the-sandbox.ai

Privacy policy

Version dated 1 October 2026

Data controller

Franck Plazanet
Privacy-rights contact: privacy@nck.agency

The controller’s postal address and country of establishment are not disclosed at this stage. This policy is therefore provisional on those points.

Information collected

When you use the form or MCP connection, we receive your name, email address and message. Company and topic are optional. The submission channel, request identifiers, IP address and technical data needed for abuse prevention may also be processed by the relevant service providers.

Purposes and legal bases

Information is used to receive, understand and answer your enquiry, maintain the conversation and prevent abusive submissions. This processing is based on the legitimate interests of responding to enquiries and securing the website. Submitting the form does not subscribe you to marketing.

Required and optional fields

Name, email and message are required to send an enquiry. Company and topic are optional. The form cannot be submitted without the required information.

Recipients and service providers

Enquiries are accessible to the data controller. 3wMCP receives enquiries from the website form and MCP assistants, and Svix delivers them to the notification service managed by 3wMCP and hosted on Cloudflare. That service uses Cloudflare Email Service to send a copy to the controller’s Google Workspace mailbox. Cloudflare Turnstile protects the website form against abuse. OpenAI ChatGPT Sites publishes and hosts the website.

The booking link opens Cal.com in a new window. No Cal.com scheduler is embedded on this page; Cal.com processes your information only if you choose to follow that link.

International transfers

Some providers may process information outside the European Economic Area. ChatGPT Sites does not offer data residency at launch. Applicable safeguards are those described in each provider’s terms and data-processing arrangements.

Retention

3wMCP is configured to automatically delete enquiry content after 90 days. Correspondence copies in our mailbox are retained for no more than 12 months and periodically deleted, unless the law requires otherwise or an active conversation must temporarily be preserved. Mailbox deletion is separate from deletion of enquiries in 3wMCP. The 3wMCP notification service retains delivery identifiers and states to prevent duplicates, without retaining the answers. These delivery records are not automatically deleted. Historical delivery records from the original notification service are preserved to prevent old enquiries from being sent again. Providers apply their own retention periods to technical logs.

Cookies and analytics

This version uses no analytics, advertising, newsletter signup or marketing trackers. Turnstile may process technical information strictly necessary for abuse prevention. The Cal.com scheduler is not embedded.

Your rights

Depending on applicable law, you may request access, correction or deletion of your information, restrict processing, or object to processing based on legitimate interests. You may also lodge a complaint with the French data-protection authority, the CNIL. Requests are normally answered within one month.

Exercise your rights: privacy@nck.agency

Useful links

CNIL · ChatGPT Sites DPA · 3wMCP · Svix · Cloudflare