Privacy Policy
This policy explains what we do with personal data about the people who hold accounts with us — our customers and their users. For that data we are the controller.
It does not cover the people who are investigated using the service. For that data our customer is the controller and we act on their instructions; the terms are in the Data Processing Agreement.
If you have been the subject of an investigation, or think you may have been, the page written for you is the Notice to Individuals.
1. Who we are
Nacre, SAS, RCS Paris 941 938 839, SIRET 941 938 839 00011, 50 avenue des Champs-Élysées, 75008 Paris, France. For any question about your personal data, write to privacy@nacre.edda.cloud.
2. What we collect, and why
| Data | Why | Lawful basis |
|---|---|---|
| Name, email address, password (stored only as a hash) | To create and secure your account and to contact you about the service | Performance of our contract with you |
| IP address, browser user agent, session records | To keep you signed in, and to detect and investigate abuse | Our legitimate interest in operating a secure service |
| Credit balance and transaction history | To account for what you have bought and spent, and to issue invoices | Performance of our contract; legal obligation to keep accounting records |
| Which investigations you ran, and when | To provide the service, to bill for it, and to be able to answer a question about how it was used | Performance of our contract; our legitimate interest in accountability |
| Which version of our terms you accepted, when, and from which IP | To be able to show what was agreed | Our legitimate interest in establishing the contract |
| Operational logs and timings | To diagnose faults and improve performance | Our legitimate interest in a working service |
We do not use cookies for advertising or analytics. The only cookies set are the ones needed to keep you signed in and to protect forms against cross-site request forgery. They are strictly necessary, so we do not ask for consent to them.
3. Where your data is
Our servers, database and file storage are in Frankfurt, Germany. Account data stays in the European Union. The only routine transfer outside the EU is to our model provider in the United States, and that concerns the content of investigations rather than your account details; it is covered by Standard Contractual Clauses. The full list is on the Sub-processors page.
4. How long we keep it
- Account data: for as long as your account exists, then deleted within 30 days.
- Investigations and their contents: 12 months from completion, then deleted automatically — including stored images and page snapshots. You can delete one sooner at any time.
- Invoices and accounting records: ten years, as French law requires. These contain your billing details, not the content of investigations.
- Security logs: twelve months.
5. Who else sees it
The organisations listed on our Sub-processors page, each bound to process data only on our instructions. We do not sell personal data and we do not share it for anyone else’s marketing. We disclose data to an authority only where legally compelled, and will tell you unless prohibited from doing so.
6. Your rights
You may ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. Where we rely on legitimate interests you can object, and we will stop unless we have compelling grounds not to.
Write to privacy@nacre.edda.cloud. We reply within 30 days. You can also complain to a supervisory authority — in France, the CNIL.
7. Security
Traffic is encrypted in transit. Passwords are hashed and never stored in readable form. Stored images and page snapshots are held on a private disk and served only to the account that owns them, through an authenticated route. Access to production is restricted to named administrators.
8. Changes
Substantive changes are notified by email before they take effect. Each version is published with a version number and date.