Privacy

GRC Platforms is operated by Better ISMS EURL, 60 rue François 1er, 75008 Paris, France (RCS Paris 943 594 648), the controller for the data described here. This page covers the public directory at grcplatforms.com: catalog pages, the listing form, and the machine-readable catalog used by AI agents.

Public catalog pages show only business and product information from public sources or submitted for listing.

New listings are paid and taken on /submit only. Until 9 November 2026, submissions were also taken through a form run by Tally (tally.so), our form processor; Tally still holds what was entered there (a business email and listing details). We use it only to review those submissions and to contact you about them, on the basis of our legitimate interest in keeping the directory accurate. We never publish the submitter email.

A paid listing collects a business email and the listing details on /submit. They are stored in a Cloudflare D1 database operated by Better ISMS. We use the email only to process the listing and write to you about it: a receipt, the link once it is live, or a refund notice. We never publish it. The legal basis is the performance of the contract you asked for, and our legal obligations for accounting records.

Payments are processed by Stripe. We never see or store card details; we keep the Stripe session and payment references so we can match the payment to your listing and refund it if needed. Checkout sets one essential cookie, for up to one hour, so only your browser can resume that checkout. It is not used for tracking.

These emails are sent through Resend, our email delivery provider. Resend processes your email address and the message content to deliver them, stores message data in the United States for 30 days, and transfers it under the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses. Stripe and Cloudflare may also process data outside the EU under the same kinds of safeguards. Write to us for a copy of them.

Retention: an abandoned checkout, with its details, goes after 30 days. The contact email goes 12 months after the submission, once it is finished, or 24 months after it if a refund could not be completed. Listing details stay while the listing is published, because that is their purpose; those of a listing we finished without publishing go after 12 months, except its name and website. Payment references stay for 10 years as accounting records. Event logs lose their contents, including any email address, after 90 days; technical delivery records stay with the listing record.

The site is hosted on Cloudflare, which processes request data such as IP addresses to serve pages and block abuse. We run no analytics service and no advertising pixels on this site. The public search API and catalog dump do not require an account.

We do not sell personal data. You can ask for access to, correction, deletion or a copy of your data, or object to its use, by writing to contact@ismscopilot.com. You can also complain to the CNIL, the French data protection authority.

Last updated: 2026-11-09