Privacy policy

Who processes what

Two situations, and they do not follow the same rules:

• Your account data (name, email, password, organization, subscription billing): Prestaday is the controller.
• Your clients' data that you enter in Prestaday (contact details, contracts, schedules, payments, documents): you are the controller, and Prestaday acts as processor on your behalf. That commitment is the data-processing agreement (DPA), separate from this page.

Reading this page does not record a contractual acceptance.

Data and purposes

Data	Purpose	Legal basis
Account: name, email, password (hashed)	Create and secure access	Contract
Technical logs, IP address	Security, abuse limits, diagnosis	Legitimate interest
Proof of CGU and DPA acceptance: IP address, browser, timestamp	Show which version was accepted, and by whom	Contract
Electronic-signature evidence: IP, browser, timestamp, code sent	Evidential value of the signature	Legal obligation / legitimate interest
Billing and payment data	Issue and keep invoices	Legal obligation
Product-email opt-in, and its withdrawal	Send news only to people who asked	Consent
Client data entered by the organization	Provide the service to the organization	Processing on the organization's behalf

The IP address and browser stored with an acceptance are kept for the life of that record. They are not shown in the operator console.

Subprocessors

The service relies on the following providers:

Prestataire	Rôle	Localisation
Resend	Envoi des e-mails transactionnels	UE
Stripe	Paiements en ligne des clients de l'organisation	USA
Cloudflare Turnstile	Protection anti-spam du formulaire d'inscription	UE
Cloudflare R2	Stockage des fichiers des clients	UE
Open map	Affichage des cartes	UE
Google / Microsoft	Synchronisation agenda et contacts — uniquement si l'organisation connecte son compte	UE / USA
Oracle Cloud Infrastructure	Hébergement de l'application	Oracle Cloud Infrastructure, 10000 Oracle Parkway, Redwood Shores, CA 94065, USA

Retention

Account data is kept while the account exists, then deleted after closure. Some data deliberately survives a deletion request because the law requires it: issued invoices and electronic-signature evidence are kept for their legal retention period. What deletion keeps, and why, is shown before you confirm.

Account data is kept while the account exists and deleted within 30 days after closure, unless security or legal obligations require longer retention. Organization data is deleted within 30 days after organization deletion, following the period available for export.

Invoices and accounting records are kept for 10 years from the end of the relevant financial year. Signature and acceptance evidence is kept for the period necessary to exercise or defend rights, up to the applicable limitation period. Technical and security logs are kept for up to 12 months. Support requests are kept for up to 3 years after closure.

Your rights

You can access, rectify, erase, restrict, object, and port your data. Export and deletion of your account or organization are available in the application. For any other request: contact@prestaday.com.

If you are a client of an organization using Prestaday, write to that organization: they decide about your data; we only host it for them.

You can lodge a complaint with the CNIL (www.cnil.fr).

Cookies

Prestaday uses only strictly necessary cookies: a session cookie that keeps you signed in, and a cookie that remembers the active organization. No advertising cookies and no third-party audience measurement. No consent banner is shown.