Privacy notice

Personal data and people concerned

The service may handle names, business contact details, account and membership identifiers, authentication and security events, billing references, support messages, supplier communications and technical request data such as IP address and user agent. Customer workspaces may also contain personal data inside product records, evidence documents, lifecycle events and audit history.

People concerned may include customer users, supplier contacts, invited collaborators, website visitors, support contacts and individuals named in customer-uploaded material. Customers should minimise personal data, avoid special-category data unless strictly necessary and lawful, and keep personal information out of public passports unless publication is justified.

Controller and processor roles

For account administration, billing, security, support and operation of this website, the operator normally acts as controller. When a customer submits product records, supplier contacts, evidence or user data to its private workspace, the customer normally determines the purposes and acts as controller while the operator acts as processor under the customer agreement and data-processing addendum.

These roles depend on the facts. The customer must give its users, suppliers and other data subjects the notices required for its processing and must not instruct the service to process data unlawfully.

EU General Data Protection Regulation, Articles 13–15 ↗

Purposes and lawful bases

Account, authentication and workspace data are used to perform the subscription contract; security logs, abuse prevention and service diagnostics support legitimate interests in protecting the platform; billing records are processed for contract and legal obligations; optional analytics or advertising measurement relies on consent where required.

Support messages and sales enquiries are used to answer the request and keep an accountable history. Personal data is not used for a new purpose until its lawful basis has been documented, and customer content is never reused for advertising.

Service providers and international transfers

The operator uses these service providers: OVHcloud (OVH SAS, France) for application servers, database and cache; Hetzner Online GmbH (Germany) for storage of uploaded documents and encrypted backups; LWS – Ligne Web Services (France) for transactional e-mail; Google (Google Ireland Ltd / Google LLC) for optional Sign in with Google and, only after consent, website analytics and advertising measurement; Microsoft (Microsoft Ireland Operations Ltd / Microsoft Corp.) for advertising measurement after marketing consent; OpenAI, L.L.C. (United States) for optional AI features; and Stripe (Stripe Payments Europe Ltd / Stripe, Inc.) for payments once paid plans are enabled. Customer data at rest is stored in the European Union. The Data Processing Agreement lists the data each provider receives.

The operator is a company established in the United States, and the Google, Microsoft, OpenAI and Stripe functions above may involve processing in the United States. These transfers rely on the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914. A copy of the safeguards can be requested from the privacy contact.

EU General Data Protection Regulation, Articles 13–15 ↗

AI-assisted features

AI functions are optional. When a model provider is configured, the text or document excerpts needed for a requested task may be sent to that provider. Without a configured provider, the platform uses deterministic heuristics. Model output is treated as a draft and requires human review before publication or use in a regulated decision.

The platform is not designed to make solely automated decisions that produce legal or similarly significant effects about individuals. Customers must not use AI features for such decisions unless they have independently established a lawful basis, safeguards and required notices.

Security and incident handling

The service uses role and tenant controls, scoped credentials, audit events, encryption options, review gates and redaction controls. No internet service can promise absolute security. Customers remain responsible for account permissions, secure endpoints, lawful uploads and prompt removal of access that is no longer needed.

Suspected personal-data incidents should be reported immediately to the privacy contact. The operator assesses confirmed incidents, preserves relevant evidence and notifies affected controllers or authorities when the applicable law and the controller-processor relationship require it.

EU General Data Protection Regulation, Articles 13–15 ↗

Retention, deletion and account closure

Retention depends on record type, tenant settings, contractual commitments and legal duties. Browser sessions and sign-in state are short-lived; operational events and customer records follow configured schedules; billing or security evidence may need a longer statutory period; immutable audit records are retained to preserve accountability.

At termination, the customer should export required data before the agreed access window ends. Customer data is deleted within 30 days after the end of the service, and copies in encrypted backups expire within 30 days of their creation, except records the law requires the operator to keep. A public passport may have a separate legally required availability period.

Your rights and complaints

Depending on the processing and applicable law, a person may request access, correction, deletion, restriction, portability or objection, and may withdraw consent without affecting earlier lawful processing. Identity may need to be verified before a request is fulfilled.

For customer-controlled workspace data, the operator may direct the request to the relevant customer or assist that customer as processor. You may complain to the supervisory authority shown below or another competent authority in your place of residence, work or alleged infringement.

EU General Data Protection Regulation, Articles 13–15 ↗