Dernière mise à jour : February 13, 2026
This Privacy Policy is issued by MEGAMOUNT, a French single-member limited liability company (EURL) with share capital of €1,000, registered under SIRET number 944 778 984 00012, R.C.S 944 778 984 Paris and VAT number FR68944778984.
Registered office: 30 BOULEVARD DE SEBASTOPOL, 75004 PARIS, France
Managing director: Adam Fontaine
Contact: info@index10.com
Index 10 is an AI-powered platform that generates complete web applications, SaaS products and websites. Users describe their product in natural language, configure options and deploy production-ready projects.
This policy covers data related to the use of Index 10. Data processed by applications created by our customers is the responsibility of those customers (data controllers).
We collect the following categories of personal data:
Your data is processed for the following purposes:
We may share data with trusted partners strictly necessary to operate the service:
For detailed information on sub-processors, see our Data Processing Agreement (DPA).
Some providers are located outside the European Economic Area. Transfers are protected by:
Transfer details are available in our DPA.
You can exercise the following rights regarding your personal data:
How to exercise your rights: Send your request to privacy@index10.com, specifying your identity and the right you wish to exercise. We may request proof of identity for verification. Exercising these rights is free of charge.
Response time: We will respond within one (1) month of receiving your request. This period may be extended by two additional months where requests are complex or numerous, in which case we will inform you within the initial month.
Portability format: Exported data will be provided in a structured, commonly used and machine-readable format (JSON or CSV).
We apply strict security controls to protect your information:
On the Index 10 platform: We use essential cookies (mandatory) and optional cookies (analytics, marketing). Manage your preferences at any time in our Cookie Policy.
On deployed user applications: The built-in analytics system for published projects does not use any cookies, localStorage, or any client-side storage technology. See section 15 below for details.
Controller: MEGAMOUNT
General contact: info@index10.com
Data protection contact: privacy@index10.com
Address: 30 BOULEVARD DE SEBASTOPOL, 75004 PARIS, France
If you believe your rights have been infringed, you may lodge a complaint with the CNIL (France) or your local supervisory authority. In particular, you may contact the Federal Data Protection and Information Commissioner (FDPIC) if you reside in Switzerland (www.edoeb.admin.ch), the Office of the Privacy Commissioner of Canada (OPC) if you reside in Canada (www.priv.gc.ca), or any other competent supervisory authority in your jurisdiction.
We may update this policy to reflect changes in our practices or applicable regulations. Non-material changes (typographical corrections, clarifications) may be made without prior notice. Material changes affecting your rights or data processing will be announced via email and/or in-app notification at least 30 days before they take effect. Where a change relies on your consent, we will request your explicit consent before the change comes into effect.
When you accept our Terms of Service and Privacy Policy (during registration), we record your IP address and user-agent.
Legal basis: Legal obligation (GDPR Art. 6.1.c, read together with Art. 7.1 GDPR) — the controller must be able to demonstrate that the data subject has given consent. Storing this evidence is an obligation imposed by the GDPR.
Purpose: To prove that you accepted the legal documents on a specific date, in case of dispute.
Retention period: Duration of the contractual relationship, then 5 years from the end of the contract (statute of limitations under French law — Art. 2224 Civil Code).
Your rights: You may request access to this data by contacting privacy@index10.com.
Our platform leverages AI models provided by Anthropic (code generation) and OpenAI (image generation via DALL-E 3 and complementary AI models). Prompts and data you submit are transmitted to these providers' commercial APIs, whose terms include Data Processing Addendums incorporated by reference. Both Anthropic and OpenAI may retain this data for a maximum of 30 days for security, abuse prevention and compliance purposes, after which it is deleted. Under Anthropic's Commercial Terms (Section B), Anthropic may not use data submitted via the API ("Customer Content") to train its AI models. Similarly, under OpenAI's business terms, OpenAI does not use data submitted via the API to train its models. For more details, see Anthropic's Commercial Terms and OpenAI's Business Terms.
MEGAMOUNT does NOT use any Customer Data to train its own AI models.
As part of delivering the service, MEGAMOUNT has technical access to the prompts and conversations you exchange with the AI through the platform, as well as to the generated code.
Purposes of this access:
Legal bases: Contract performance (GDPR Art. 6.1.b) and legitimate interest (GDPR Art. 6.1.f — security and abuse prevention).
Restricted access: Only authorised MEGAMOUNT personnel, bound by confidentiality obligations, may access this data and only when necessary for the purposes described above. We do not systematically read your conversations.
Your rights: You can request deletion of your conversation history at any time by contacting privacy@index10.com or by deleting your account.
When you publish an application through Index 10, a lightweight analytics script is automatically embedded to provide traffic statistics (visitor count, page views, bounce rate, traffic sources, devices). This system is designed to be GDPR-compliant without requiring visitor consent.
This processing relies on legitimate interest (GDPR Art. 6(1)(f)) for audience measurement. No ePrivacy consent (Art. 5(3) of the ePrivacy Directive) is required because nothing is stored on the visitor's device.
Retention period: Aggregated data is retained for as long as the project is active. Raw event data is retained for a maximum of 90 days.
You can disable analytics collection for any project at any time from the project settings (Settings > Analytics). Disabling analytics triggers an automatic redeployment of your application without the analytics script. No visitor data will be collected after disabling.
Responsibility: Index 10 users who publish applications are data controllers for their own visitors' data. Index 10 acts as a data processor for this processing.
Index 10 is a professional web application generation service intended for adults. The service is not intended for individuals under 16 years of age (as set by Art. 45 of the French Data Protection Act, in accordance with Art. 8 GDPR).
We do not knowingly collect personal data from minors under 16. If we become aware that a minor under 16 has provided us with personal data without the required parental consent, we will take steps to delete such data as soon as possible.
If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@index10.com so we can arrange deletion.
In accordance with Article 22 GDPR, we inform you that:
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
In accordance with Articles 33 and 34 GDPR, in the event of a personal data breach:
MEGAMOUNT may disclose personal data when required by law, including in response to:
Unless legally prohibited, we will endeavour to notify you before any such disclosure. Any data disclosed will be restricted to the minimum required and processed in accordance with applicable law.
Index 10 may integrate with or provide access to external services such as version control platforms, cloud infrastructure providers, payment processors and other tools. These third-party services operate under their own privacy policies and terms, over which MEGAMOUNT exercises no control. We recommend reviewing the applicable privacy documentation before sharing personal data with any external service. MEGAMOUNT cannot be held liable for the data protection practices of these third parties, which we encourage you to verify before use.
Exercising your data protection rights (access, rectification, erasure, objection, etc.) will never result in adverse treatment. You will not be penalised, discriminated against or subjected to different service conditions for having exercised these rights.
Should a competent court or authority declare any provision of this policy invalid or unenforceable, the remaining provisions shall continue to apply in full. The affected provision shall be replaced by a valid provision that most closely achieves the intended legal and economic purpose.
Provisions of this policy that, by their nature, must survive termination of the contractual relationship shall continue to apply after termination or expiration of your account. This includes in particular obligations relating to data retention (§7, §13), data subject rights (§8), breach notification (§18) and proof of consent.
© 2025-2026 MEGAMOUNT. All rights reserved.