded, documents generated). Some rows carry a detail field that can contain your email address or the identifier of your enquiry.

4.10 Server logs

Cloudflare processes the standard request metadata of any web request, including IP address, user agent and country, for security, rate limiting and performance. That processing follows Cloudflare's own retention policy, not ours.

5. What is not done here

No analytics of any kind runs on these pages. Not Google Analytics, not Plausible, not Cloudflare Web Analytics, not Meta Pixel, not Hotjar. There is no first-party analytics table either, no heatmap, no scroll tracking, no outbound-click tracking and no email open pixel.

No advertising, no profiling, no cross-site tracking, no fingerprinting. Your data is never sold and never shared with an advertiser. No automated decision produces a legal effect for you: the documents in section 4.8 are computed from your own answers and are read by a person.

There is no newsletter on this surface, so nothing you send here subscribes you to anything.

6. Who else touches the data

• Cloudflare, Inc. (United States), as host and as the operator of the database and the file storage. Privacy policy
• Resend (United States), to deliver sign-in emails. Resend receives your email address, the subject, the body of the message and two internal labels. It receives nothing else. Privacy policy
• Google Fonts. Your browser fetches the Inter typeface from Google's servers when you open one of these pages, which means Google sees your IP address and user agent. The font files are not self-hosted. Privacy policy
• Cal.com, only if you follow the "Book a call" link on the Businesses page. Nothing is embedded, and nothing is sent to Cal.com unless you click it and book. Privacy policy
• YouTube. The video previews on the landing page are still images stored on this site. A player from youtube-nocookie.com loads, and YouTube sees your request, only after you click one of them. Privacy policy

7. Transfers outside the EEA

Cloudflare, Resend, Google and Cal.com are United States companies, so personal data is processed outside the European Economic Area. Those transfers rely on the safeguards those providers put in place, in particular the European Commission's Standard Contractual Clauses.

Separately, the controller himself accesses this data from Vietnam, as stated in section 3.

8. How long it is kept

Stated as it actually works today, not as an intention:

• Sign-in links stop working after fifteen minutes and after one use. The row that records the request is kept.
• Cross-device sign-in rows stop working after ten minutes. The row is kept.
• The session cookie expires after seven days, or immediately when you sign out.
• Enquiries are kept while the enquiry is live and afterwards as a business record.
• Client rows, intake answers, uploaded files and generated documents are kept for the duration of the engagement and afterwards.
• No automatic deletion job runs on this surface. Deletion is done by hand, and it is done when you ask.

9. Your rights

Under the GDPR you can ask to access your data, correct it, have it erased, restrict or object to how it is used, receive it in a portable format, and withdraw consent where consent is what allows the processing. Under the French Loi Informatique et Libertés you can also leave directives about what happens to your data after your death.

Write to [email protected]. The answer comes within one month. Because there is no automated export tool, an access or portability request is answered by hand, from the tables named in section 4, which is why they are named.

If you think your rights have not been respected, you can complain to the CNIL, the French supervisory authority, at cnil.fr, or to the authority where you live.

10. Security

• Everything is served over HTTPS.
• Sign-in links are stored only as a hash, never in a readable form.
• The session cookie is signed with a server key and cannot be forged or edited.
• Rate limits sit on the forms (per IP address) and on sign-in (per email address).
• The client-area endpoints refuse anonymous callers, and refuse an intake identifier that does not belong to the signed-in client, whether or not that identifier exists.

No system is beyond reach. If something goes wrong that affects your data, you will be told.

11. Age

This is a business service and it is not aimed at children. Do not use these forms or the client area if you are under 18.

12. Changes

This notice changes when the surface changes. The date at the top is the last revision. Questions: [email protected].