This translation is provided for information only. Only the French version is legally binding.

Legal document

Collector policy

Version 1.0 — in force since 28 October 2026

Archived version, replaced on 30 October 2026. See the version in force

Article 1 — Purpose and scope

This policy describes how the Collector works: the sources it consults, the pages of websites it reads, how a website can object to this reading, the Personal Data concerned and the rights of individuals. It applies to every website the Collector consults, whether or not it has a Card.

It supplements the personal data protection policy, which describes all the Processing carried out by the Service, and the general terms of use, which describe the nature of the Facts and the dispute procedure.

Article 2 — Definitions

In this document, the following capitalised terms have the meaning given below, in the singular and in the plural:

“Publisher”: the company AXO-LAB, single-shareholder simplified joint-stock company (SASU) with a share capital of 5 000 euros, registered with the Trade and Companies Register of Cusset under number 103 310 017, which publishes and operates the Site and the Service under a non-exclusive licence granted by the Rights Holders. The Publisher does not hold the intellectual property rights in the Service.
“Rights Holders”: Malcolm Chevillot, Lucas Firmin, Sacha Lamour and Clément Pandreau, the authors of the Service, who jointly hold the intellectual property rights in it in equal shares, under a co-ownership and operating agreement.
“Service”: the information service named “Recto”, available through the Site and the Extension, which presents, for each news website, a Card made up of Facts.
“Site”: the website available at www.recto-medias.fr and its subdomains.
“Card”: the record that the Service devotes to a news website, bringing together the Facts about it.
“Fact”: any fact shown on a Card, taken from a public register or from a publication by the publisher of the website concerned, together with its source and its date.
“Watcher”: any User invited by the Publisher to hold an account in order to contribute to the Service, in particular to the handling of reports.
“Personal Data”: any information relating to an identified or identifiable natural person, within the meaning of Article 4(1) of the GDPR.
“Processing”: any operation performed on Personal Data, such as collection, storage, consultation, disclosure or erasure, within the meaning of Article 4(2) of the GDPR.
“GDPR”: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
“Collector”: the computer program operated by the Publisher, identified by the name “RectoCollecteur”, which automatically consults public registers and pages of websites in order to establish the Facts on Cards.
“Evidence”: the record of what the Collector consulted: address consulted, date and time of the consultation, digital fingerprint of the content received and the relevant extract of that content.
“Alert”: the internal notice that a detection rule produces when a website shows specified characteristics, intended only for Watchers and the Publisher’s authorised staff.

Article 3 — Controller

The controller is AXO-LAB, a single-shareholder simplified joint-stock company (SASU) with a share capital of 5 000 euros, registered with the Trade and Companies Register of Cusset under number 103 310 017, whose registered office is at Le Point Commun, place Claude Wormser, 03000 Avermes, France. The publication director of the Service is Clément Pandreau, President of AXO-LAB. Any question about this policy, and any request to exercise rights, may be sent to contact@recto-medias.fr.

Article 4 — Facts, never opinions

4.1 What is published

A Card contains only Facts: facts taken from a public register or from what the website itself publishes, each with its source and date. The Service publishes no assessment, rating or ranking of a website or a person.

4.2 What is missing and what is transformed

When a Fact could not be established, the Card states why: the data was absent from the source on the date of consultation, the website refused reading, the page could not be reached, the security certificate was invalid or the source was unavailable. A reading that could not take place is never presented as the absence of the data.

When data has been formatted for display (conversion of a domain name or a date, extraction of a passage from a page), the Card says so, and the Evidence keeps the value as the source gave it.

4.3 Automatic detection

The Collector applies detection rules that may produce Alerts. An Alert is never published and never changes a Card: it is examined by people. Each Alert states the version of the rules that produced it and the list of its grounds, written in plain language. The rules are deterministic: applied to the same data, they produce the same Alert, so that each one can be replayed and checked.

No decision producing legal effects concerning a person, or similarly significantly affecting them, is based solely on automated processing, within the meaning of Article 22 of the GDPR.

Article 5 — What the Collector reads

5.1 Public registers and databases

The Collector consults the following sources:

Sources consulted by the Collector
Source	Producer	Data read
Open data on .fr domain names and RDAP service	Afnic	.fr domain names created each day and monthly snapshots, creation date, registrar, status of the domain name and holder when it is a legal person
RDAP services of the registries of other extensions	Registries designated by IANA and, for registries that do not hold them, registrars	registration and transfer dates, registrar, status of the domain name and holder when it is a legal person
List of recognised online press services (CPPAP)	French Ministry of Culture	registration of a service, number, expiry date, publisher and address of the service
API Recherche d’entreprises and Sirene API	French Interministerial Digital Directorate and Insee	name, SIREN number, legal form, activity, creation date, status and managers of the publisher, as published by the Sirene directory and the national business register
Domain Name System (DNS)	The domain’s name servers, queried by the Publisher’s own resolver, with no intermediary	IP addresses, name servers, mail servers, text records and DNSSEC signature of a domain name
Security certificate of the website	The website’s server, when an encrypted connection is opened, without reading any page	authority that issued the certificate, domain names it covers and validity dates
Wayback Machine	Internet Archive	date and title of the first archived page of a website

The sources whose data appears on Cards, and their licences, are listed in the legal notice.

5.2 Pages of websites

On a website, the Collector reads only:

the “robots.txt” file and any reservation of text and data mining rights, before any other page;
the home page;
the legal notice, publisher information and contact pages, up to 5 pages per visit.

It leaves at least 1 second between requests to the same website, does not return more than once every 7 days, even when a reading is requested through the Service, except for a new collection requested as part of a dispute, and reads no more than 2 megabytes per page.

A reading is started by the Publisher, or requested through the Service by a visitor for a website that does not have a Card yet. The request only concerns the address of the website; the data processed to limit the number of requests of each visitor are described in the personal data protection policy.

5.3 What the Collector never does

circumvent an access control measure: credentials, subscription, anti-bot test or blocking;
fill in a form, create an account or accept cookies;
run the scripts of pages;
read a page while ignoring a security certificate error;
read a page that a website forbids it through its “robots.txt” file.

Article 6 — Identifying the Collector

The Collector identifies itself as “RectoCollecteur” in the “User-Agent” header of each of its requests, followed by its version number, the address of the page that describes it and a contact address.

The exact value of this header, the IP addresses from which the Collector connects and its request rates are published on the Collector page, which is kept up to date. A request that claims to come from the Collector from another IP address does not come from the Publisher.

Article 7 — A website objecting to the reading of its pages

7.1 Through the “robots.txt” file

The Collector complies with the Robots Exclusion Protocol (RFC 9309). A website may forbid it all or some of its pages by naming “RectoCollecteur”, or all robots. When the file does not exist or the server refuses to provide it (a response code in the 4xx range), the Collector treats reading as permitted, as that protocol provides; when the server does not respond, returns a server error (5xx range) or asks it to slow down (code 429), it treats reading as refused and only tries again on its next visit.

7.2 Through the reservation of text and data mining rights

When a website reserves its rights under Article L122-5-3 of the French Intellectual Property Code, in particular through the TDMRep protocol, the Collector keeps from a page only the extract needed to establish a Fact and its digital fingerprint, and never a full copy. No page read by the Collector is used to train an artificial intelligence model.

7.3 Through a written request

The publisher of a website may also ask for the reading of its pages to stop by writing to contact@recto-medias.fr. The Publisher then asks it to prove control of the domain name, by publishing a single-use code in a DNS record or in a file placed on the website.

7.4 Effect on the Card

Reading of the pages stops, and the Facts taken from those pages are removed from the Card when it is next published. The Facts taken from public registers remain displayed, because they do not come from the website. The Card then states, without further comment: “Legal notice: reading refused by the website”, with the date on which this was recorded.

Article 8 — Personal Data concerned

8.1 Persons and data

The Collector processes the following Personal Data:

the surname, first name and position of publication directors, as websites publish them in their legal notice pursuant to Article 1-1 of the French Act on confidence in the digital economy (LCEN);
the surname, first name and capacity of the managers who are natural persons of the publishing companies and associations, as published by the Sirene directory and the national business register;
the name, which includes the person’s name, and the SIREN number of a sole trader who publishes a website, when the Sirene directory makes them public;
the contact email address published in a website’s legal notice, which the Service never publishes and which is used only to confirm the identity of the author of a request about that website.

8.2 Data never collected or published

the personal address, telephone number and email address of individuals, and any data relating to their private life; any such data read by mistake is deleted as soon as it is detected;
the identity of a natural person who holds a domain name, which registries do not make public;
the identity of a non-professional publisher who has chosen to give only the contact details of its host, as the law allows: the Collector does not seek it by cross-checking other sources;
the data that the Sirene directory or the national business register do not disclose at the request of the person concerned: the Collector does not seek it in other sources.

Article 9 — Purposes and legal bases

The Collector processes this data in order to:

establish the Facts on Cards, to inform the public of the identity of the publishers of news websites;
produce the Alerts examined by Watchers and the Publisher’s authorised staff;
keep the Evidence needed to handle disputes and to defend the Publisher’s rights.

This Processing is based on legitimate interests (Article 6(1)(f) of the GDPR): that of the public in knowing the identity of the persons who publish a news website, and that of the Publisher in establishing and justifying the Facts it publishes. The Publisher has balanced these interests against the rights of the persons concerned: the data is limited to surname, first name and position; it is already made public by registers or by notices that the law requires publishers to display; it relates only to the exercise of a publishing function; it is associated with no assessment. The measures set by the French data protection authority (CNIL) for collection by web scraping (guidance of 19 June 2025) are applied, in particular compliance with the “robots.txt” file and limiting collection to the pages needed.

Data are extracted from pages by fixed rules, without any artificial intelligence model: a value is only kept if it appears verbatim in the text of the page, and it is presented as stated by the website, distinct from the Facts taken from a register.

Article 10 — Informing the persons concerned

As the data is not collected from the persons concerned, this policy gives them the information required by Article 14 of the GDPR. The Publisher does not inform them individually: the number of websites concerned and the lack, for most of them, of personal contact details would make this impossible or would involve a disproportionate effort, within the meaning of paragraph 5(b) of that Article. In return, this policy is published permanently, each Card refers to the source of each of its Facts, and the balancing described in Article 9 is documented in writing and kept available to the CNIL.

Article 11 — Recipients and processors

The Facts on Cards can be viewed by the public. Alerts, Evidence and contact email addresses are accessible only to Watchers, within the limits of their role, and to the Publisher’s authorised staff.

Within the Publisher, Personal Data are only accessible to authorised persons, namely the President of AXO-LAB and the members of the Recto project team, to the extent their duties require. These persons act under the authority of the Publisher, within the meaning of Article 29 of the GDPR: they only process the data on its instructions and are bound by confidentiality.

The Publisher uses the following processors:

OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix, for the hosting of servers and data (France).
Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapour 049513, for the hosting of the Service’s database, in an Amazon Web Services data centre located in Paris (eu-west-3 region) (France); possible access from third countries, in particular Singapore and the United States, by Supabase and its sub-processors (including Supabase, Inc. and Amazon Web Services, Inc.), governed by the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914).

No data is sold, rented or disclosed for commercial purposes.

Article 12 — Retention periods

Retention periods of the Collector’s data
Data	Period
Full copy of a page read	Thirty days; afterwards only the relevant extract, the digital fingerprint, the address and the date of consultation are kept.
Extract of a page kept as Evidence	As long as the Fact it establishes is published, then one year after it is replaced by a more recent Fact.
Surname, first name and position of a person named on a Card	As long as the Card is published and the source still publishes the data; in the Card’s history, the data is replaced by the position alone one year after its removal.
Contact email address of a website	As long as the website publishes it, and at most one year after its removal.
Requests to exercise rights and decisions taken	Three years from the decision.
Proof of identity, if it was requested	Deleted as soon as the request has been answered.
Technical logs of the Collector, without page content	One year.

Article 13 — Rights of individuals and means of dispute

13.1 Rights over Personal Data

Any person concerned has the rights of access, rectification, erasure, restriction and objection provided for by Articles 15 to 21 of the GDPR, under the conditions described in the personal data protection policy. In particular, they may object to the Processing of their name, on grounds relating to their particular situation (Article 21). Requests should be sent to contact@recto-medias.fr; the Publisher answers within one month, which may be extended by two months taking into account the complexity and number of requests (Article 12(3)).

13.2 Effect of an objection

As soon as an objection concerning their name is received, the name is no longer displayed while the request is examined (Article 18(1)(d) of the GDPR). The request is examined case by case; the decision is taken by two authorised persons, other than the person who examined the request, and reasons are given. If the objection is upheld, the name is no longer displayed; the Card states “Name not displayed at the request of the person concerned”, and continues to state the declared position and its date. If it is rejected, the decision sets out the compelling legitimate grounds relied on and recalls the means of redress.

13.3 What is not erased on request

Facts concerning a legal person (name, SIREN number, registration with the Joint Committee for Press Publications and Agencies, dates) and technical Facts relating to a domain name are not Personal Data: they are neither erased nor hidden on request. They change only when their source changes, as recorded by a new collection.

Proving control of a domain name allows the publisher of a website to ask for the reading of its pages to stop, to dispute a Fact or to exercise its right of reply; that proof alone changes no Fact.

13.4 Disputes and right of reply

Anyone may dispute the accuracy of a Fact under the procedure set out in the general terms of use: the dispute triggers a new collection from the source, and the Fact is only changed if the source justifies it.

Any person named or designated by the Service also has the right of reply provided for by Article 1-1 of the LCEN. The request is sent to the publication director, Clément Pandreau, at clement.pandreau@axo-lab.fr, within three months of the Fact that justifies it being made available to the public.

13.5 Complaint to the CNIL

Any person concerned may lodge a complaint with the Commission nationale de l’informatique et des libertés (Article 77 of the GDPR): Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France; telephone: +33 1 53 73 22 22; online: cnil.fr/fr/plaintes.

Article 14 — Changes to the policy

14.1 Amendments

The Publisher may amend this policy, in particular to take account of changes to the Service, to the regulations or to case law. Each amendment gives rise to a new version, numbered and dated, published on the Site. Earlier versions remain available from the version history at the end of the document.

A new version comes into force on the date it states. Where the amendment is substantial, the Publisher informs Users by a notice on the Site and, for Users with an account, by email, before it comes into force.

Version history

Successive versions of the document
Version	Entry into force	Changes
2.0 (in force)	5 November 2026	Launch of the Service. The public certificate transparency logs, searched through crt.sh, join the Collector’s sources (Article 5.1). Evidence is also used for the files the Publisher sends to the competent authorities when the verification of a website by people confirms it (Article 9). Alerts and Evidence are accessible to Lead Reviewers and to the dispute panel, within the limits of their role, and the role of OVH SAS is specified, the database being hosted by Supabase (Article 11). Disputes are filed through the Site’s form (Article 13.4). The term “Watcher” is replaced by “Local Correspondent”.
1.1	30 October 2026	Clarifications on the Facts and on the data read: the Card states where the Collector looked for a missing Fact and gives four new reasons for an absence (information not applicable, media outside the scope of the French registers, first reading, website that the Publisher chooses not to read); each Fact states how it was established (Article 4.2); new clause on the changes recorded from one consultation to the next (Article 4.4); Arcom’s list of services of general interest added to the sources, and the number displayed by a website looked up in the CPPAP list (Article 5.1); limit lowered to 4 pages per visit (Article 5.2); the name of a natural person presented as a website’s host, and former names of persons in the changes recorded, are never kept or published (Article 8.2).
1.0	28 October 2026	First version: sources read by the Collector, compliance with websites’ objections, Personal Data concerned, purposes and legal bases, retention periods, rights of individuals and means of dispute.