Privacy policy
FACIL’iti Talents extension

In force since September 21, 2026

1. Purpose and scope

This policy describes the data processed by the FACIL’iti Talents browser extension, and by it alone.

It does not cover:

• the FACIL’iti Talents mobile app (iOS and Android), which is governed by a separate policy, as it works differently;
• the FACIL’iti Smart and FACIL’iti Essentiel solutions, built into our customers’ websites;
• the facil-iti.com website and the websites you visit with the extension enabled, which remain governed by their own policies.

The extension works under a licence purchased by an organisation (employer, institution, public body). It is not intended for individual consumer use.

Our commitment to readability. This document is written for people who may find reading difficult, which is precisely who FACIL’iti Talents is for. It uses short sentences, no unnecessary jargon, and each section answers one simple question.

2. Who is responsible for what

Two organisations are involved: your employer or institution, which purchased the licences, and FACIL’iti, which publishes the extension. Their roles differ from one feature to another.

Publisher of the extension

FACIL’iti — French simplified joint-stock company (SAS) with a share capital of €21,500 · 16 rue Soyouz, 87068 Limoges CEDEX, France · Limoges Trade and Companies Register (RCS) no. 834 795 023 · VAT FR 87834795023

Data Protection Officer (DPO)

FACIL’iti has appointed a DPO registered with the CNIL, the French data protection authority. Contact: [email protected] · or by post to the address above, for the attention of the DPO.

Security and compliance questions (IT departments, CISO)

[email protected]

If you are not sure who to contact, write to FACIL’iti’s DPO: we will pass your request on to your organisation if it concerns them.

3. The principle: everything stays on your device, except for three features

The extension changes how pages are displayed directly in your browser. It does not send back the pages you view, what you type, or the addresses of the websites you visit.

Only three features send data out of your device, and you always know when:

Visual adaptations cover fonts, colours, contrast, reading mode, letter colouring and the visual focus.

Sections 4 to 8 describe each of these cases in detail.

4. Activating your licence

To use the extension, you enter your email address once — together with the activation code, if your organisation gave you one — then click the confirmation link you receive by email.

What we do with this address

1. We check that you are entitled to a licence: either your address belongs to one of the email domains declared by your organisation, or you enter the activation code it gave you. The code is used when your address does not belong to one of those domains.
2. We check that a licence is still available under the corresponding contract.
3. We send you the confirmation email.
4. You click the link you received: the licence is activated.
5. Our licence service records your address, with the associated licence, for the duration of the contract.

Regular check. The extension checks with the licence service that your licence is still valid. This check updates the date you last used the extension.

What the licence service records

Legal basis. Assigning licences is a processing activity of your organisation: FACIL’iti carries it out on its behalf, on the legal basis your organisation has chosen (usually its legitimate interest in providing its staff with accessibility tools). Checking the number of licences in use, on the other hand, is FACIL’iti’s own processing activity, based on its legitimate interest in enforcing the contract purchased (Art. 6(1)(f) of the GDPR). You may object to it (section 14); the extension can then no longer be activated.

What your organisation sees. Your organisation monitors the number of licences used within its scope. In its administration area, it also has the list of addresses that have activated a licence, shown partially masked. It has access neither to your settings nor to your Assisted Setup requests.

What is never linked to your licence. No page viewed, no display setting, no request made to Assisted Setup. The licence service records the date you last used the extension, never what you did with it.

5. Your display preferences

Your settings (font, size, spacing, contrast, colour filters, night mode, letter colouring, visual focus, reading mode), as well as your interface language, the status of your licence and your Assisted Setup authorisation, are stored in the extension’s local storage, on your device.

• They are not sent to FACIL’iti.
• They are not visible to your organisation.
• They are deleted when you uninstall the extension.

These settings say a lot about you. Choosing a dyslexia-friendly font or a colour-blindness filter may reveal a disability. That is precisely why they never leave your device, and why nobody, at your employer or at FACIL’iti, has access to them.

No account-based sync. Your settings stay in this browser, on this device. They go through no online account and are not copied to your other devices. You do not need an account to use the extension.

Legal basis for storage on your device. This storage is strictly necessary for the extension to work, so it does not require your consent (Article 82 of the French Data Protection Act, loi Informatique et Libertés). No advertising or audience measurement tracker is set.

6. Assisted Setup (artificial intelligence)

Assisted Setup lets you describe your need in your own words, such as “the lines are too close together”, and turns on the matching settings. You are interacting with an artificial intelligence system. It is not a person answering you.

What is sent

Only the text of your request: what you type, or the text produced by your dictation (see section 7).

The following are never sent: the address of the website you are viewing, the content of the page, anything else you type, your email address, your licence code. The call to the AI service carries no account identifier (neither email address nor licence code) that would make it possible to link a request to a person.

The route

1. Your text is sent, encrypted (HTTPS/TLS), to FACIL’iti’s web service hosted in the European Union.
2. This service queries a large language model on Amazon Bedrock, Frankfurt region (eu-central-1).
3. The model returns the list of settings to turn on. No free text is sent back to you.
4. The settings are applied. You can change or undo them, one by one.

What is not kept

• Your text is not stored after processing: each request is analysed on its own, with no history.
• It is not logged: the content of your requests does not appear in any FACIL’iti application log.
• It is never used to train the model. Amazon Web Services is contractually committed not to use content submitted to Bedrock to train its models, nor to share it with third-party model providers.

Legal basis: your consent (Art. 6(1)(a) GDPR). Assisted Setup never starts on its own. You turn it on, after reading what is sent, and you can withdraw your authorisation at any time in the extension’s settings. Withdrawal takes effect immediately; settings already applied remain in place.

Do not mention your disability or your health. Describe what bothers you on screen: that is enough, and it works better. If you spontaneously mention a condition or a disability, that information is processed like the rest of your request, on the basis of your explicit consent (Art. 9(2)(a) GDPR), without being kept or reused.

No automated decision about you. The system produces no profile, no assessment and no decision that has a legal effect on you or similarly significantly affects you within the meaning of Article 22 GDPR. It suggests display settings, which you remain free to change.

AI transparency. This system can make mistakes: check that the settings applied suit you (Article 50 of the EU Artificial Intelligence Act).

7. Dictation

Instead of typing your request, you can dictate it. This flow differs from the others and is worth reading.

What happens when you dictate

1. Your browser asks for permission to use the microphone. Without this permission, dictation does not work; the keyboard remains available.
2. Your browser captures your voice and sends it to its own speech recognition service, run by its publisher.
3. The recognised text comes back into the extension’s input field. You can see it and correct it.
4. This text then follows exactly the route described in section 6.

What FACIL’iti receives: the text, never your voice. The audio recording goes through neither our servers nor our AI service. We never have access to it and we keep nothing of it.

What this means for you. This processing is the responsibility of your browser’s publisher, which acts on its own behalf and under its own rules. FACIL’iti has no contract with it for this processing, and therefore cannot guarantee either where your voice is processed or how long it is kept. If this is a problem for you, or if your organisation’s policy forbids it, type your request on the keyboard: the result is the same.

How to remove microphone access. At any time, in your browser’s settings: Privacy and security › Site settings › Microphone. The extension keeps working normally.

Who processes your voice depends on your browser

Your browser chooses this service, not the extension.

8. Reading mode translation

In reading mode, you can have the text of the page translated. This translation runs entirely on your device.

The extension relies on Chrome’s built-in translator, which runs locally, in the browser.

• The content of the page never leaves your device. Neither FACIL’iti, nor Google, nor any other third party receives it.
• FACIL’iti processes no personal data on this occasion.
• Translation works even offline, once the language model is installed.

A point of transparency. The first time a language pair is used, your browser downloads the corresponding model from Google’s servers. This download is handled by Chrome, not by the extension: it tells Google which language is requested, never the text to be translated.

AI transparency. Translation relies on an artificial intelligence model. Like any machine translation, it may contain errors or mistranslations: for a binding document, refer to the original version.

Availability. This feature depends on your browser and on the language pair chosen. When it is not available, the extension does not offer translation.

9. What the extension never collects

The extension needs access to the content of the pages you display: that is how it changes fonts, colours and spacing. This access stays local to the browser. Nothing leaves it.

In practice, FACIL’iti never receives:

The addresses of the websites you visit

No URL is sent, neither in full nor as a statistic

The content of pages

Text, images, documents displayed: nothing is sent

What you type

No keystroke capture, in any field

Your passwords

Password fields are neither read nor modified; no interaction with password managers

The content of your forms

Including in your business applications, your email and your intranet

Your browsing history

Neither read, nor copied, nor analysed

Screenshots

The extension takes none

Your location

No geolocation

There is no advertising tracker, no audience measurement, no resale of data. The extension contains no third-party analytics SDK.

The only thing we know about your use is the date you last used the extension, linked to your licence (section 4). Not how often, not for how long, not which features, not which websites.

What our servers necessarily see. Any connection to a server gives it your device’s IP address and browser type. Our licence and Assisted Setup services record them in technical logs, to keep the services secure (detecting abuse and attacks) and to diagnose failures. These logs are kept for 3 months, then deleted. They never contain the text of your requests, nor the addresses of the pages you view. Legal basis: FACIL’iti’s legitimate interest in securing its services (Art. 6(1)(f) GDPR).

10. Recipients, processors and transfers outside the EU

About the only possible transfer outside the EU. It concerns dictation, and dictation alone. It results from the speech recognition service built into your browser, not from a choice made by FACIL’iti: we have neither control over nor visibility of this processing, which is governed by your browser publisher’s terms. Google and Microsoft do not specify where your voice is processed; they are American companies, so a transfer outside the European Union cannot be ruled out. The applicable legal framework is the one this publisher implements for this service (EU–US Data Privacy Framework adequacy decision and/or standard contractual clauses). If this transfer is not acceptable to your organisation, dictation can be turned off: see section 13. Typing on the keyboard gives the same result.

No resale, no commercial sharing. FACIL’iti does not transfer, rent or sell any data to third parties. Our processors, Amazon Web Services and Mailjet, are bound by a contract compliant with Article 28 GDPR. Google and Microsoft are not our processors: they are involved in dictation as publishers of your browser, under their own terms (section 7).

Authorities. We only disclose data to an administrative or judicial authority on a legal request, and strictly within its limits.

11. How long data is kept

At the end of the contract. When your organisation does not renew its licences, the licences are deactivated and the associated technical data is deleted once the periods above have elapsed. Since no browsing history or business content is stored, there is nothing else to purge.

If you uninstall the extension. Everything stored on your computer disappears: settings, language, licence status. On the licence service side, your licence is released.

12. Security and requested permissions

The measures

• All exchanges between the extension and our services are encrypted in transit (HTTPS/TLS).
• Technical licence data is encrypted at rest.
• Administrative access to the hosting environments follows the principle of least privilege, with strong authentication.
• Development, test and production environments are kept separate.
• The extension is distributed through the official stores, which sign it and verify its integrity.
• These measures are part of FACIL’iti’s information systems security policy (ISSP), available on request.

The permissions requested from the browser, and why

Limited use of data. In accordance with the Chrome Web Store User Data Policy, FACIL’iti undertakes to use the data collected by the extension only to provide and improve the features described here, not to sell it, not to use it for advertising, profiling or creditworthiness purposes, and not to transfer it to third parties outside the cases described in section 10.

Report a vulnerability. [email protected]

13. What your organisation can turn off

Not every organisation allows AI tools. The features concerned can be turned off for a whole customer, without affecting the rest of the extension.

Our recommendation on translation. It runs entirely on the device and sends no content: there is no privacy reason to turn it off. It primarily benefits employees whose first language is not French, for whom it is an accessibility aid just like an adapted font. Turning it off therefore has a real cost in terms of inclusion, with nothing gained in data protection.

To request deactivation: your FACIL’iti sales contact, or [email protected].

What your organisation cannot do. It can neither see your Assisted Setup requests, nor know your display settings, nor know which pages you view. This information exists nowhere but on your device.

14. Your rights, and how to exercise them

You have the rights provided for by the GDPR: access, rectification, erasure, restriction, portability, objection, and the right to set out instructions for what happens to your data after your death.

Immediate steps, without writing to us

For a formal request

Write to FACIL’iti’s DPO: [email protected], or by post to our head office, for the attention of the DPO. We reply within one month, which may be extended by two months for complex requests, in which case we will let you know.

How we find you. Your email address is your licence identifier: include it in your request and we will find what concerns you directly. We do not ask for further proof of identity, unless there is reasonable doubt about where the request comes from.

Some requests are for your organisation. For anything related to how licences are assigned within your organisation, contact its DPO or your usual contact: your organisation decides who receives a licence. If you write to us by mistake, we will tell you and point you in the right direction.

Complaints. If you are not satisfied with our reply, you can lodge a complaint with the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr (in French). If you live in another Member State, you can contact your own country’s supervisory authority.

15. Changes to this policy

We update this document whenever a version of the extension changes what is processed: a new feature that sends data, a change of processor, a new country of processing.

Where to find this document

It is available from the extension (Personal data and security menu) and from the extension’s page on the Chrome Web Store: FACIL’iti Talents.

Documents that complement this one, available on request from [email protected]: the architecture, security and compliance note; the information systems security policy (ISSP); the data processing agreement (DPA); the DPO’s appointment filed with the CNIL.

Version history

Each version remains available at its own address: it records what applied on that date.

1. September 21, 2026 version in force