1. Data controller
Market Sonar is published by Catalyz SAS, a simplified joint stock company (SAS) registered in France.
- SIREN: 106 681 927
- Registered office: 36 rue d'Alsace-Lorraine, 31000 Toulouse, France
- Contact: hello@market-sonar.com
2. Data we collect
Account data. When you register, we collect your name, email address, and password (hashed). If you subscribe to a paid plan, payment is processed by Stripe; we store only a Stripe customer ID, never card details.
Usage data. We log page views, feature usage, and API calls to improve the service. Logs include your IP address, browser type, and timestamp.
Competitor data. Data you ask us to collect (pricing pages, social accounts) is stored to deliver the service. This data is publicly available information from competitor websites.
Posts from professional LinkedIn profiles. When a customer chooses to follow a competitor whose only LinkedIn presence is a person’s profile (a freelancer or sole trader), we read that profile’s public posts and their figures: text, date, format, images posted, documents posted (we keep a document’s cover image and its PDF file), and the number of reactions, comments and reposts. We never read their connections, followers, career, skills, contact details or profile photo, nor the people who react to their posts. A third-party provider, Apify, collects this data from public pages. If the customer’s team has turned it on, an artificial intelligence (Mistral) files these posts by topic and summarises them for the team, drawing no conclusion about the person. Only the customer’s team that follows the profile, and the messaging channels it has connected, can see this data, and those channels never receive the posts’ text. It appears in no report, shared finding or answer to an assistant. The details, for the people concerned, are in §6.
Instagram connection. If you connect your business's own Instagram account (Instagram Login), we receive an access token, the account's id, username and account type, the follower count, your stories and their insights (views, reach, follows, profile visits, taps, exits, replies, shares), daily follows and unfollows, and, when you publish from Market Sonar, the id, link and insights of what you published. We publish only posts a member of your team prepared and approved in Market Sonar, to the connected account only.
Canva connection. Each member who can edit publications may connect their own Canva account (Settings → Connections). We then receive an access token, the id of that Canva account and the id of its Canva team. When you create a design from a publication, we send, at your request, to your own Canva account, its size and its title (the publication's title, or its date, followed by “· Market Sonar”); when you import a design, your search and the pages you chose. These go to Canva Pty Ltd, in Australia, outside the European Union. This transfer is necessary for the service you ask for (Article 49(1)(b) GDPR). Canva sends back the list of your designs (title, number of pages, date modified, thumbnail), which only you see and which we do not store, then the exported files of the pages you choose to import, which become media of the publication like any upload. We send Canva none of your media, none of your publications' text beyond that title, and no data about your competitors.
Contact form. When you use the contact form, we collect your name, email, company name (optional), and message.
3. Why we process your data
- To provide and operate the Market Sonar service (contract performance)
- To send transactional emails: password resets, billing receipts, change alerts (contract performance)
- To respond to your enquiries via the contact form (legitimate interest)
- To improve the service through aggregated, anonymised analytics (legitimate interest)
- Letting our customers follow their competitors’ public communication, including a freelancer’s posts published from their professional LinkedIn profile (the legitimate interest of our customers and of Market Sonar). We have weighed this interest against the rights of the people concerned: only posts the person made public to promote their business are read; no profile, network or contact data is collected; the data stays within the customer’s team, is never sold and is never used to make a decision about the person; it is erased after 12 months; and any objection is applied across all our customers.
- To comply with legal obligations, including accounting and tax requirements
We do not sell your personal data. We do not use your data for profiling or automated decision-making.
4. Sub-processors
We use the following third-party services to operate Market Sonar:
- Scaleway (France) — hosting infrastructure
- Stripe (USA, EU SCCs) — payment processing
- Mistral (France) — AI analysis of competitor data, and alt text suggestions for a publication's images when a member asks for them, imported images included
- Apify (Czech Republic) — collection of competitors’ public pages (social networks, reviews)
- Sentry (EU region, Frankfurt) — error monitoring
- Brevo (France) — sending service e-mails (invitations, sign-in links, notifications), including to the contacts our customers invite to approve their publications
Services you connect yourself: Canva (Canva Pty Ltd, Australia), with the Canva account each member chooses to connect to create, import and update their publications' visuals. Canva is not our processor; it processes this data under its own terms and privacy policy.
5. Data retention
Account data is retained for the duration of your account plus 30 days after deletion. Competitor data you collected is deleted when you delete the competitor or close your account. Posts read from a personal LinkedIn profile are erased 12 months after their publication date, and at once when the customer stops following the profile or the person objects. Server logs are retained for 90 days. Invoices and billing records are retained for 10 years as required by French law.
Instagram data is kept while the account stays connected and your team exists. Images and videos prepared in the Calendar are deleted 90 days after the post was published or cancelled. Disconnecting Instagram deletes the access token at once.
For Canva, the access token is encrypted and kept while the account stays connected. For each imported medium we keep its design's id, page, title and date modified, and the Canva connection that imported it, to offer “Update from Canva”; the link of your imported media is removed when you disconnect your Canva account, and those media stay in the publication, kept like the Calendar's other media. The record of each export (design and its title, pages, format, state) is deleted after 90 days, that of each trip to Canva one week after it expired. The ids of your Canva account and its team stay on the closed connection until you connect again, your account is deleted or the team is deleted. Download addresses and thumbnails from Canva are never stored.
6. Your rights
Under the GDPR, you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data. To exercise any of these rights, email hello@market-sonar.com. We will respond within 30 days.
You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertes), the French data protection authority.
To delete the data we read from Instagram, disconnect it in Settings → Connections, remove Market Sonar from your Instagram account (Settings → Apps and websites), or email us. A deletion request from Instagram deletes that account's access token, story insights, follower days and the stories we stored from Instagram, and gives you a confirmation code and a status page.
To remove Market Sonar's access to your Canva account, click “Disconnect Canva” in Settings → Connections: we ask Canva to revoke the access token and delete it on our side, even if Canva does not answer, and the media you imported lose their link to their designs. Your designs stay in your Canva account, under Canva's own privacy policy.
If we read your LinkedIn profile. Market Sonar is a competitive watch tool. One or more of our customers, who compete with your business, have chosen to follow your LinkedIn profile because you use it for that business.
- What we read. Your public posts and their figures: text, date, format, images posted, documents posted (we keep a document’s cover image and its PDF file), and the number of reactions, comments and reposts. Never your profile itself, your connections, your followers, your career, your contact details, your profile photo, or the people who react.
- Where the data comes from. Your public posts on LinkedIn, read from public pages by our provider Apify. A post restricted to your connections, or a profile you have hidden from logged-out visitors, is not read.
- Why. Our customers’ competitive watch, on the basis of their legitimate interest and ours (§3). If the customer’s team has turned it on, an artificial intelligence (Mistral) files your posts by topic and summarises them for the team. It draws no conclusion about you, and no decision concerns you.
- Who sees it. Only the customer’s team that follows your profile, in Market Sonar, and the messaging channels it has connected, which never receive your posts’ text. The posts appear in no report, shared finding or answer to an assistant. Our processors (§4) handle them on our behalf only.
- How long. Each post is erased 12 months after its date, with its images and document, and at once if the customer stops following your profile or you object.
- How to object. At any time, without giving a reason: write to rgpd@market-sonar.com with your profile’s address, or reply to our message on LinkedIn. Within two working days we erase your posts and their figures for all our customers, and your profile can no longer be added. We keep only a fingerprint of your profile’s address, which cannot by itself be turned back into the address, to stop it being added again.
- Your other rights. To obtain the data we hold about you, we will ask you to show that the profile is yours. You may also complain to the CNIL (cnil.fr).
7. Cookies
Market Sonar uses strictly necessary cookies for authentication and session management. We do not use tracking cookies, advertising cookies, or third-party analytics that set cookies. No cookie consent banner is required under EU regulations for strictly necessary cookies.
8. Security
Data is encrypted in transit (TLS 1.3) and at rest. Passwords are hashed with bcrypt. Access to production systems is restricted to authorised personnel via SSH key authentication.
9. Changes to this policy
We may update this policy from time to time. Material changes will be communicated by email to registered users at least 14 days before they take effect.