Legal
Privacy policy
Who processes your data
Aleph Index, a French société par actions simplifiée whose registered office is at 39 avenue Pierre Ier de Serbie, 75008 Paris, is the controller of the personal data collected through this site. Aleph Index processes your data in accordance with French law no. 78-17 of 6 January 1978 and with Regulation (EU) 2016/679 (GDPR). For any question about your data, write to contact@aleph-index.com.
What we collect, and when
We only collect data you send us. A demo, contact or documentation request gives us your name, work email, phone number, organisation, profile and message. A search run in Open Search sends the terms you type to our engine, without our tying them to you. Our host keeps technical logs, including your IP address, solely for security and anomaly detection. Finally, if you accepted audience measurement, the pages you view, how long you stay, the site or search engine that brought you, your country, your device type and your IP address are sent to Google Analytics. If you declined, none of that is collected.
Why, and on what basis
Answering a demo, contact or documentation request falls under pre-contractual steps taken at your request. Keeping the site secure and available rests on our legitimate interest. Audience measurement rests on your consent, and on nothing else: we only carry it out if you have given it, and you may withdraw it at any time. Outside Company 360, described below, we do not use your data for prospecting. We do no profiling, and no decision concerning you is taken by automated means.
Company 360: what we collect, and why
Company 360, our analysis of a company's exposure on the dark web, is served at c360.aleph-index.com and falls under this policy. Below the pre-analysis, we ask for a work email address, which we verify with a code. Ordering a report also asks for your last name, first name and company and, if you wish, a phone number. These details are used to send you the document you asked for, to process and invoice your order, and to reach you if the analysis requires it. Requests made from the same browser, or with the same confirmed address, are linked together for internal follow-up. Addresses collected on 25 and 26 September 2026, under a text that said so, may also be used to tell you about Aleph's cybersecurity offers. That purpose rests on our legitimate interest in presenting our services to professionals whose activity matches them (Article 6.1.f GDPR). We no longer collect addresses for that purpose: those collected before or since are used only to handle the request they belong to.
Company 360: our messages, and how to stop them
Every prospecting message we send carries an unsubscribe link that works in one click, with no account and no form. Your objection is recorded at once and permanently: we then keep only your address and the date you opted out, solely so that we never write to you again. You may also object by writing to contact@aleph-index.com. Your details are never sold, rented or transferred to a third party, and they are not used for targeted advertising: neither your address, nor your company's name, nor the result of your analysis is passed to a commercial partner. A request that goes nowhere, meaning one never paid for, is deleted along with its details thirty days after your last action. The details of a paid order are kept for as long as our accounting obligations require. An address on our mailing list stays there until you object, or for three years without any interaction from you.
Company 360: the free alert (Aleph Alert)
Below the pre-analysis, you can ask to be told if new documents mentioning your company appear. For this we collect your first name, last name and work email address, which we verify with a code. The company's analysis is run again regularly, with no guaranteed frequency; when it changes, we write to you, and our messages offer to order a report or to talk with our team. This processing rests on your consent, which you withdraw in one click through the link in every message: the alert stops and your details are erased at once. They are kept for as long as the alert is active; an alert request never confirmed is deleted after seven days, and a stopped alert keeps only its dates, for one year.
If you do not fill in the form
The fields we ask for are the ones we need in order to give you a useful answer: without them, we cannot handle your request. No other field is required, and nothing obliges you to write to us in order to browse this site.
How long we keep them
Contact request data is kept for as long as it takes to handle, then three years from the last exchange. Technical logs are kept by our host only for as long as the security of the service requires, then deleted. The audience-measurement cookie expires after thirteen months, and traffic data is kept by Google for the period set on our Analytics property, which the tool caps at fourteen months. Your choice to accept or decline is kept for six months in your browser, after which you are asked again.
Who they are shared with
No one, other than processors bound by contract and acting on our instructions: the hosting of the site, the tools we use to handle your request — business email and customer follow-up — and, if you accepted audience measurement, Google Ireland Limited for Google Analytics. Their access is limited to the data their task requires, and we require the corresponding protection and confidentiality measures from them. We have turned off Google signals and ad personalisation: traffic data serves neither advertising nor cross-site matching. We never sell or transfer your data.
Where they are hosted
The site and the requests you send us sit on servers located in France, and do not leave the European Union. There is one exception, and it is yours to decide: if you accept audience measurement, traffic data is processed by Google, which may transfer it to the United States. That transfer relies on the EU–US Data Privacy Framework, to which Google LLC adheres, together with the European Commission standard contractual clauses. If you decline measurement, no data leaves the European Union.
How they are protected
Exchanges with this site are encrypted end to end by TLS. Access to the requests we receive is limited to the people who need to handle them. These measures are reviewed as the site evolves.
Cookies and trackers
This site sets no advertising cookie, no tracking pixel and no social media button. It uses Google Analytics to count visits, and only if you accept: until you click Accept, the Google tag is not loaded, no request goes to Google and no cookie is set. If you accept, two cookies are set, _ga and _ga_JBR6JYKBKP, which tell visitors and sessions apart, and which expire after thirteen months. Declining degrades nothing: the site works exactly the same. You can change your choice at any time through the Cookies link at the foot of every page, and you are asked again every six months. On c360.aleph-index.com, no measurement cookie is set and no third-party analytics tool is loaded. To know where our visitors come from, our server records, each time the home page is displayed, two general pieces of information: the type of source (search engine, social network, direct link…) and the type of device (computer, phone, tablet). They are counted per hour, with no IP address, no identifier and nothing that could identify you. When you run a search, these same two pieces of information are attached to your request, and deleted with it.
Links to other sites
Our pages link to partner, reference and institutional sites, and some links open in a new tab. Those sites have their own privacy policies and we are not answerable for how they use information collected there. We invite you to read them before sending anything.
Your rights
You have rights of access, rectification, erasure, restriction, objection and portability. You may also object at any time, and without giving a reason, to the processing of your data for communication purposes. To exercise these rights, write to contact@aleph-index.com or by post to the registered office. We answer within one month. If our answer does not satisfy you, you may lodge a complaint with the CNIL, 3 place de Fontenoy, 75007 Paris.
Changes to this policy
We may update this policy. Any significant change will be flagged on this page, with the date it takes effect.
In force as of 30 September 2026.