This policy covers cuik.io, the Cuik application, its APIs and MCP connector. It explains the data we use to provide the service and the choices you have. The Chrome extension also has a dedicated notice.
Who is responsible?
Cuik is operated by EMEKA, a French SAS company, SIRET 98067966600019, 10 rue de la Paix, 75002 Paris, France. Contact us about personal data at lesieutre.kevin@gmail.com.
EMEKA is the controller for account administration, billing, operation and security of the service. When you import your clients’ data, you remain responsible for its use and the necessary permissions; Cuik processes it to provide the features you request.
Data and purposes
- Account and subscription: email, name, preferences, account identifiers, plan and billing information, used to authenticate you, manage access, bill you and send service messages. Stripe processes payments; Cuik does not store your full payment card number.
- Projects and analyses: websites and URLs analysed, crawl results, keywords, SEO data, uploaded files, reports, tasks, comments and settings, used to perform, save and share your work as you choose.
- Google connections: connected account identity, authorised sites or properties, requested data and authorisation tokens needed for synchronisation, as described below.
- Support and feedback: messages, screenshots and attachments you submit, technical page context and optional voice dictation, used to assist you and resolve problems. Avoid including passwords or unnecessary sensitive information.
- Operation and security: request and error logs, IP address and browser information, depending on the services used, to diagnose incidents and prevent abuse.
Account creation and the features you request are processed to perform our service contract. Billing also involves legal obligations. Security and support rely on our legitimate interest in operating a reliable service. Optional audience measurement relies on your consent.
Information required for an account or operation is necessary to provide it. Google connections and AI features are optional; without the relevant permission or data, only the affected feature is unavailable.
Google data
Google Analytics: Cuik reads the properties you authorise and their statistics, such as visits, pages, traffic sources and conversion events. This supports your dashboards, analyses and reports. Analytics access is read-only: Cuik does not modify your property or its configuration.
Google Search Console: Cuik reads authorised sites and search performance, including queries, pages, clicks, impressions, positions and selected dimensions. This supports SEO monitoring, clusters and reports.
Google Drive, Sheets and Slides: when you request an export or use a template, the relevant permissions allow access to the templates involved and creation or modification of the documents you request. This is separate from the read-only Analytics connection. Google’s consent screen lists the permissions for the flow you choose.
Account identity associates the connection with the correct user. Authorisation tokens support continued authorised access without signing in for every request. Results may be cached or saved in your projects and reports.
You can disconnect the account in Cuik and revoke permission in your Google account connections. Revocation prevents subsequent access using that permission; it does not automatically delete results already saved in Cuik or documents exported to your Drive. Use available deletion controls or contact us to delete data held by Cuik.
Cuik does not use data obtained through Google APIs to sell profiles or target advertising. This includes data from Google Workspace APIs (Drive, Sheets and Slides): Cuik does not use these data to build, refine or train non-personalised artificial intelligence or machine-learning models. Use and transfer to other applications are limited to requested features, in accordance with the Limited Use requirements of the Google API Services User Data Policy.
AI and the MCP connector
When you request an AI-assisted feature, the data needed to perform it may be sent to its provider: OpenAI for certain assistance features and voice transcription, and Anthropic for certain analyses and cluster suggestions. Depending on your request, this can include instructions, keywords, URLs, result or report excerpts, including relevant Google data. Voice dictation sends the recording to the transcription service to obtain text.
Cuik uses these providers’ business APIs; their policies provide for no training on these data by default. This does not mean that providers have no technical retention. See OpenAI’s business data terms and Anthropic’s API retention rules.
When you connect Cuik to an external assistant through MCP, authorised tools can send it data you ask to retrieve and perform changes within your permissions. That assistant’s provider applies its own retention and use policies: review its settings before providing confidential information. Cuik cannot enforce those settings on your assistant.
Recipients and sharing
EMEKA and the providers of the features you use process necessary data: hosting and infrastructure providers, Supabase for authentication and some application data, Google for connected services, Stripe for payments, Brevo for email and the AI providers described above. SEO searches may send requested domains, URLs or keywords to providers such as DataForSEO or Haloscan. These providers do not all receive all your data.
Shared reports, documents and boards are available to recipients according to your sharing settings. A link available without sign-in can be opened by someone it is forwarded to: choose its content carefully and disable it when no longer needed.
Some providers are established or process data outside the European Economic Area. Applicable terms and safeguards depend on the provider and service, including adequacy decisions and standard contractual clauses where applicable. Contact us for details of recipients and safeguards for processing that concerns you. Cuik does not claim that all data remain exclusively in France or Europe.
Retention and deletion
Cancelling a subscription does not delete your account or work. Account and project data are retained while your account remains open and they are needed for the service, or until you request deletion. For team data, your personal account must be distinguished from content belonging to the team.
To close your account, delete your data or request deletion of imported Google data, email lesieutre.kevin@gmail.com from your account address and specify the scope. We verify your identity proportionately, process the request and respond within one month. If a lawful extension is necessary because of complexity, we notify you within that month and explain why.
The request covers the relevant active data and management of any backup copies. The backup handling timeframe is explained in our response according to the media involved; backups are not used to restore a deleted account. There is no promise of an automatic purge on the same date across every medium.
Accounting documents and supporting records subject to legal retention are kept for 10 years after the end of the relevant financial year. Evidence needed to establish or defend a legal claim may be retained for the applicable dispute or legal limitation period, with access restricted to that purpose. Support correspondence and technical logs are retained according to request resolution, diagnostic needs and applicable obligations; they are included in the scope reviewed when an erasure request is received.
Files already exported to your Google Drive and copies downloaded by you or recipients remain under their control. Deletion in Cuik does not delete those copies.
Security
Connections to the service use HTTPS. Cuik uses authentication and access permission mechanisms for accounts and workspaces. Sharing links and connector permissions should be managed as access to your data. We address identified security defects; no measure can guarantee zero risk.
Report unexpected access or privacy concerns to lesieutre.kevin@gmail.com, without sending passwords or access tokens.
Cookies and audience measurement
Storage required for sessions, security and functional preferences is separate from optional audience measurement. Declining measurement does not delete your account or Google connections.
On the marketing website, Google Analytics can measure visits and interactions and Microsoft Clarity can analyse page usage. Clarity is also present in the current version of the SaaS application; it is disabled in the upcoming V3. The website’s optional audience measurement tools are loaded only after you agree. Your choice is saved for six months in this browser, separately on each site. Accept, decline or change it in the “Cookies” section of this page. Clearing browser storage resets the choice.
Your rights
You can request access, rectification, erasure, restriction and, where legally applicable, portability or object to processing. You can withdraw consent without affecting earlier lawful processing. Send requests to lesieutre.kevin@gmail.com; proof of identity is requested only when necessary.
If our response is unsatisfactory, you can complain to the CNIL or your data protection authority. We update this policy to reflect service changes and communicate material changes through an appropriate channel.