ExtraltExtralt

GDPR Compliance

Last modified: August 2026

Extralt is a French company subject to GDPR. This page describes how we protect your data and support your rights under the regulation.

What is GDPR?

The General Data Protection Regulation (GDPR) is a regulation by which the European Parliament, the Council of the European Union, and the European Commission strengthen and unify data protection for all individuals within the European Union (EU).

Is Extralt GDPR compliant?

Yes. This page describes the specific measures we take and your rights under the regulation.

Information we hold

Registration and contact information. We collect information about you when you register to use our services. This may include your name and email address. This information is handled by our authentication provider.

Payment information. When you purchase our services, transaction information including company name and billing details are collected. Payment processing is handled by our payment provider. We never store your full credit card information.

Technical and usage information. We automatically collect information on how you interact with our service, such as IP address, date and time of access, and usage patterns.

Customer data. Data that you extract using our service ("Customer Data") belongs to you. We process this data on your behalf as a data processor, not as a data controller. When you use enrichment features, your extracted data is processed using AI to translate, classify, and match products. You can only access enriched product data for products you have extracted. Your extraction data, including the specific URLs you extract and your pricing and availability data, remains private to your organization. When you use the AI assistant, we process your chat messages, page context, tool results, and relevant dashboard state to generate assistant responses and proposed workflow plans for your organization.

International data transfers

Some of our service providers are located outside the European Union. When transferring personal data outside the EU, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure your data receives adequate protection.

Data security

We monitor for security vulnerabilities and unauthorized access. In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify affected individuals without undue delay.

Preventive measures we take include:

  • Encrypted HTTPS communication for all data transfers
  • Regular encrypted backups
  • Secure credential storage with industry-standard hashing
  • Access controls and authentication safeguards

Data retention

We retain personal data only for as long as necessary to provide and secure our services, resolve disputes, and comply with legal obligations. The following access and retention rules apply:

  • Active accounts: Data is retained while your account is active.
  • Subscription lapse: If your subscription is cancelled, expires, or becomes inactive following payment failure, you retain read and export access for 30 days. Customer Data is then inaccessible but may be restored by resubscribing until 180 days after the subscription ended. After 180 days, the organization is permanently deactivated and cannot be restored. Deactivation is an access state, not confirmation that Customer Data has been physically deleted.
  • Organization deletion: When you delete an organization, its subscription is cancelled and access is immediately and irreversibly revoked. Associated data is retained only as long as necessary for the purposes and legal obligations described above.
  • User account deletion: Deleting your user account removes your individual access. It does not delete organizations or their Customer Data. Limited personal data may be retained when required for security, dispute resolution, or legal obligations.
  • Data deletion requests (GDPR Article 17): Requests for erasure are handled in accordance with applicable law. We normally respond within one month; legally permitted extensions may apply to complex or multiple requests.
  • Billing and financial records: Transaction records and billing information may be retained beyond the above timelines as required by applicable law, including French tax regulations (up to 10 years for financial records).

Data subject rights

Under GDPR, you have the following rights regarding your personal data. To exercise any of these rights, contact us at support@extralt.com.

  • Right to be informed: We inform you about what we do with your data through this page and our Privacy Policy.
  • Right to access: You can request a copy of all personal data we hold about you.
  • Right to rectification: You can request correction of inaccurate personal data.
  • Right to erasure: You can request deletion of your personal data.
  • Right to restrict processing: You can request that we limit how we use your data.
  • Right to data portability: You can request your data in a portable format.
  • Right to object: You can object to certain types of processing, such as direct marketing.

Lawful basis for processing

Under GDPR Article 6, we process your personal data based on the following lawful bases:

  • Contract performance: Processing your registration, account, and payment information is necessary to provide you with the Extralt Service.
  • Legitimate interests: We process usage data to improve our service, ensure security, and prevent fraud. We balance these interests against your privacy rights.
  • Legal obligations: We may process data to comply with applicable laws, such as tax and accounting requirements.

Sub-processors

We use the following third-party service providers. Each is contractually bound to GDPR-compliant data handling.

  • Clerk - Authentication and user management
  • Stripe - Payment processing
  • Convex - Database and backend infrastructure
  • Cloudflare - Content delivery and hosting
  • ClickHouse - Data storage and analytics
  • Sentry - Error monitoring
  • PostHog - Product analytics
  • Google Analytics - Website analytics for public marketing pages
  • Google Cloud - AI processing for product enrichment and AI assistant responses

Data Protection Officer

Given the nature and scale of our data processing activities, Extralt is not required to appoint a Data Protection Officer under GDPR Article 37. For any data protection inquiries, please contact us at support@extralt.com.

Questions?

If you have any questions about our GDPR compliance or wish to exercise your data rights, contact us at support@extralt.com.