This English version is provided for convenience. In case of any difference, the French version prevails.
1. Who is responsible for your data
The data controller is Company name : to be completed, publisher of Airval (see the legal notice).
For any question about your data: confidentialite@airval.example.
For the documents you upload that contain third-party data (customers, employees, contractors), your company is the controller; Airval processes them on your behalf, as a processor, under the terms of use.
2. The data we process
- Your account: email address, password (stored only as an argon2id hash, never in plain text), date the address was confirmed.
- Your organisation: its name, its members and their role (owner, admin, member).
- Your company: name, SIREN number, legal form, date of incorporation, and the files you upload to the data room (accounting entries file, Stripe invoice export, contracts, articles of association…).
- Security: IP address, browser, sign-in dates, and a log of sensitive actions (sign-in, sign-out, document download, role change).
- Newsletter: email address, IP address and date of the request, confirmation date.
3. Why, and on what basis
| Purpose | Legal basis |
|---|---|
| Provide the service: account, data room, calculations, score | Performance of the contract |
| Secure the service: sessions, audit log, rate limiting | Legitimate interest (protecting your data and the service) |
| Invoice paid plans | Legal obligation |
| Send the newsletter | Consent, confirmed by email |
| Answer your messages | Legitimate interest, or pre-contractual steps |
4. How long we keep it
- Account, organisation, company and documents: for as long as your account is open.
- After the account is closed: deletion within deletion period : to be completed, unless the law requires us to keep it.
- Sign-in sessions: 30 days at most, then erased 7 days after they expire or are revoked.
- Email confirmation links: valid for 24 hours, erased 7 days later.
- Anti-abuse counters: erased as soon as their window ends, one hour at most.
- Audit log: retention period : to be completed.
- Newsletter: until you unsubscribe; an unconfirmed request is erased after 7 days.
- Accounting records related to invoicing: 10 years, as required by the French Commercial Code.
5. Who can access it
Your data is never sold, rented or used for advertising. It is accessible to the members of your organisation according to their role, to the publisher’s authorised staff for support and security, and to our processors:
- Hosting: host : to be completed.
- Email delivery: email provider : to be completed.
- Payment for paid plans: payment provider : to be completed.
- Assisted document reading: Anthropic (United States). This feature is off by default; when it is on, only the document concerned is sent, and the result is always shown to you before it is saved. This feature never produces a valuation figure.
6. Transfers outside the European Union
When a processor handles data outside the European Union, the transfer is covered by appropriate safeguards within the meaning of Articles 44 et seq. of the GDPR, such as the European Commission’s standard contractual clauses.
7. How we protect it
- Documents encrypted at rest (AES-256-GCM), never reachable through a public address.
- Passwords stored as argon2id hashes.
- Revocable sessions, of which the database only keeps a hash.
- Role-based access, log of downloads and role changes.
- Encrypted connection (HTTPS), strict security headers, limits on sign-in attempts.
The details are on our Security page.
8. Your rights
You have the right to access, rectify, erase, restrict, port and object to the processing of your data, the right to withdraw your consent at any time, and the right to set instructions for what happens to your data after your death.
Write to us at confidentialite@airval.example: we reply within one month. If you believe your rights are not being respected, you can lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07), or with the authority of your country.
11. Changes
We may update this policy. The date of the last update is shown at the top of the page; if there is a significant change, we will let you know by email.