Privacy policy

1. Data controller

The data controller is Timothy Mariaud--Quéré, publisher of Catpilot. Contact: timothy.mariaudquere@catpilot.fr.

2. Data collected and purposes

We only collect the data strictly necessary for the purpose of the processing (data minimisation principle, Article 5 GDPR). No sensitive data within the meaning of Article 9 GDPR is collected.

3. Retention periods

In accordance with Article 5(1)(e) GDPR, your data is kept for no longer than is necessary for the purposes for which it is processed. After that, it is deleted or anonymised, unless it must be archived to meet a legal obligation or to defend our rights.

• User account. Your account data (identity, work email, settings) is kept for the duration of the contract with the client company, then deleted within 30 days.
• Inactive accounts. Accounts with no login for 24 months are deleted, after prior notice to the user.
• Contractual data. Evidence of the business relationship is kept for 5 years from the end of the contract, in restricted-access archives, in line with the limitation period set out in Article 2224 of the French Civil Code.
• Invoices and accounting records. They are kept for 10 years from the end of the financial year, in accordance with Article L123-22 of the French Commercial Code.
• Prospects. Data of people contacted by email or LinkedIn, or who requested a demo, is kept for 3 years from its collection or from the last contact initiated by the prospect, in line with the CNIL guidelines on customer management.
• Clients, for marketing purposes. Data is kept for 3 years from the end of the business relationship.
• Marketing opt-out list. The information needed to respect your objection is kept for 3 years from the exercise of this right.
• Requests to exercise rights. Information relating to your request is kept for 5 years from its closure. Any proof of identity is deleted as soon as it has been checked.
• Login and security logs. They are kept for 12 months and then deleted automatically, in line with the CNIL recommendations on logging.
• Technical backups. They are kept on a rolling 30-day basis.
• Data imported by our clients. Data imported into Catpilot by client companies is kept for the duration of the contract. At its end, it is returned on request and then deleted within 60 days, backups included, in accordance with the client's instructions (Article 28(3)(g) GDPR).

4. Recipients and service providers

Your data is only accessible to authorised Catpilot staff and to our technical service providers, within the limits of their role:

• Vercel: application hosting (processing in Paris, France).
• Supabase: database, accounts and file storage (hosted in Paris, France).
• Resend: sending service emails (invitations, password resets, notifications).
• OVHcloud: Catpilot's email service.

Some of these providers are companies established outside the European Union. Any transfers are covered by appropriate safeguards (standard contractual clauses of the European Commission).

5. Data security

Protecting our clients' data is at the heart of how Catpilot is designed. Here are the concrete measures in place:

• Hosted in France: the application runs in the Paris region, and data (accounts, files) is hosted in Paris.
• Strict separation between companies: access rules are enforced directly by the database, not only by the application. Each user only sees their own company's data, and an extract uploaded as personal is only visible to its author.
• Encryption: all exchanges with the website are encrypted (HTTPS), and data is encrypted on our host's servers.
• Protected files: uploaded files are kept in private storage, and uploads go through temporary, secure links.
• Checks on uploaded files: only Excel files are accepted, their size is limited and their content is checked (no hidden macros, protection against malicious files).
• Secure access: accounts are created by invitation only, strong passwords are mandatory (at least 12 characters, with upper and lower case letters, a digit and a special character), and two-factor authentication is available to everyone and mandatory for the Catpilot team.
• Traceability: the main actions are recorded in an access log, kept for 12 months and then deleted automatically. The content of your files is never included.
• Identified exports: every PDF or PowerPoint export carries a watermark showing the company, the user and the date.
• Website protection: content security policy, security headers and rate limiting on sensitive forms (forgotten password, contact).
• Never sold: your data is never sold, never shared with a third party and never combined with another client's data.

6. Cookies

Catpilot only uses cookies that are strictly necessary for it to work (keeping you logged in, display preferences). No analytics or advertising cookies are set, so your consent is not required.

7. Your rights at a glance

In accordance with Articles 15 to 22 GDPR, you remain in control of your personal data. At any time, you can:

• access it: find out what data we hold about you and obtain a copy;
• correct it: have inaccurate information corrected or incomplete information completed;
• have it erased (“right to be forgotten”): request its deletion when it is no longer needed;
• restrict its use: temporarily suspend its processing, for example while a dispute is being examined;
• take it with you (portability): receive it in a structured, machine-readable format to reuse it elsewhere;
• object to its processing: on grounds relating to your particular situation;
• decide what happens to it after your death: set instructions for its retention, deletion or disclosure (Article 85 of the French Data Protection Act).

To exercise any of these rights, simply write to timothy.mariaudquere@catpilot.fr, specifying your request. We will reply within one month. Each of these rights is detailed in section 8 below.

8. Your rights over your personal data

In accordance with Regulation (EU) 2016/679 (GDPR) and French Law No. 78-17 of 6 January 1978 (loi Informatique et Libertés), any individual whose data is processed by the publisher of Catpilot has the following rights.

9. Changes

This policy may change. The date of the last update is shown at the top of this page.