Privacy policy
Last updated: September 23, 2026
Who processes what
Two situations, and they do not follow the same rules:
- Your account data (name, email, password, organization, subscription billing): [à compléter : entityName] is the controller.
- Your clients' data that you enter in Prestaday (contact details, contracts, schedules, payments, documents): you are the controller, and [à compléter : entityName] acts as processor on your behalf. That commitment is the data-processing agreement (DPA), separate from this page.
Reading this page does not record a contractual acceptance.
Data and purposes
| Data | Purpose | Legal basis |
|---|---|---|
| Account: name, email, password (hashed) | Create and secure access | Contract |
| Technical logs, IP address | Security, abuse limits, diagnosis | Legitimate interest |
| Proof of CGU and DPA acceptance: IP address, browser, timestamp | Show which version was accepted, and by whom | Contract |
| Electronic-signature evidence: IP, browser, timestamp, code sent | Evidential value of the signature | Legal obligation / legitimate interest |
| Billing and payment data | Issue and keep invoices | Legal obligation |
| Product-email opt-in, and its withdrawal | Send news only to people who asked | Consent |
| Client data entered by the organization | Provide the service to the organization | Processing on the organization's behalf |
The IP address and browser stored with an acceptance are kept for the life of that record. They are not shown in the operator console.
Subprocessors
The service relies on the following providers:
| Prestataire | Rôle | Localisation |
|---|---|---|
| Neon | Base de données PostgreSQL hébergée | UE (Francfort) |
| Resend | Envoi des e-mails transactionnels | UE / États-Unis |
| Stripe | Paiements en ligne des clients de l'organisation | UE / États-Unis |
| Cloudflare Turnstile | Protection anti-spam du formulaire d'inscription | UE / États-Unis |
| Google / Microsoft | Synchronisation agenda et contacts — uniquement si l'organisation connecte son compte | UE / États-Unis |
| [à compléter : hostName] | Hébergement de l'application | [à compléter : hostAddress] |
Retention
Account data is kept while the account exists, then deleted after closure. Some data deliberately survives a deletion request because the law requires it: issued invoices and electronic-signature evidence are kept for their legal retention period. What deletion keeps, and why, is shown before you confirm.
[to be completed: exact retention periods, with counsel]
Your rights
You can access, rectify, erase, restrict, object, and port your data. Export and deletion of your account or organization are available in the application. For any other request: [à compléter : privacyEmail].
If you are a client of an organization using Prestaday, write to that organization: they decide about your data; we only host it for them.
You can lodge a complaint with the CNIL (www.cnil.fr).
Cookies
Prestaday uses only strictly necessary cookies: a session cookie that keeps you signed in, and a cookie that remembers the active organization. No advertising cookies and no third-party audience measurement. No consent banner is shown.