Privacy policy
Last updated: 5 November 2026 · Version française
This English version is provided for convenience. The French version is the legally binding one.
Okkly lets researchers (designers, product teams) have their website tested by volunteers, with no screen, microphone or camera recording. This page explains what data is processed, why, for how long, and how to exercise your rights.
Who is responsible?
- You are testing a website (tester): the controller is the researcher who sent you the link. YXLO DESIGN acts on their behalf, as a processor.
- You have an account (researcher): YXLO DESIGN (SIREN 999 055 031) is the controller for your account data.
Contact for any question about your data: [e-mail de contact RGPD à compléter].
Testers: what we collect
- Your answers to questions and the outcome of tasks (success, duration, pages visited on the tested website or screens viewed on a mockup, number and position of clicks, scroll depth). A click position is recorded relative to the clicked element (its place in the page, never its text), to show the researcher a click map.
- Device type (mobile, tablet, desktop), browser, rounded screen size and language.
- A random participation code (for example K7P-2QX), which links your answers without identifying you.
Never: your name, your email, your IP address (it is never stored), a browser fingerprint, what you type into the tested website's forms, or any tracking cookie. The script installed on the tested website does nothing without a valid task link, and sends no data outside tasks.
Legal basis: your consent, given before you start. You can stop at any time. Purpose: helping the researcher improve their website.
Researchers: what we collect
- Your email (magic-link sign-in), your display name if you set one, the date you accepted the terms.
- Your websites, your tests, the analyses generated and share links.
Legal basis: performance of the contract (the terms of use). Sign-in links are sent by our email provider.
Artificial intelligence analysis
When the researcher requests it, answers are sent to Anthropic (United States) to write a summary. Before sending, detected emails and phone numbers are masked. Anthropic does not use this data to train its models. This transfer outside the European Union is governed by standard contractual clauses. The analysis is reviewed by the researcher, who remains responsible for its content.
Figma mockups
Some tasks take place on an interactive mockup the researcher created in Figma. It is displayed inside Okkly by Figma Inc. (United States), which then receives your browser's technical connection information (IP address, browser) and may set its own technical cookies, under its privacy policy. On our side, we only note the mockup screens displayed, the number and position of clicks and the time spent on the task. This transfer is mentioned on the test's welcome screen, before you give your consent.
Retention periods
| Data | Retention |
|---|---|
| Complete responses and analyses (including answers cited in an analysis) | 12 months after the test closes, then automatic deletion |
| Incomplete responses | 30 days |
| Inactive researcher account | Deleted after 24 months without sign-in |
| Share links | Until they expire (90 days max) or are revoked |
| Security logs | 6 months |
| Backups | Rolling 30 days |
Your rights
You have the right of access, rectification, erasure, restriction, objection and withdrawal of consent.
- Testers: with your participation code, view or delete your answers on the My data page. Without a code, write to us: we can't find your answers any other way, since we don't know who you are.
- Researchers: change your name or delete your account and all its data from the "My account" page.
If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr) or your local data protection authority.
Security
Data is hosted in the European Union and encrypted in transit and at rest. Each researcher can only access their own data (database isolation checked by automated tests). Share tokens and passwords are stored hashed.
Cookies
Okkly uses no advertising cookies or audience measurement tools. Only technical cookies are set: the signed-in researcher's session, your language preference, and access to a password-protected shared analysis (12 hours). The anti-bot check (Cloudflare Turnstile) uses no tracking cookie.