Privacy policy

This policy explains which data we process when you visit wasla.fr and when you use numu OS, the tool that helps you prepare your LinkedIn posts with AI (customer area wasla.fr/app). We kept it short and accurate: it describes what the service actually does today.

1. Who is responsible for your data

wasla.fr and numu OS are published by WASLA ("we"), the controller of your data.

For any question about your data or to exercise your rights: contact@wasla.fr. We have not appointed a data protection officer.

2. The data we process, and why

2.1 Your account

• Data: e-mail address, password (handled by our authentication service, never visible to us), technical account identifier, two-factor authentication settings, interface language.
• If you use "Sign in with Google": your e-mail address, whether it is verified, and the technical identifier of your Google account (§ 3).
• Why: to create your account, identify you, secure access, and prevent one address from opening several accounts or free trials.
• Legal basis: performance of the contract; for security and preventing trial abuse, our legitimate interest.

2.2 Your workspace and your content

• Data: your workspace name; what you tell us about yourself and your business (role, company, audiences, tone, topics, examples); the sources and topics you choose; the generated posts, images and carousels, your edits and approvals; the members you invite (e-mail address and role).
• Why: to provide the service, i.e. prepare, review and present posts that sound like you.
• Legal basis: performance of the contract.
• Your content may mention other people. You remain responsible for what you give us and what you publish.

2.3 AI and research

• To generate your posts and their visuals, we send our AI providers the instructions they need: excerpts of your editorial profile, topics, sources, drafts. We never send them your e-mail address, your payment data, your LinkedIn data or the data received from Google.
• For topic monitoring, we send search queries (your themes, possibly company names) to a web search service.
• Legal basis: performance of the contract. The providers and what they do with this data are described in § 4.

2.4 LinkedIn connection (if you turn it on)

• Data:
  • your LinkedIn identifier and display name;
  • the access token granted by LinkedIn (encrypted, never displayed) and the permissions granted;
  • if you turn on automatic publishing, the posts you approved and their publication date;
  • if you upload LinkedIn statistics exports, the statistics they contain (the files are deleted as soon as they are read).
• Why: to publish on your profile the exact version you approved, when you ask for it, and to show you your results.
• Legal basis: performance of the contract, at your request. You can disconnect LinkedIn at any time in the settings.
• We send no LinkedIn data to any AI. numu OS never knows your LinkedIn password.

2.5 Subscription and payment

• Data: plan, credits used, subscription and purchase history; billing name, e-mail and address; invoices. Card details are entered with our payment provider, Stripe: we never see them.
• Why: to take payments, invoice, manage the trial, plan changes and cancellation, and keep our accounts.
• Legal basis: performance of the contract; legal obligation for invoices and accounting.

2.6 Where your sign-up came from

• Data: campaign parameters of the first page you visited (source, medium, campaign), the site you came from (domain name only), landing page, and a simple "came from a Google ad: yes / no" flag (never the click identifier). This is kept in your browser for the life of the tab, then recorded once with your account.
• Why: to know which channels bring sign-ups, so we can run our business.
• Legal basis: our legitimate interest.

2.7 E-mails we send you

• Account e-mails: verification code, password reset.
• Service e-mails: welcome, "your first content is ready", reminder of an approved post to publish. They never contain the text or visual of your content. We do not track opens or clicks.
• Legal basis: performance of the contract. We do not send you marketing e-mails.

2.8 Support

• Data: your messages to contact@wasla.fr and our replies.
• Why: to answer and follow up on your request. Legal basis: performance of the contract or our legitimate interest.

2.9 Audience, ad conversion and usage measurement (only with your consent)

• Google Analytics 4 and Google Ads:
  • on the public site, and only two measurements in the customer area: sign-up and the start of the free trial;
  • data: page views, events, cookie identifiers, device, approximate location, and whether you came from a Google ad;
  • why: to measure site traffic and learn which Google ads bring sign-ups and trials;
  • we use Google's consent mode: nothing loads before your choice, and ad personalisation always stays off (no retargeting).
• PostHog (hosted in the EU), on the site and in the signed-in customer area: page views, clicks, the two measurements above, session recordings. In the customer area, every text, field and attribute is masked in recordings: we see neither your posts, nor your visuals, nor names and e-mails. You are identified by an opaque identifier, never by your e-mail or name.
• Legal basis: your consent, which you can withdraw at any time (§ 8).

2.10 Technical operation, security and errors (without consent)

• Technical logs of our servers: date, requested operation, technical identifiers, IP address and browser. Never your passwords or tokens.
• Error tracking with Sentry (hosted in the EU): error type, page address without sensitive parameters, browser, opaque workspace identifier. No content, no e-mail; Sentry is set not to store IP addresses and sets no cookie.
• AI quality and cost measurement (PostHog, server side): provider, model, volume, cost, duration, status, opaque workspace identifier. Never your instructions or the generated texts.
• Legal basis: our legitimate interest in running, securing and improving the service.

2.11 What is required, what is optional

Your e-mail address is required to create an account; information about your business and your sources, to generate your posts; your billing data, for a paid subscription. Without them, we cannot provide the corresponding service. The LinkedIn connection and audience measurement are optional: refusing them does not prevent you from using numu OS.

2.12 Automated decisions

We make no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. The AI suggests content; you review it, edit it and decide whether to publish it.

3. Data received from Google ("Sign in with Google")

When you choose "Sign in with Google", we only ask Google for your e-mail address. Google then sends us this address, whether it is verified, and the technical identifier of your Google account. We use and keep these three pieces of information only to create your numu OS account and recognise you each time you sign in. If a numu OS account with a password already exists for this address, we do not link the two: we ask you to sign in with your password.

We do not access your Google contacts, e-mails or files. We do not sell this data, do not use it for advertising, do not send it to any AI provider and do not use it to train any AI model.

numu OS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove numu OS's access from your Google account (https://myaccount.google.com/permissions). Your numu OS account then remains; to delete it, see § 9.

4. AI: who receives your content and what they do with it

Texts and visuals are AI-generated, then shown to you for review: nothing is published without your approval. Always review content before publishing it.

5. Who receives your data

• Authorised WASLA staff, only as far as they need.
• Our service providers, who process data on our behalf, under their terms:

• LinkedIn, if you connect it: your posts are sent to it for publication. LinkedIn then processes your data under its own rules, as a separate controller.
• Stripe also processes some data on its own behalf (fraud prevention, financial obligations).
• Authorities, only upon lawful request.

We do not sell or rent your data to anyone.

6. Transfers outside the European Union

The service is hosted in the European Union (AWS, Paris region; PostHog and Sentry, EU hosting). Some providers handle data in the United States: OpenAI, Google, Tavily, Stripe, Anthropic, and the parent companies of PostHog and Sentry for support. These transfers rely on the EU–US adequacy decision (Data Privacy Framework) where the recipient is certified, and otherwise on the European Commission's standard contractual clauses. To find out more, write to contact@wasla.fr.

7. How long we keep your data

8. Cookies and trackers

On your first visit, a banner lets you accept or refuse audience, ad conversion and usage measurement, one as easily as the other. Google Analytics, Google Ads and PostHog load only after "Accept". Your choice is kept for 13 months; you can change it at any time with the "Manage cookies" link at the bottom of every page. If you refuse or withdraw consent, measurement stops; Google Analytics cookies and PostHog data in your browser are deleted. Google's advertising cookies may remain until they expire or until you clear them in your browser.

Without your consent, we only use what is necessary: remembering your choice, your sign-in session, and the origin of your visit kept for the life of the tab (§ 2.6).

9. Your rights

You can ask for access to your data, its rectification, erasure, restriction of processing, portability, object to processing based on our legitimate interest, withdraw your consent at any time, and give instructions about your data after your death.

To exercise these rights, in particular to delete your account or get a copy of your data, write to contact@wasla.fr from your account's address. We reply within one month (extendable by two months for complex requests). After a deletion request, we erase your data within 30 days, except what the law requires us to keep (invoices). We may ask you to confirm your identity if in doubt.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07), or with the data protection authority of your country of residence.

10. Security

Connections are encrypted (HTTPS). Passwords are handled by Amazon Cognito; two-factor authentication is available. LinkedIn tokens and secrets are encrypted. Customer workspaces are separated, internal access is restricted, and our logs and monitoring tools exclude your content. No measure removes every risk: if a breach of your data creates a risk, we notify the CNIL and, where required, the people concerned, within the legal deadlines.

11. Minimum age

numu OS is a service for professionals. It is reserved for people aged 18 or over.

12. Changes

We may update this policy. The date below shows the version in force. For any significant change, in particular a new use of data received from Google, we will tell you by e-mail or in the app before it applies.

Version of 28 October 2026.