Privacy notice (draft)

# Privacy notice (DRAFT)

Status: **DRAFT, 2026-10-31. Not legal advice, not published, and the account
service is not open to the public.** This notice is a draft for counsel review
and owner approval. The published version will appear at `/legal/privacy` and
will carry a version number and an effective date. Nothing here is a promise
to a customer until it is published.

## 1. Who we are

The account service is operated by `[OPERATOR LEGAL NAME]`, `[LEGAL FORM]`, with
its registered office at `[REGISTERED ADDRESS]`, registered under
`[RCS CITY AND NUMBER]`, VAT number `[VAT NUMBER]` (the "operator", "we", "us").

Data protection contact: `[PRIVACY EMAIL]`. Data protection officer:
`[DPO NAME OR ROLE]`, `[DPO EMAIL]`. If counsel decides that no data protection
officer is required, this section will say so and name the person responsible
for data protection questions.

## 2. What this notice covers

This notice covers the hosted account service: the creation and management of
an account, sign-in through email and password or a third-party identity
provider, the profile, the plan and subscription, the usage record, and the
model gateway.

It does not cover the local workspace. The workspace, the business data it
imports, the store and the sessions stay on the customer's own machine. The
account service holds no business row, no imported document and no workspace
file. Deleting an account does not delete the local workspace or its business
data; that data is deleted on the machine that holds it.

The service is planned as an invite-only beta. It is not open to the public,
and live charges are not enabled while the beta terms apply.

## 3. Data we collect

We collect only what is needed to provide the account service.

| Category | What it includes | Why |
|---|---|---|
| Account and identity | Email address, display name, interface language, persona answers, verified email status, identity provider and provider subject, provider email and its verification status | Create the account, sign the person in, show the profile |
| Password credentials | A salted, iterated password hash and the iteration count. Never the password itself | Email and password sign-in |
| Sessions and security | Session rows with a hashed refresh token, device label (optional, trimmed), creation, last seen and expiry, revoked state; short-lived access tokens; CSRF and OAuth state cookies; email verification and reset tokens (hashed) | Keep the person signed in, revoke devices, prevent abuse and cross-site request forgery |
| Plan and subscription | Plan code, subscription status, current period, trial end, payment provider customer and subscription identifiers, invoice links, billing events with a minimal payload | Provide the plan, the allowance and the billing relationship |
| Usage | One row per hosted model call: workspace label, time, model, tokens in and out, cost in micro-USD, basis (provider-reported or estimated), request identifier, status and latency | Meter the plan's allowance and show current usage |
| Support and audit | Operator actions, support contacts, records of data subject requests and security events; request identifiers and status, latency, and no message content | Operate the service, answer requests and keep evidence |

We do not store the content of email messages beyond the transactional message
and its delivery metadata, and we do not keep a prompt or a completion in a log
(see section 5).

## 4. What we do not collect

- No business data: no imported rows, no documents, no mailboxes, no calendar,
  no workspace files, no model of the customer's business.
- No card data. The payment provider handles the card; we receive the
  subscription, invoice and payment status.
- No special categories of personal data on purpose. The service does not ask
  for health, political, religious, biometric or similar data.
- No advertising or profiling profile, and no data broker input.
- No raw IP address by default. User agent and device label are optional and
  trimmed.
- No prompt or completion content in any log, at the gateway or at the reverse
  proxy.

## 5. Hosted model calls

When a workspace uses the hosted model allowance, the prompt and the completion
pass through the gateway and the model provider in memory. A prompt can contain
a customer name, an amount or an invoice line, so business content leaves the
local machine on that path even though the account service stores no business
row.

- The workspace owner remains responsible for the content of its prompts and
  decides what to send.
- The account service processes that content only to forward the call, return
  the answer, count the tokens and apply the plan. It keeps no content.
- `[MODEL PROVIDER]` will process the prompt and completion to serve the call
  only under a contract that requires no training on this traffic and no
  retention beyond the call. The signed term is tracked in `subprocessors.md`
  and must be recorded there before the provider is enabled.
- A workspace that is configured with a local model, or with its own provider
  key, keeps that traffic outside the gateway. The account service does not see
  it, and the customer's own provider terms apply.

## 6. Lawful bases

| Purpose | Lawful basis |
|---|---|
| Create and operate the account, sign-in, profile, sessions | Performance of a contract (Article 6(1)(b) GDPR) |
| Provide the plan, the hosted allowance and metering | Performance of a contract (Article 6(1)(b)) |
| Billing, invoices and the records the payment provider keeps | Performance of a contract and legal obligation (Article 6(1)(b) and (c)) |
| Security, abuse prevention, rate limits, audit | Legitimate interests (Article 6(1)(f)): protecting the service and its users |
| Answering data subject requests and complaints | Legal obligation and legitimate interests (Article 6(1)(c) and (f)) |
| Transactional email (verification, reset, security notice) | Performance of a contract and legitimate interests (Article 6(1)(b) and (f)) |
| Any optional marketing, if introduced later | Consent (Article 6(1)(a)), with a way to withdraw |

Counsel confirms the mapping before publication. If a purpose changes, this
table and the purposes above change in the same version.

## 7. How long we keep data

The proposed periods are separated into account telemetry, audit and billing
records. In summary:

- account and profile data: while the account exists, then purged within 30
  days of deletion;
- usage rows: 12 months proposed;
- audit rows: 12 months proposed;
- email tokens: 7 days;
- the minimal billing record: `[RETENTION FOR BILLING RECORDS]`, proposed to
  match the statutory accounting period, with the payment provider keeping the
  statutory accounting records under its own retention;
- backups: `[BACKUP RETENTION]`, with deletion propagated through the backup
  cycle as described in the retention statement.

These periods are proposals, to be confirmed with counsel. Where a law or a
dispute requires a longer period, the longer period applies.

## 8. Who receives data

- The hosting provider `[HOSTING PROVIDER]`, in `[HOSTING REGION]` (EU), for
  storage and backups.
- The email provider `[EMAIL PROVIDER]`, for transactional messages.
- The payment provider `[PAYMENT PROVIDER]`, for subscriptions and invoices.
- The model provider `[MODEL PROVIDER]`, for hosted model calls, as described
  in section 5.
- Public authorities and courts where the law requires it, and professional
  advisers under confidentiality.

The current list, with purpose, location and the safeguard for any transfer
outside the EEA, is [`subprocessors.md`](subprocessors.md). Where a provider
processes outside the EEA, the transfer uses `[TRANSFER MECHANISM]`.

## 9. Security

The account service uses TLS, hashed and salted password storage, hashed
session and email tokens, HMAC-signed cookies, access control, audit logging
and no prompt or completion logging. Access is limited to what is needed to
operate and support the service. Every operator read of account data is
audited. No security measure is absolute; a personal data breach would follow
the operator's incident procedure.

## 10. Your rights

Subject to the conditions in the GDPR and to the identity check needed to
protect the account, a person can:

- access the data held about them and export it;
- correct or complete the profile;
- delete the account, subject to the records the law or a dispute requires;
- restrict or object to a processing that relies on legitimate interests;
- receive the data in a portable format;
- withdraw a consent at any time, without affecting earlier processing;
- complain to `[SUPERVISORY AUTHORITY]`, normally the CNIL for a French
  controller.

Requests are made from the account pages, or by email to `[PRIVACY EMAIL]`.
The operator answers within `[RESPONSE PERIOD]`, normally one month, and can
extend that period by two months for a complex or repeated request, with an
explanation. Requests are free. The operator may ask for proof of identity
before acting. The operator's procedure is available on request.

## 11. Cookies and session storage

The account service uses only cookies that are strictly necessary to sign a
person in and to protect forms.

| Cookie | Purpose | Lifetime |
|---|---|---|
| Session cookie `[NAME]` | Holds the short-lived access token | `[ACCESS TOKEN LIFETIME]` |
| Refresh cookie `[NAME]` | Holds the opaque refresh token, HttpOnly, Secure, SameSite=Lax | `[SESSION LIFETIME]` |
| CSRF cookie or form token `[NAME]` | Binds a form post to the session | Session |
| OAuth state cookie `[NAME]` | Binds an identity provider callback to the browser that started it | Minutes |

These cookies are essential to the service and are intended to be treated as
strictly necessary, which does not require consent under the French rules;
counsel confirms the position. The beta does not use
analytics, advertising or third-party tracking cookies, and there is no
consent banner for them. If an optional cookie is added later, this notice and
a consent mechanism change before it is set.

## 12. Children

The service is a business tool and is not directed at children. It is not
offered to anyone under 18. If the operator learns that a minor created an
account, the account is closed and the data is handled under the operator's
data subject request procedure.

## 13. Changes to this notice

The notice is versioned and dated. A material change is announced at sign-in,
by email to the account address, or both, at least 30 days before it takes
effect when the law allows. The account record stores the version of the
notice and the terms accepted at sign-up.

## 14. Contact and complaints

- Privacy questions and requests: `[PRIVACY EMAIL]`.
- Security issues: `[SECURITY EMAIL]`.
- Post: `[OPERATOR LEGAL NAME]`, `[REGISTERED ADDRESS]`.
- Complaint: `[SUPERVISORY AUTHORITY]`, normally the CNIL (www.cnil.fr).

If a person is not satisfied with the answer, they can complain to the
supervisory authority without waiting for the operator.