Legal document
Privacy policy — ret-ai-ler
Version 1.2 of 17 October 2026
This policy describes how Alpha 11 SRL (CBE BE 0769.418.252, Quai des Péniches 44, box 20, 1000 Brussels — “Alpha 11”, “we”) processes personal data in connection with the ret-ai-ler service (the “Service”), in accordance with Regulation (EU) 2016/679 (“GDPR”) and the Belgian Act of 30 July 2018.
Contact for any data-related question: [email protected].
1. Our two roles
Alpha 11 is the controller for the data it processes on its own behalf: management of User accounts, contractual relationship and invoicing, support, security and improvement of the Service, showcase website.
Alpha 11 is a processor for the data that the professional Customer entrusts to the Service in the course of its business (purchase and order history imported from its Retailer accounts, baskets, scanned receipts and invoices, recipes, preferences, data of its staff and suppliers). This processing is carried out on the Customer's instructions and governed by the Data Processing Agreement (Annex 2 to the General Subscription Terms). The Customer is the controller and the recipient of requests to exercise rights relating to this data.
2. Data we process
Identity and account: name, professional email address, technical identifier, organisation, role, language; provided by the Customer or by the User when the account is created via our authentication provider.
Retailer session: a session token issued by the Retailer when the User logs in to their Retailer account themselves in a secure window. We never receive or store the Retailer password. The token is stored encrypted, isolated per User, and deleted on logout or when it expires.
Shopping data: instructions and messages exchanged with the assistant, baskets proposed and approved, recurring products, order history imported from the Retailer account, preferences and exclusions (diet, allergens), order templates, events, recipes, photos of receipts, invoices or price lists submitted, postcode or pickup store, household or professional profile.
WhatsApp channel (if enabled): phone number, text messages, voice notes and images sent to the Service number.
Usage and technical data: operating logs (timestamp, actions, errors), AI Credits consumption counter, IP address, browser or app type. Logs are systematically scrubbed of secrets (passwords, tokens, session links).
Billing: company contact details, billing references, payment history (handled by our accounting team; no bank card data is processed by the Service).
Demo request (showcase website): name, business, email address, phone (optional), message (optional), as well as the IP address and country of connection for anti-abuse purposes. Alpha 11 is the controller.
We do not intentionally process special categories of data (Article 9 GDPR); declared dietary preferences or allergens are processed only to filter proposals, on the User's instruction.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and secure accounts, authenticate Users | Performance of the contract (Art. 6.1.b) |
| Provide the Service: understand instructions, import history, compose baskets, compare prices, prepare the basket on the Retailer account | Performance of the contract (Art. 6.1.b); for the professional Customer's data, Customer's instructions (Art. 28) |
| Import purchase history from the Retailer account, on the Customer's express mandate to exercise its right to portability on its behalf | Performance of the contract and Customer's mandate (Art. 20 GDPR; Art. 5.4 of the General Subscription Terms) |
| Personalise proposals (habits, preferences, exclusions) | Performance of the contract; health-related exclusions are recorded only at the User's explicit request (Art. 9.2.a) |
| Invoice, collect payment, keep accounts | Performance of the contract and legal obligations (Art. 6.1.c) |
| Provide support and answer requests | Performance of the contract and legitimate interest |
| Secure the Service, prevent fraud and abuse, keep logs | Legitimate interest (Art. 6.1.f) and legal obligation |
| Measure AI Credits consumption and use of the Service, improve features and the quality of product matching (aggregated statistics) | Legitimate interest (Art. 6.1.f) |
| Inform the Customer of changes to the Service | Legitimate interest; right to object at any time |
| Respond to a demo request and get back to you | Legitimate interest (Art. 6.1.f): responding to the request of a professional interested in the Service; pre-contractual measures (Art. 6.1.b) when you act on your own behalf |
| Protect the form against bots and abuse | Legitimate interest (Art. 6.1.f) |
| Analytics, browsing analysis and identification of visiting companies | Consent (Art. 6.1.a GDPR; Art. 10/2 of the Act of 30 July 2018) |
We make no decision producing legal effects or similarly significantly affecting you based solely on automated processing: every order is approved and paid for by the User personally.
4. Artificial intelligence
The Service uses generative AI models provided by third parties (currently Anthropic for language models and OpenAI for voice note transcription). The instructions, history extracts, product lists and images needed for an action are sent to these providers for processing, under commercial (API) contracts that prohibit the use of this data to train their models. Alpha 11 does not train any model on its customers' personal data. When the User accesses the Service through their own AI assistant (for example Claude or ChatGPT), that assistant's terms and privacy policy apply to the exchanges that take place there.
5. Recipients and sub-processors
Data is accessible only to Alpha 11 (restricted access, authorised persons only) and to the following providers, acting on our instructions:
| Provider | Role | Location |
|---|---|---|
| Google Cloud (Cloud Run, Cloud SQL PostgreSQL, storage) | Hosting and database | EU — europe-west1 region (Belgium) |
| WorkOS | User authentication (AuthKit, OAuth) | United States (standard contractual clauses) |
| Anthropic | Language models (chat, basket composition, analyses) | United States (standard contractual clauses) |
| OpenAI | WhatsApp voice note transcription (Whisper) | United States (standard contractual clauses) |
| Anchor Browser | Secure cloud browser used during the initial login to the Retailer account | EU / United States depending on the session (standard contractual clauses) |
| Cloudflare | Hosting of the showcase website, network protection, anti-bot verification (Turnstile) and cookie-free analytics (Web Analytics, after consent) | EU / worldwide (standard contractual clauses) |
| Google Ireland Limited (Google Analytics 4) | Showcase website analytics, after consent | Collected via EU servers; processing possible in the United States (EU–US Data Privacy Framework / standard contractual clauses) |
| PostHog, Inc. (PostHog Cloud EU) | Analytics and user-journey analysis on the showcase website, after consent | EU — Frankfurt, Germany (AWS eu-central-1); possible transfers to the United States covered by standard contractual clauses |
| Microsoft Ireland Operations Limited (Microsoft Clarity) | Browsing analysis of the showcase website (click maps, session recordings), after consent | Microsoft Azure; transfers to Microsoft Corporation (United States) covered by standard contractual clauses |
| Dealfront Group GmbH (Leadfeeder) | Identification of companies visiting the showcase website (B2B prospecting), after consent | EU — Ireland (Amazon Web Services) |
| Meta Platforms (WhatsApp Business) | Delivery of WhatsApp messages, if the channel is enabled | EU / United States (standard contractual clauses) |
| Zoho Corporation (Zoho ZeptoMail / Zoho CPaaS) | Delivery of demo request emails | EU (EU data centre) |
Customer's third-party software (for example Koust): when the Customer connects one of its own tools to the Service, data is exchanged with that tool at the Customer's request. That vendor acts on the Customer's behalf, under its own terms; it is not a processor of Alpha 11.
Retailers (Solucious, Vajra / Delibio, Terroirist, Bionaturels, Delhaize, Colruyt / Collect&Go, Bio-Planet, etc.) are separate controllers: when the Service acts on your Retailer account at your request, the Retailer processes your data under its own privacy policy.
We do not sell personal data and do not use it for any advertising purpose. We may disclose data to an authority if the law requires it.
6. Transfers outside the European Union
Data is hosted in the European Union. Some providers (authentication, AI models, messaging and, only after your consent, certain analytics and browsing-analysis tools on the showcase website — see §10) may process data from the United States. These transfers are covered by the European Commission's standard contractual clauses (Decision 2021/914) and, where applicable, by the provider's certification under the EU–US Data Privacy Framework, supplemented by technical measures (encryption in transit and at rest, minimisation of the data transmitted).
7. Retention periods
| Data | Period |
|---|---|
| User account and organisation | Term of the Contract, then 30 days (export possible), then deletion |
| Retailer session token | Until logout or expiry (a few days at most depending on the Retailer) |
| Shopping data (history, baskets, preferences, receipts, recipes) | Term of the Contract; preferences inactive for 180 days are ignored; deleted at the end of the Contract after export |
| Chat and WhatsApp messages | As long as needed for the conversation, then limited retention for support and improvement purposes (12 months at most) |
| Technical logs | 90 days (except in case of a security incident) |
| Billing data | 7 years (accounting and tax obligations) |
| Demo requests that did not lead to a contract | 12 months after the last exchange, then deletion |
8. Security
Alpha 11 applies appropriate technical and organisational measures: EU hosting, encryption of communications (TLS) and of data at rest, application-level encryption of session tokens at rest, isolated per User, data segregation by organisation, OAuth authentication, logs scrubbed of secrets, restricted and traced administrator access, backups, static security analysis of the code, and a responsible vulnerability disclosure process (see our security policy, provided on request). As the Service is in beta, absolute security cannot be guaranteed; in the event of a data breach likely to result in a risk to your rights, we will inform you in accordance with Articles 33 and 34 of the GDPR.
9. Your rights
You have the rights of access, rectification, erasure, restriction, objection, portability and, where applicable, withdrawal of consent. You can also disconnect from a Retailer and delete the imported data at any time from the Service.
To exercise your rights: [email protected]. We reply within one month. If your data was entrusted to the Service by your employer (professional Customer), we will forward your request to them or invite you to contact them, in accordance with the Data Processing Agreement.
You may lodge a complaint with the Belgian Data Protection Authority (Rue de la Presse 35, 1000 Brussels — dataprotectionauthority.be).
10. Cookies
Principle. On the showcase website (ret-ai-ler.com), no non-essential cookie or tracker is set or read, and no measurement tool is loaded, until you have made a choice. On your first visit, a banner lets you accept all, reject all or customise your choice by category. Rejecting is as easy as accepting and does not limit your browsing in any way; no category is enabled by default.
Duration of your choice. Your choice, whether acceptance or rejection, is kept for 6 months in the ral_consent cookie, after which we ask you again. We also ask you again when we add a tool or change a purpose. Some browsers clear this cookie earlier; the banner then reappears.
Withdrawal. You can change or withdraw your consent at any time, as easily as you gave it, via the “Manage cookies” link at the bottom of every page. Withdrawal stops the tools concerned and deletes from our site the cookies they had set; it does not affect the lawfulness of processing carried out beforehand.
Categories. Necessary (always active, exempt from consent); Analytics; Browsing analysis; B2B prospecting. Only the tools actually in use are offered in the banner.
| Tool | Provider | Category | Purpose | Cookies / trackers and duration | Location / transfer outside the EU |
|---|---|---|---|---|---|
| Cookie choices | Alpha 11 SRL | Necessary | Remember your consent choice and its date | ral_consent — 6 months | Your browser only |
| Cloudflare Turnstile | Cloudflare, Inc. | Necessary | Protect the demo request form against bots and abuse | Technical browser signals, strictly necessary (see below) | EU / worldwide (standard contractual clauses) |
| Cloudflare Web Analytics | Cloudflare, Inc. | Analytics | Traffic and page performance statistics | No cookies or local storage; measurement script runs in the browser | EU / worldwide (standard contractual clauses) |
| Google Analytics 4 | Google Ireland Limited | Analytics | Visits, pages viewed, journeys and traffic sources (without advertising features) | _ga, _ga_<ID> — 2 years | Collected via EU servers, IP address not stored; processing possible in the United States (EU–US Data Privacy Framework / standard contractual clauses) |
| PostHog (EU Cloud) | PostHog, Inc. | Analytics; session recordings only if browsing analysis is also accepted | Analytics and user-journey analysis (browsing events) | ph_<key>_posthog — 1 year; ph_… local storage entries | EU — Frankfurt (Germany) |
| Microsoft Clarity | Microsoft Ireland Operations Limited | Browsing analysis | Click maps and session recordings (movements, clicks, scrolling; typed content masked) | _clck — 1 year; _clsk — 1 day | Microsoft Azure; transfer to Microsoft Corporation (United States) covered by standard contractual clauses |
| Dealfront (Leadfeeder) | Dealfront Group GmbH | B2B prospecting | Identify the company from which the site is visited (based on its network's IP address) and the pages viewed, in order to contact it | _lfa — 1 year; _lfa_consent — 2 years; _lfa_expiry (local storage) | EU — Ireland (Amazon Web Services) |
These tools are not used for any advertising purpose: Google's and Microsoft's advertising signals remain denied. The web app uses only strictly necessary cookies (authenticated session, security), exempt from consent.
The demo request form is protected by Cloudflare Turnstile, which may process technical browser data to tell a human from a bot. This processing is described in Cloudflare's Turnstile Privacy Addendum.
11. Changes
This policy may be updated, in particular as the Service, the Retailers and the providers evolve. The version in force is the one published on ret-ai-ler.com; the date at the top prevails. Customers are notified of substantial changes by email.