Privacy policy

Two distinct roles

For your account and billing data, we are the controller.

For the answers, photos and lists your crews capture, you are the controller and we are your processor: we act only on your instructions, set out in the data processing agreement.

Data processed

Account: name, email address, password (hashed), organization, role, sign-in logs.

Billing: company name, address, VAT number, invoice history. Payment data is handled by our payment provider; no card number reaches our servers.

Business content: form answers, media, lists, registered devices, audit log.

Technical: IP address, device type, error traces, performance measurements.

Legal bases and purposes

Performance of the contract: providing the service, billing, support.

Legitimate interest: security, fraud prevention, product improvement from aggregated measurements.

Legal obligation: invoice retention.

Consent: marketing communications, non-essential analytics.

Retention

Business content: for the duration of the contract, then a thirty-day grace period before permanent deletion, unless you configure a shorter retention yourself.

During those thirty days, an answer withdrawn by your retention rule stays in your console's bin: an administrator restores it without going through us.

Invoices: ten years, as accounting rules require.

Technical logs: twelve months at most.

Your rights

Access, rectification, erasure, restriction, portability and objection can be exercised at contact@groupe-apb.fr. We answer within one month.

If your data was captured inside a customer's organization, contact that customer first as the controller; we assist them in answering.

You may lodge a complaint with the French data protection authority.

Cookies

The public site uses only cookies necessary to operate it and, where applicable, analytics configured so as not to require consent under the French regulator's guidance.

The application uses a session cookie required to sign in.