WHAT WE COLLECT, AND WHY.

Who is responsible

We Call Shotgun (formerly Spicy Advisory — same company, renamed in August 2026) is the data controller for this site. We are based in Paris, Île-de-France, France. Write to [email protected] for anything in this notice, including access and deletion requests. We have not appointed a Data Protection Officer; the founders handle these requests directly.

What we collect

• —What you send us. Your name, email address, company, phone number if you provide one, and whatever you write in a contact form, a booking, or an email. Contact forms on this site are delivered by FormSubmit and arrive in our inbox.
• —Bookings. Calls are scheduled through Cal.com, which records the name, email address and timing you enter, and adds the event to our calendar.
• —Live chat. The chat widget is operated by Tidio. If you open it, Tidio stores the conversation and a session identifier.
• —Diagnostic tools. The AI Adoption Scorecard and the AI Act checker run in your browser. Answers are only stored if you choose to send us your results.
• —Reviews. If you submit a client review, we store the name, role, company and text you provide, in Supabase, so it can be published on this site.
• —Analytics. Google Analytics 4 and Ahrefs Analytics record aggregate page views, referrers, approximate location and device type. We do not use them to build advertising profiles.
• —Server logs. Our host, Cloudflare, keeps standard request logs including IP addresses, for security and abuse prevention.

Why we are allowed to hold it

• —To answer you and run an engagement — performance of a contract, or steps taken at your request before one (GDPR Article 6(1)(b)).
• —To keep the site working and secure, and to understand which pages are useful — our legitimate interests (Article 6(1)(f)). You can object at any time.
• —Non-essential analytics and chat cookies — your consent (Article 6(1)(a)), which you can withdraw by clearing cookies or blocking them in your browser.
• —Invoices and accounting records — a legal obligation (Article 6(1)(c)).

Who else sees it

We do not sell personal data and we do not share it for anyone else’s marketing. The processors that handle it on our behalf are Cloudflare (hosting and CDN), Google (Analytics 4 and Workspace email), Cal.com (scheduling), Tidio (live chat), FormSubmit (contact form delivery), Supabase (reviews and our own client records) and Ahrefs (analytics). Each is bound by a data processing agreement.

Some of these providers process data in the United States. Those transfers rely on the European Commission’s Standard Contractual Clauses, the EU-US Data Privacy Framework, or the UK addendum where the UK GDPR applies.

How long we keep it

• —Enquiries that do not become engagements: up to 24 months, then deleted.
• —Client records and engagement material: for the duration of the engagement and 5 years after it ends.
• —Invoices and accounting records: 10 years, as French commercial law requires.
• —Analytics data: 14 months in Google Analytics 4.
• —Published reviews: until you ask us to remove them.

Cookies

This site sets no advertising cookies. Google Analytics 4 sets measurement cookies, Tidio sets a chat session cookie if you open the widget, and Cloudflare may set a security cookie. Blocking all cookies in your browser leaves every page fully readable; only the chat widget stops working.

Your rights

You can ask for a copy of the data we hold about you, have it corrected or deleted, ask us to restrict or stop processing it, and receive it in a portable format. Write to [email protected] and we will answer within one month. If you are not satisfied, you can complain to the CNIL in France (cnil.fr) or to the Information Commissioner’s Office in the United Kingdom (ico.org.uk).

Changes to this notice

We update this page when what we collect changes, and the date at the top of the page moves with it. The current version is dated 2026-08-23. Material changes affecting existing clients are also sent by email.