What Pool does with your data
Last updated: 12 November 2026. This is a translation of the French version, which prevails in case of discrepancy.
Who processes your data
Pool is operated by Stema Partners, a French simplified joint-stock company (société par actions simplifiée), 128 rue La Boétie, 75008 Paris, France, registered in the Trade and Companies Register under RCS Paris 929 663 508. Stema Partners is the data controller. No data protection officer has been appointed. Contact: t.denizot@stemapartners.com.
Your assistant (Claude, ChatGPT, Le Chat or another) is a service you chose. What you share with it is governed by its own rules: Pool only receives what it sends when it calls a tool.
Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account and signing you in with an email code | Performance of the service you request |
| Publishing a consultant's profile and suggesting it to clients whose need matches it | Performance of the service |
| Answering a search, revealing contact details for a credit, notifying the consultant | Performance of the service |
| Recording a client's confirmation of a project | Performance of the service |
| Sharing the name of a confirmed project's client with those who unlock the consultant's contact details | Consent of the consultant and of that client, which either can withdraw |
| Sending, at a consultant's request, an invitation to confirm a project to a person at their client | Legitimate interest: allowing the client to confirm the project. A single message per project and per person, who can refuse any further message |
| Limiting searches per organisation and preventing the directory from being extracted | Legitimate interest: protecting registered consultants |
| Capping the invitations an account has sent and those a person receives | Legitimate interest: preventing the service from being used for mass mailing |
| Measuring search quality (text of needs for 90 days, profiles suggested, unlocks) | Legitimate interest: improving the service |
| Recording the scan of a consultant's AI practices | Consent, given on their computer before each sending |
| Measuring visits to the website's public pages with Google Analytics | Consent: you accept or refuse it in the banner shown on your first visit, and can change your mind at any time |
Consultants' data
- Visible to clients
- First name, title, bio, city, way of working, rate range, availability, projects described by client sector and size, skills, declared AI practices and the automatic scan if there is one.
- Private
- Last name, email, phone, LinkedIn link, public links, SIREN number, name and email domain of each project's client. All this data is encrypted in the database.
- Shared on unlock
- Full name, email, phone, LinkedIn link and public links, only to the client who spends a credit. Plus the names of the clients of your confirmed projects, only in the case described below. The consultant is notified by email of the domain of the organisation concerned. The client can view them again as long as the profile is visible.
- Never shared
- Your SIREN number, and the names of your projects' clients outside the case described in the next line.
- Data about your clients
- The name and email domain of a client, which you enter for a project, are only used to check the person who will confirm that project. They are neither shown nor searchable. One exception, for the name: if you agree for a project and the client agrees when confirming it, that name is shared, with your contact details, with clients who spend a credit to contact you. Either of you can withdraw your agreement. If you ask for an invitation to be sent, your contact's address is used to write to them once, then is not kept.
Automatic scan of AI practices
Only if the consultant installs the Pool extension for Claude Code, runs it, and agrees to send the result.
- What the extension reads
- On the consultant's computer, file names and configuration keys, to count them. If they also accept usage measurement, it goes through their session logs for the last 30 days to count calls to skills and connectors, without extracting anything else. Their assistant then reads the description of their most used skills to suggest a sentence about each.
- What Pool receives
- Numbers, the names of tools recognised from a fixed list, and at most five sentences the consultant has approved. Never a file, skill or server name, nor an excerpt of a conversation.
- What these are worth
- They come from a program the consultant runs on their own computer. They are shown to clients as an unverified scan, not as proof.
Clients' data
- Account
- Email address, verified by a code, and the language in which you receive emails. Its domain is used to pool usage limits per organisation.
- Searches
- The text of the need is kept encrypted for 90 days, then erased. Structured criteria (skills, filters), the profiles suggested and their rank are kept without the text.
- Credits and contacts
- Credits received and spent, and the list of consultants whose contact details you unlocked, so that you can find them again.
- What the consultant learns
- The domain of your email address when you unlock their details or confirm a collaboration. Never the text of your need, nor your address.
- If you confirm a project
- Your name does not appear anywhere. Your organisation is only named if you agree: its name, as entered by the consultant and as you saw it when agreeing, is then shared, once the confirmation is validated, with clients who spend a credit to contact this consultant. You can withdraw this agreement whenever you want, in your client dashboard. The account that gave or withdrew the agreement, and the date, are kept with the confirmation.
The Pool connector does not read your assistant's history, memory or files.
If you received an invitation to confirm a project
A consultant registered on Pool gave your work address to invite you to confirm a project carried out for your organisation. Your address was used to send you this message, once. Pool does not keep it: it only keeps a fingerprint, which cannot be turned back into your address but avoids writing to you twice for the same project, and lets your client dashboard show you this project if you sign in with that address. The email provider, Resend, keeps its own record of this message, under its own rules.
The link at the bottom of the message lets you refuse any further invitation, whichever consultant it comes from. If you confirm the project, you create an account: the “Clients' data” section then applies.
Browsing data
Google Analytics measures visits to the website's public pages (pages viewed, where visitors come from, type of device and browser). It sets cookies that recognise your browser from one visit to the next, and only loads if you accept (see Cookies).
It is not present on the sign-in page, in your personal area (profile, client dashboard), or on any page whose address contains a code. It receives nothing of what you do from your assistant.
How profiles are ranked
A profile is suggested when its projects match the need described: same words, same meaning, required skills proven in projects. Where matches are close, priority goes to profiles with projects confirmed by clients, a verified company, up-to-date availability, at least three projects described, a scan showing regular use of AI, and a phone number and LinkedIn profile provided. The last of the three places may go to a relevant profile that has been shown little so far.
No profile is promoted in exchange for payment. No decision producing legal effects is made entirely automatically: the client alone chooses whom to contact.
Recipients and hosting
- Hosting
- OVHcloud, server located in France (Gravelines).
- Sending emails
- Resend, a company established in the United States: your email address and the content of messages (sign-in code, notifications, invitations to confirm a project). This transfer outside the European Union is covered by standard contractual clauses.
- Search by meaning
- Mistral AI (European Union) receives the public text of profiles and the text of needs to turn them into vectors. No contact details and no last names are sent to it.
- SIREN check
- The SIREN number entered is sent to the French government's public “Recherche d'entreprises” API.
- Audience measurement
- Google Ireland Ltd., for Google Analytics, loaded only if you accept. Browsing data may be transferred to the United States; this transfer is covered by the European Commission's standard contractual clauses and the EU-US Data Privacy Framework (DPF).
No data is sold.
How long data is kept
- Profile and account
- Until their owner deletes them. Deletion erases the profile, projects, credits and associated contacts. If the account had invitations sent, a fingerprint of its address remains in the log of those sendings: it cannot be turned back into the address, and ensures that the invitation cap cannot be bypassed by creating a new account.
- Text of needs
- 90 days.
- Profiles sent in reply
- 14 days, the time a result remains usable. After that, only the rank and scores are kept.
- Technical log
- 180 days, without the content of requests.
- Sign-in code
- 10 minutes.
- Google Analytics cookies
- At most 13 months on your device.
- Your cookie choice
- 6 months, after which you are asked again.
- Language choice
- 12 months on your device, if you switched language.
- Invitation to confirm a project
- The recipient's address is not kept. Its fingerprint is kept as long as the project exists, and for 30 days in the log of sendings; that of a person who refused invitations, with no time limit, so that their refusal continues to be respected. The fingerprint of the address of the account that had invitations sent is kept with no time limit in this log.
Security
Exchanges are encrypted (HTTPS), consultants' private data and the text of needs are encrypted in the database, and there is no password to steal: sign-in uses a one-time code.
Your rights
You can view and correct your profile from your assistant, and delete your account with all its data by asking it to delete your Pool account.
You have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw any consent you have given, and the right to set instructions on what happens to your data after your death. To exercise them: t.denizot@stemapartners.com. You can also lodge a complaint with the CNIL (cnil.fr), the French data protection authority.
The service is intended for professionals. It is not intended for minors.