Privacy Policy for Hyperion Consulting
Last updated: 9 November 2026
1. Website Publisher Information
Website Publisher:
Hyperion Consulting (SASU)
SIRET: 94804171000013
TVA: FR73948041710
126 Avenue du General Leclerc, 92100 Boulogne-Billancourt, France
contact@hyperion-consulting.io
Director: Mohammed Cherifi
Website Host:
AI Service Provider:
2. Data Controller
For the purposes of the General Data Protection Regulation (GDPR), the data controller is:
Hyperion Consulting
Data Protection Contact
Given the size and nature of our operations, the appointment of a Data Protection Officer (DPO) is not mandatory under Article 37 of the GDPR. However, for all data protection inquiries, you may contact:
A Record of Processing Activities (ROPA), as required by Article 30 of the GDPR, is maintained internally and is available upon request to the supervisory authority.
3. Information Collection and Use
3.1 Types of Data Collected
We collect several categories of information:
Personal Data
Information that can directly or indirectly identify you:
- Identity data: First name, last name
- Contact data: Email address, phone number (if provided)
- Technical data: IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform
- Usage data: Information about how you use our website and services
- Marketing and communications data: Your preferences in receiving marketing from us
- Enquiry journey context: A bounded public landing path, non-identifying campaign labels, referrer origin, selected call to action and diagnostic outcome may be held in memory and attached when you submit an enquiry under the form privacy consent. After analytics consent, the same context may also be stored for the current browser tab. Likely personal or opaque identifiers are filtered first.
Cookies and Similar Technologies
We use cookies and similar tracking technologies. See Section 9 for detailed information.
3.2 Legal Basis for Processing
We process your personal data based on the following legal grounds:
- Consent: When you have given clear consent for us to process your personal data for specific purposes
- Contract: Processing necessary for the performance of a contract to which you are party
- Legal obligations: Processing necessary for compliance with legal obligations
- Legitimate interests: Processing necessary for our legitimate interests or those of third parties, provided those interests are not overridden by your rights and interests
3.3 Purpose of Data Collection
We use your personal data for the following purposes:
- To provide and maintain our Service
- To manage your account and provide customer support
- To notify you about changes to our Service
- To send you marketing communications (with your consent)
- To analyse and improve our Service
- To comply with legal obligations
- To detect, prevent, and address technical issues
- To protect our rights and property
3.4 Mandatory vs Optional Data
When collecting data, we will indicate whether providing certain information is:
- Mandatory: Required to provide our services (marked with an asterisk *)
- Optional: Additional information that helps us improve our services
Consequences of not providing mandatory data: We may not be able to provide certain services to you.
4. Data Retention
We retain your personal data only for as long as necessary for the purposes set out in this Privacy Policy:
Enquiries and CRM contacts
duration of the relationship plus 2 years, then deleted by the weekly retention sweep
Prospect records (outbound research)
2 years from last activity, then deleted
CRM activity logs
3 months
Lead qualification scores and enrichment
90 days
AI assistant conversations and agent memory
30 days from last activity
Assessment submissions and attachments
with the CRM contact record; attachments are not retained after analysis
Marketing subscriptions
until you withdraw consent, or 2 years after last interaction
Marketplace accounts
for the life of the account; 30 days after deletion request, then permanently purged
Payment records (Stripe/PayPal)
10 years, as required by French commercial and tax law
Data-subject request records
3 years, as evidence that requests were handled
Compliance register entries
7 days if never completed, 90 days otherwise
Error diagnostics and consented browser performance
the configured provider retention period has not yet been verified; no default duration is asserted. Session replay is disabled in this version.
Operational alerts (Slack/Telegram)
retained in those channels per their own settings
Backups
30 days rolling, after which restores are no longer possible
Technical logs
3 months
Cookies and browser storage
see Section 9
5. Data Recipients & Processors
Your personal data may be shared with the following categories of recipients:
- Internal recipients: the founder, who is the sole person with access to personal data. Hyperion Consulting is a solo practice and has no employees.
- Service providers (processors): Third-party companies listed below that process data on our behalf
- Legal authorities: When required by law or legal proceedings
- Business transfers: In case of merger, acquisition, or sale of assets
The service providers below support the website and its operations. Roles as controller, processor or sub-processor depend on the specific processing and applicable terms. Links identify published provider terms; they do not establish that a DPA has been signed. “Not currently enabled” marks a retained integration that is inactive in the configured environment.
Mistral AI
Active stateless AI inference for explicitly initiated, production-allowlisted Helio, Search and Product Council interactions.
Requests are restricted in application code to https://api.eu.mistral.ai. Regional inference does not by itself prove Zero Data Retention or that every control-plane, support or subprocessor activity remains in the EU. See Section 6.
Data-processing and privacy termsResend
Transactional and marketing email delivery
United States (EU Standard Contractual Clauses in place)
Data-processing and privacy termsStripe Payments Europe, Ltd.
Not currently enabledMarketplace subscription payment processing. NOT CURRENTLY ENABLED: no Stripe credentials are configured in the environment this policy is published from, so no marketplace payment is taken and nothing reaches Stripe through us. The integration is retained and this entry describes the processing if it is switched back on. Separately, and unrelated to this, Stripe is loaded by the Calendly booking widget if you choose to load it — see Section 9.4.
Ireland (EU) with transfers to the United States under SCCs
Data-processing and privacy termsPayPal (Europe) S.à r.l. et Cie, S.C.A.
Not currently enabledAlternative marketplace payment method. NOT CURRENTLY ENABLED: no PayPal credentials are configured in the environment this policy is published from. The integration is retained and this entry describes the processing if it is switched back on.
Luxembourg (EU)
Data-processing and privacy termsSentry (Functional Software, Inc.)
Application error diagnostics with filtering of message content, request data and private URL details. Optional browser performance telemetry requires analytics consent; server performance sampling and session replay are disabled in this version. Production configuration was observed on 31 October 2026; this does not establish successful event receipt.
Provider established in the United States; the selected processing and storage region, applicable transfer safeguards and contractual evidence remain to be verified. Provider DPA link below.
Data-processing and privacy termsGoogle Analytics 4 (Google Ireland Ltd.)
Anonymized website analytics with Consent Mode v2. Client-side tracking tag activates only on explicit opt-in. GA4 Data API also used server-side by the admin dashboard for aggregated reporting.
EU data processing, sub-transfers to the United States under SCCs
Data-processing and privacy termsCloudflare Web Analytics (Cloudflare, Inc.)
Real-time website performance and traffic analytics (RUM — Real User Monitoring). Cookieless and privacy-friendly: no persistent cookies, no cross-site tracking, no fingerprinting. Collects aggregated page-view and Core Web Vitals metrics.
United States (EU Standard Contractual Clauses in place)
Data-processing and privacy termsUpstash (managed Redis)
Separate managed rate-limit counters. Primary application state uses the self-hosted Redis path when configured.
Primary application state is self-hosted; the separate Upstash rate-limit path remains active. We do not assert an EU processing region for the managed service. See Section 6.
Data-processing and privacy termsCloudflare, Inc. (R2 Object Storage)
Object storage for product-delivery assets and off-site backups
European Union (EU-jurisdiction bucket); Cloudflare is a US-headquartered company — transfers covered by EU Standard Contractual Clauses
Data-processing and privacy termsTwenty CRM (self-hosted)
Customer-relationship records for enquiries, leads and assessment submissions. Self-hosted on our own OVHcloud infrastructure in France — the software vendor has no access.
France (EU) — our own infrastructure
Data-processing and privacy termsSlack (Salesforce)
Internal operational alerts to the founder. Visitor page alerts carry page, referrer, user agent, truncated IP address, country, device and browser. Enquiry, assessment and booking alerts additionally carry identity and qualification data: your name, e-mail address, company, the lead score and the signals behind it, the suggested next action, and — where they apply — your assessment result or your booking details. The free text of your enquiry is deliberately NOT forwarded to this channel; it stays in the CRM and in the operator's mailbox.
United States (SCCs / DPF)
Data-processing and privacy termsTelegram
Internal operational alerts to the founder's own device. Receives the same identity and qualification data as Slack — name, e-mail address, company, source, lead score and signals — plus, for a small number of system-generated notices, a short summary line. The free text of your enquiry is deliberately NOT forwarded to this channel.
Outside the EEA — see Section 6
Data-processing and privacy termsCloudflare, Inc. (CDN & WAF)
Serves and protects every request to this site. Necessarily processes connection metadata including your IP address. This is infrastructure, not analytics.
Global edge network (SCCs / DPF)
Data-processing and privacy termsn8n (self-hosted)
Workflow automation running on our own infrastructure. Where its intake and lead webhooks are switched on, it receives the e-mail address and source of a gated-resource request, and the full contents of a strategic intake form. Those two webhooks are NOT enabled in the environment this policy is published from; the administrative connection that reads workflow run history — which carries no personal data — is.
France (EU) — our own infrastructure at n8n.hyperion-consulting.io. The software vendor has no access.
SerpAPI
Search-engine result retrieval for outbound business research and competitor monitoring. Queries name organisations, and can name individuals at organisations we research for outbound contact. It is NOT on any visitor or enquiry path: nothing you submit to this website is sent to SerpAPI.
United States
LinkedIn (Microsoft)
Not currently enabledTwo separate uses. (1) Company look-up during lead qualification: when you request a gated resource we take the first label of your e-mail address's company domain — "example" from "example.com" — and ask LinkedIn's organisation directory about it. Your e-mail address, your name and your message are never sent, and free e-mail providers are skipped entirely. (2) Publishing and measuring our own posts from our own LinkedIn page, which involves no visitor data at all. Use (1) is NOT enabled in the environment this policy is published from.
United States / Ireland
Data-processing and privacy termsAnthropic
Public-source article research, drafting and automated editorial review in a separate owner-authorized lane. Website enquiries, client documents and visitor conversations are excluded from this lane.
External Anthropic service. Processing location, retention and safeguards depend on the applicable provider terms; EU-only processing is not asserted for this public-editorial lane.
Data-processing and privacy termsWe do not sell, trade, or rent your personal information to any third party. We do not engage in cross-context behavioural advertising.
6. International Data Transfers
Your information, including Personal Data, may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ.
If we transfer data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:
- Standard contractual clauses approved by the European Commission
- Adequacy decisions
- Your explicit consent
Recipients that involve or may involve a transfer outside the EEA include Resend, Sentry, Google Analytics 4, Calendly, Cloudflare, Slack, Telegram, Upstash, SerpAPI (outbound research only) and LinkedIn (company look-up not currently enabled). Owner-authorized Helio, Search and Product Council interactions are sent to Mistral through https://api.eu.mistral.ai; that endpoint does not by itself establish the location of every control-plane, support or subprocessor activity. Anthropic: External Anthropic service. Processing location, retention and safeguards depend on the applicable provider terms; EU-only processing is not asserted for this public-editorial lane.
Where we rely on Standard Contractual Clauses we do so through the data-processing terms each provider publishes, linked in Section 5, pursuant to Art. 46(2)(c) GDPR and, where applicable, the UK International Data Transfer Agreement.
We will not claim a safeguard we cannot show you. The Mistral EU service chain, DPA acceptance, subprocessors, transfer position and Zero Data Retention status are not claimed verified; Telegram, LinkedIn and SerpAPI also require the recorded transfer review. Do not submit confidential, special-category, export-controlled or safety-critical operational data. Ask dpo@hyperion-consulting.io if this affects your decision to use an AI feature.
You have the right to obtain information about these safeguards by contacting us.
7. Your Rights
Under GDPR, you have the following rights regarding your personal data:
Right of access (Art. 15)
Obtain confirmation whether we process your data and access to it
Right to rectification (Art. 16)
Correct inaccurate or incomplete data
Right to erasure (Art. 17, 'right to be forgotten')
Request deletion of your data under certain circumstances
Right to restriction of processing (Art. 18)
Request limitation of processing under certain circumstances
Right to data portability (Art. 20)
Receive your data in a structured, commonly used, machine-readable format
Right to object (Art. 21)
Object to processing based on legitimate interests or for direct marketing
Right to withdraw consent (Art. 7.3)
Where processing is based on consent, you can withdraw it at any time without affecting prior lawfulness
Right not to be subject to automated decision-making (Art. 22)
Including profiling that produces legal or similarly significant effects
Right to compensation (Art. 82)
Claim material or non-material damages for infringements of GDPR
Right to lodge a complaint (Art. 77)
File a complaint directly with the French supervisory authority (CNIL) — details below
To exercise these rights, submit a request through our Data Subject Request form at /data-subject-request, or contact us at: dpo@hyperion-consulting.io. We may need to verify your identity before processing your request. Verification will be proportionate to the sensitivity of the data involved.
You also have the right to lodge a complaint with the supervisory authority:
Commission Nationale de l'Informatique et des Libertés (CNIL)
3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07
Tel: +33 (0)1 53 73 22 22
8. Data Security
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
- Encryption of data in transit and at rest
- Regular security assessments
- Access controls and authentication measures
- Ongoing data-protection training maintained by the founder, who is the only person with access
However, no method of transmission over the Internet or electronic storage is 100% secure.
10. Automated Decision-Making & Profiling
We do not use automated decision-making that produces legal effects or similarly significantly affects you.
Current contact and gated-resource qualification uses deterministic rules only. A stateless Mistral-assisted scorer exists but is not in the production-consumer allowlist and has no Mistral web-search tool. Any later activation would only prioritise and prepare a human response; no decision with legal or similarly significant effects is automated. Legal basis and DPIA screening remain open review items for that separate feature. Scores are kept for 90 days. You may object at any time at dpo@hyperion-consulting.io.
10.bis AI Systems & EU AI Act Transparency
This register describes deterministic functions and retained Mistral-backed surfaces. Owner-authorized Helio, Search and Product Council interactions use the EU-only Mistral adapter; other retained remote capabilities remain disabled. Each active interaction discloses that it is AI and where input is sent before submission.
Hyperion AI Assistant (site chatbot)
Answers questions about our services and content using retrieval-augmented generation
Model: Mistral models (provider: Mistral AI — see Section 5 for where that processing takes place)
Disclosure: The interface clearly indicates you are interacting with an AI system, not a human.
Your rights: You may at any time request to speak with a human via contact@hyperion-consulting.io. Outputs are not used for automated decision-making.
Helio Decision Navigator
Routes a product or system decision you describe to the smallest engagement that fits, or to an honest no-fit result, and drafts a cited brief
Model: Mistral models (provider: Mistral AI — see Section 5 for where that processing takes place)
Disclosure: Identified as an AI assistant before you can type anything. It recommends; it does not decide, price or contract. Giving contact details and booking a call are a separate, consented step.
Your rights: You can use it without giving any contact details. Internal alerts about its use carry bounded metadata only, never your free text.
Physical AI Product Council
Uses three separately prompted Mistral roles to challenge and explain a deterministic Physical AI Product Flight Simulator scenario and its evidence gaps
Model: Active pinned mistral-small-2603 and mistral-medium-3-5, and mistral-large-4-0 (Mistral Large 4, a public-preview model that Mistral may update), through the EU-only stateless adapter. Deterministic code owns calculations and the named human owns the decision.
Disclosure: Before interaction, the interface states that this is a Mistral-only multi-model council, that the same model family can share failure modes, that submitted scenario data is sent to Mistral, and that outputs can be wrong and are not safety certification, legal advice or an autonomous release decision.
Your rights: No contact details are required. Sensitive, confidential and safety-critical operational data is rejected. The server does not retain council conversation content; contact dpo@hyperion-consulting.io for privacy rights.
AI site search
Answers a question typed into the site search box from this site's published content, and lists the pages the answer came from
Model: Mistral small models (provider: Mistral AI — see Section 5)
Disclosure: The answer is labelled as AI-generated and shows its sources. Your query is sent to the provider to produce it, and answers are cached so the same question is not sent twice.
Your rights: Ordinary keyword search works without it. No output is used to make any decision about you.
AI Readiness Assessment
Generates a personalised AI maturity score and recommendations from your quiz answers
Model: Deterministic scoring logic combined with optional Mistral-generated recommendations (provider: Mistral AI — see Section 5)
Disclosure: Results are for informational purposes only, do not constitute professional advice, and do not produce legal or similarly significant effects.
Your rights: You may request deletion of your results and associated personal data under Article 17 GDPR.
EU AI Act risk classifier
Suggests an indicative risk tier, and the articles that would apply, for a system you describe
Model: Mistral models (provider: Mistral AI — see Section 5 for where that processing takes place)
Disclosure: Labelled as indicative and not legal advice. The description you type is sent to the provider to produce the classification.
Your rights: A human decides what to do with the result. You may request deletion of a register entry you created under Article 17 GDPR.
Use-case generator
Drafts candidate AI use cases from a business context you describe
Model: Mistral models (provider: Mistral AI — see Section 5 for where that processing takes place)
Disclosure: The output is a draft for you to choose from, not a finding about you. The context you type is sent to the provider and is not stored beyond the session.
Your rights: Using the tool is entirely optional and requires no contact details.
Marketplace AI agents
Configurable AI agents that registered Marketplace users converse with to produce work for their own projects
Model: Mistral models (provider: Mistral AI — see Section 5 for where that processing takes place)
Disclosure: Every agent is labelled as an AI agent. Your messages, the agent's replies, and any project context you attach are sent to the provider to produce each reply.
Your rights: Conversation memory is held for 30 days from your last activity. You can delete your account and its data from the Marketplace account area, or by writing to dpo@hyperion-consulting.io.
Lead qualification and scoring
Scores an enquiry or a gated-resource request so that a human can prioritise a reply. This is profiling — Section 10 describes it in full.
Model: The current path uses deterministic rules only. An optional stateless Mistral scorer is not in the production-consumer allowlist and has no built-in web search; the LinkedIn company look-up is also inactive (see Section 5).
Disclosure: Disclosed at the point of collection. No decision producing legal or similarly significant effects is automated: a person decides whether and how we reply.
Your rights: Legal basis is our legitimate interest in prioritising enquiries (Art. 6(1)(f)). Scores are kept for 90 days. You may object at any time at dpo@hyperion-consulting.io.
Outbound prospect research and scoring
Researches and tiers organisations we may approach, from publicly available professional information
Model: Mistral models, plus public search results retrieved through SerpAPI and publicly available LinkedIn information (see Section 5)
Disclosure: Where the information was not obtained from you, Article 14 GDPR applies and we give that notice on first contact.
Your rights: An objection is honoured immediately and the record suppressed. Write to dpo@hyperion-consulting.io.
Proposal drafting
Drafts a proposal outline from an enquiry so that a human has something to work from
Model: Mistral models (provider: Mistral AI — see Section 5 for where that processing takes place)
Disclosure: Nothing drafted this way is sent to you without human review.
Your rights: The draft is kept with the enquiry record. You may request access or deletion under Articles 15 and 17 GDPR.
AI-assisted content generation
Blog articles, research digests, and tool guides may be drafted with AI assistance and pass automated verification against their cited sources before publication
Model: Anthropic for the owner-authorized public-source editorial lane, with governed Mistral backup. Visitor and client-data processing remains restricted to Mistral through the EU endpoint.
Disclosure: Our automated public-source article workflow uses AI drafting, source and claim checks, and a separate automated editorial review. From 9 November 2026, each article produced by this workflow requires the founder's explicit approval before publication. Some articles published earlier used automated publication checks without individual human approval. Each article identifies its recorded review and AI assistance. The automated review is not a human or legal review.
Your rights: You may report inaccurate AI-generated content to contact@hyperion-consulting.io.
Attachment text extraction (contact and assessment forms)
A retained, currently disabled capability would read a brief or deck you choose to attach and return a short summary
Model: No remote model is active for this feature. The planned Mistral OCR and summarisation path is not in the production-consumer allowlist.
Disclosure: The attachment path is currently disabled, so no file is sent to Mistral. If later enabled, provider transfer and retention terms will be disclosed before file selection.
Your rights: Attaching a file is optional and the form works without it. You can edit or remove the extracted summary before sending, and request deletion of your enquiry under Article 17 GDPR.
AI Lab public demonstrations
Provides deterministic and browser-local demonstrations today; retained remote vision, OCR, prompt-evaluation and speech capabilities remain disabled
Model: Deterministic and browser-local code only at present. Remote Mistral vision, OCR and speech are not in the production-consumer allowlist.
Disclosure: Current local demonstrations do not send their inputs to Mistral. Any later remote demonstration will disclose the transfer before submission and remain illustrative only.
Your rights: Every demonstration is optional and starts only when you run it. No output is used to make any decision about you.
Helio industrial demonstrations (plant audit, defect inspection, maintenance logs)
Retained, currently disabled remote demonstrations would show how a vision or tabular model reads an industrial scene, a part photograph or a maintenance log
Model: No remote model is active for these demonstrations; Mistral vision is not in the production-consumer allowlist.
Disclosure: These remote demonstrations are disabled, so photographs and files are not sent to Mistral. If later enabled, provider transfer will be disclosed before submission.
Your rights: Every demonstration is optional and starts only when you run it. No output is used to make any decision about you.
Homepage campaign personalisation
Rewrites a page headline to match the marketing campaign you arrived from
Model: Mistral models (provider: Mistral AI — see Section 5 for where that processing takes place)
Disclosure: It uses only the campaign labels in the link you followed and the audience of the page — no personal data is sent. It is BUILT BUT NOT CURRENTLY IN USE: no page on this site mounts it today. It is listed so that this register is complete rather than merely current.
Your rights: Nothing about you is sent to the provider, and no output is used to make any decision about you.
We do not engage in any of the AI practices prohibited under Article 5 of the AI Act (social scoring, emotion recognition in workplace, biometric categorization, subliminal manipulation, exploitation of vulnerabilities, untargeted facial scraping, real-time remote biometric identification).
No final AI Act role or risk-classification conclusion is claimed here. The active public Mistral features are presented as advisory decision support with pre-interaction disclosure and human authority; formal classification and legal review remain open assurance work.
The founder maintains an AI-literacy programme through direct engineering, product, governance and review work. Whether the programme is sufficient for each activated use is recorded and reviewed rather than assumed.
This list and the system-by-system register on our AI Transparency page describe the same systems, in the same order. If they ever disagree, treat the disagreement itself as a defect and tell us at dpo@hyperion-consulting.io.
10.ter Data Protection Impact Assessment
A documented DPIA screening for the Mistral-backed public features is not yet claimed complete. The owner authorized the allowlisted public interactions while the processing purposes, data categories, scale, vulnerable-person impact, risk indicators and escalation decision remain open assurance work, with legal review recommended where required. Deterministic tools do not use remote AI.
11. Children's Privacy
Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18.
In accordance with Article 8 of the GDPR and Article 45 of the French Data Protection Act (Loi Informatique et Libertés), the age of digital consent in France is set at 15. For users under 15 residing in France, the consent of a parent or guardian is required for any information society service directly offered to the child.
12. Links to Other Sites
Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.
13. Changes to This Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any material changes by:
- Posting the new Privacy Policy on this page
- Updating the "Last updated" date
- Sending you an email notification (for significant changes)
Changes to this notice do not replace your choices or rights. Where fresh consent is required, it will be requested separately.
14. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:
126 Avenue du General Leclerc
92100 Boulogne-Billancourt, France
Response time: We will respond to your requests within one month of receipt, as required by GDPR.
This Privacy Policy is governed by French law and complies with the General Data Protection Regulation (EU) 2016/679.