This translation is provided for information only: only the French version is legally binding.
Privacy policy
Version of 2026-10-31.
Data controller
Thomas SAMSON (SAMSON Tech), 32 route des Graves 3, 33640 Portets, France, is the controller of the processing described below, which concerns site visitors and customer accounts. For data reported by agents from customers' clusters, the publisher acts as a processor: see the data processing agreement.
Contact for any question or request: [email protected].
Data processed
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Email address, organization name and identifier, usernames and password hashes | Creating and managing the account, logging in, sending service emails (login links, alerts, reports) | Performance of the contract | Duration of the subscription, then deletion with the organization |
| Subscription, invoices, Stripe customer identifier | Billing and accounting | Legal obligation | 10 years (French Commercial Code) |
| IP address, date, page requested, browser | Service security, abuse prevention, diagnostics | Legitimate interest | 12 months at most |
| Organization activity log (logins, configuration changes) | Traceability for the customer and security | Performance of the contract | 365 days, then deleted (earlier if the organization is deleted) |
| Name, email address and message from the contact form; anti-bot check by Cloudflare Turnstile | Replying to your request, protecting the form from bots | Legitimate interest | 3 years at most after the last exchange |
| Audience measurement of the public site (pages viewed, origin, device) | Understanding how the site is used | Consent | 14 months (Google Analytics) |
Data from a deleted organization disappears immediately from the service, then from encrypted backups as they rotate, within 6 months at most.
Cookies
- Necessary cookies, no consent required: customer area and console session, form protection, chosen language. They are not used for any tracking.
- Audience measurement (Google Tag Manager and Google Analytics), on the public site only, set only if you accept it in the banner; you can change your choice at any time through the “Audience measurement” link at the bottom of the page.
Recipients and processors
Data is neither sold nor rented. Only the publisher and the providers needed for the service have access:
| Provider | Role | Location |
|---|---|---|
| OVH SAS | Hosting of the service and encrypted backups | France |
| Cloudflare, Inc. | Routing and protection of traffic (DNS, proxy, firewall) | Global network; transfers outside the EU governed by the Data Privacy Framework and standard contractual clauses |
| Brevo (Sendinblue SAS) | Sending service emails | France |
| Stripe Payments Europe, Ltd. | Payment and invoices | Ireland; transfers outside the EU governed by the Data Privacy Framework and standard contractual clauses |
| Google Ireland Ltd. | Audience measurement, after consent | Ireland; transfers outside the EU governed by the Data Privacy Framework |
Security
Encrypted connections (HTTPS), passwords stored as hashes, secrets encrypted in the database, two-factor authentication available, organizations isolated from each other, encrypted backups, restricted administrative access.
Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability regarding your data, as well as the right to withdraw your consent at any time. To exercise them, write to [email protected] ; you will receive a reply within one month. You may also lodge a complaint with the CNIL (cnil.fr).