Privacy Policy

Privacy Policy

Last updated: 04/10/2026

1. Introduction

Welcome to Deciris. We respect your privacy and are committed to protecting your personal data. This Privacy Policy describes how Deciris (SASU) (“we”, “us”, or “our”) collects, uses, discloses and protects your information when you visit our website or use our software as a service (the “Service”).

This policy covers Free and paid accounts, the Professional Trial and the thirty (30) day Transition period after expiry, as well as exports and Account closure.

This policy applies to:

• Customers: Businesses or organizations using our Service, including free of charge.
• Users: Individuals authorized by Customers to access the Service.
• Participants: Individuals who respond to questionnaires or inspections through the Service.
• Visitors: Anyone browsing our public site.

We comply with the General Data Protection Regulation (GDPR) and applicable French laws.

2. Roles of Data Controller and Data Processor

It is important to distinguish the two main contexts in which we process data:

2.1 When we act as Data Controller We are the Data Controller for:

• The information you provide when registering a Customer account (e.g. professional contact details, billing information).
• Users' connection identifiers to the Service.
• Usage data and analytics regarding your interaction with our platform (used to improve the Service).
• The marketing communications we send to you (B2B prospects).

2.2 When we act as a Subcontractor We are the Subcontractor for:

• The content of the questionnaires and templates you create.
• Participant Data: Responses, names, emails or other data you collect from third parties using our Service.

In this second context, You (the Customer) are the Data Controller. We process this data only on your instructions and in accordance with our Terms of Use and our Data Processing Agreement (DPA).

3. Data we collect

3.1 Data you provide to us

• Account Data: Name, email address, telephone number, name of organization, SIRET/VAT number (for billing).
• Plan and Trial Data: Plan type, Trial activation and expiry dates, transition deadline, selection of Free or a paid plan, and requests for export and Account closure.
• Billing Data: Billing address and other details required for billing. We do not store credit card or payment method details as billing is handled manually.
• Communications: Records of your support tickets or emails.

3.2 Data collected automatically

• Usage Logs: IP addresses, browser type, operating system, referring URL, device information, pages visited, and timestamp.
• Cookies: Technical cookies required for connection authentication and session security.

3.3 Data processed on behalf of Clients

• Questionnaire Content: Questions and images that you upload.
• Answers: Data entered by Participants (which may include text, photos, GPS location if enabled, etc.).
• Data submitted to AI features (if enabled in the plan): Free-text instructions and, where applicable, uploaded file content (e.g. PDF) sent to the AI provider to generate/modify templates.

4. How we use data and legal bases

We use personal data for the following purposes, relying on these legal bases under the GDPR:

For data processed as a Processor (Participant responses), strictly for the purpose of providing the Service as instructed by the Client.

5. Data Sharing and Subprocessors

We do not sell your personal data. We only share data with trusted third-party service providers (“Subprocessors”) necessary to operate our Service.

Current Main Sub-processors:

• DigitalOcean: Hosting infrastructure (Servers located in the EU).
• MongoDB Atlas: Database hosting (EU Regions).
• Agora: Video streaming services for remote inspections (only when this feature is enabled in the plan).
• Mailjet: Email delivery services (including invitations, security notifications, and transactional account/Trial-expiry communications; some mailing features may be unavailable depending on plan).
• AI Providers: (e.g. Anthropic) for model generation/modification capabilities (receive instructions submitted in the AI tool, including free text and, where applicable, uploaded file content; Participants' responses are not transmitted automatically).

We ensure that all suppliers are bound by strict data protection agreements. We may also disclose data if required to do so by law (e.g. court order).

6. International data transfers

Our main servers and databases are located within the European Economic Area (EEA).

If we transfer data outside the EEA (for example, to a US-based tool), we ensure that appropriate safeguards are in place, such as:

• Adequacy decisions: Transfer to countries considered to provide adequate protection.
• Standard Contractual Clauses (SCC): Use of EU-approved contracts that require the recipient to protect your data.
• Data Privacy Framework: Use of the EU-US Data Protection Framework where applicable for US suppliers.

7. Data retention

• Account data: Retained during the contractual relationship, including Free, the Professional Trial and the Transition period. After closure, only data needed for a legal obligation or the defence of rights is retained for the applicable period, for example five years for contractual claims.
• Billing data: Retained for ten years where required by French accounting and tax obligations.
• Participant data, questionnaires and uploaded files: Retained during the contractual relationship, including Free, the Trial and the thirty days of restricted access after Trial expiry.
• Trial expiry: If no continuing plan has already been activated and the Account has not been closed early, transition starts automatically at the end of the three months. External questionnaires can no longer receive responses, and Users cannot create or modify Content except for operations needed to move to Free. For thirty days from Trial expiry, the Customer may activate Free after meeting its limits, subscribe to Professional, export data or close the Account. Export alone does not extend the deadline. If neither Free nor Professional is activated, the Account, its Content and exports are deleted from production systems at the end of those thirty days.
• Transition exports: Raw data in CSV and uploaded images and files in a ZIP archive, accessible until the end of transition unless the Account is closed earlier. Generated PDF reports are not retained on servers and are not included; they must be generated and downloaded before Trial expiry.
• Export incident: Automatic deletion is suspended when Deciris detects an export failure, including for already-scheduled deletion. Following intervention by Deciris staff, a fresh thirty-day period starts when the corrected export is accessible and the Owner has been notified, without shortening an existing later deadline. A reminder is sent seven days before the revised deadline. A further failure maintains or reinstates the hold. Downloading alone does not trigger early deletion; express closure remains possible. These rules take precedence over the automatic deletion and export-availability deadlines above under Article 6.2.2 of the T&Cs.
• Other closures: Data processed for the Customer is deleted from production systems without undue delay, generally within thirty days of closure, subject to the DPA and applicable legal obligations.
• Backups: Residual copies may remain until the backup cycle described in Article 4.8 of the DPA expires. Account closure and production deletion do not mean immediate erasure of all backups.

8. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you.
• Rectification: Correct inaccurate or incomplete data.
• Erasing: Request deletion of your data (“Right to be forgotten”), subject to legal retention obligations.
• Limitation: Ask us to limit the processing.
• Portability: Receive your data in a structured, machine-readable format.
• Opposition: Object to processing based on legitimate interests or commercial prospecting.
• Withdraw consent: Withdraw your consent at any time when processing is based on consent.
• Complaint: Lodge a complaint with the CNIL (www.cnil.fr).

How to exercise your rights: Contact us at contact@deciris.com. We may request additional information to verify your identity before processing your request. We respond within one month, which may be extended by two additional months for complex or multiple requests, in accordance with GDPR. Note: If you are a Participant wishing to access/delete data collected by one of our Clients, please contact that Client directly. We cannot delete Participant data without the permission of the Data Controller.

9. Security

We implement robust technical and organizational measures to protect data, including:

• Data encryption in transit (TLS 1.2+) and at rest.
• Strict access controls and principles of least privilege for our staff.
• Security assessments and regular updates.

However, no method of transmission over the Internet is 100% secure. You are responsible for maintaining the confidentiality of your password.

10. Cookies

We use cookies mainly for essential purposes (authentication, session management). We do not use third-party advertising cookies, analytics services or tracking technologies.

• Session cookies: To keep you logged in.
• Preference cookies: To remember language settings.

You can manage your cookie preferences through your browser settings.

11. Changes to this policy

We may update this Privacy Policy from time to time. The “Last Updated” date at the top will indicate the effective date. Significant changes will be notified by email or via an alert on the dashboard.

12. Contact us

If you have any questions about this policy or our data practices:

Deciris (SASU) 9 RUE DES COLUMNS 75002 PARIS France E-mail: contact@deciris.com