Privacy policy

Who is responsible?

Thibault Guery, Chaussée d'Alsemberg 842, 1180 Uccle (Bruxelles), Belgique. Contact: tiboguerydev@gmail.com.

Two situations: for agency accounts (their members) we are the controller. For what an agency's clients send through their link (files, answers, messages), the agency is the controller and we act on its behalf as a processor (see the data processing agreement).

What data?

Agency members: email, display name, photo (optional), preferences, and a log of sensitive actions (sign-ins, invitations, deletions, exports).

Agencies' clients: name and email given by the agency, and what they send themselves: files, answers, approvals, messages, and the date of their last visit.

We don't collect browsing data for analytics or advertising.

Why?

To provide the service (contract), secure it and prevent abuse (legitimate interest), and send project emails (links, reminders, updates) on the agency's request.

How long?

As long as the agency's account exists. An agency can permanently delete a client and everything about them at any time; when an account is closed, its data is deleted. Technical upload tokens are erased after 2 days.

Who receives it?

Only our technical providers, who use the data solely to provide their service:

Supabase (database and files) — data hosted in the eu-west-1 (Ireland, European Union) region.

Vercel (application hosting) — the application is served from its global network; data is not stored at Vercel.

Resend (email delivery) — receives the recipient's address and the email's content.

Sentry (technical error reporting, data hosted in the EU) — receives an error's details, without cookies, IP addresses, content or client links.

These providers may be established outside the European Union (United States): transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

Cookies

Only strictly necessary cookies: the agencies' sign-in session and a few preferences (language, welcome screen). The light/dark theme and text drafts are kept in your browser. No analytics or advertising cookies, so no consent is asked.

Your rights

You can ask to access, correct, delete or export your data, or object to processing: write to tiboguerydev@gmail.com. If you are an agency's client, contact the agency first: it decides about your data; we will help it answer you.

You can also lodge a complaint with the Belgian Data Protection Authority, rue de la Presse 35, 1000 Brussels (dataprotectionauthority.be).

Security

Secret links, private files, account isolation checked by tests: everything is detailed on the Security and data page.