Privacy Policy

1. Data controller

The data controller for personal data collected through the OpenChantier Service is the publishing company, whose contact details appear in the Legal Notice.

2. Data collected

In the course of using the Service, we collect the following data:

• Identification data: first name, last name, email address
• Professional data: company name, company registration number, VAT number
• Usage data: projects, photos, working hours, documents
• Technical data: IP address, browser type, connection data
• Payment data: processed exclusively by our payment provider Stripe

3. Purposes of processing

Your data is collected for the following purposes:

• Provision and management of the Service
• Management of your account and subscription
• Service-related communications (notifications, updates)
• Service improvement and usage analysis
• Compliance with our legal and regulatory obligations

4. Legal basis

The processing of your data is based on:

• Performance of a contract (provision of the Service)
• Your consent (marketing communications)
• Our legitimate interests (Service improvement, security)
• Compliance with our legal obligations (invoicing, accounting)

5. Retention period

Your data is retained for the duration of your use of the Service, then for 3 years after account deletion, unless otherwise required by law.

Billing data is retained for 7 years in accordance with accounting obligations.

These periods are enforced by a monthly automatic purge. Three years after an account is deleted, the site photos of the company it owned are destroyed at our image host as soon as no member has access to it any more; the account and the company themselves are erased only once they carry no accounting obligation. Notifications and the log of sensitive actions are kept for 12 months; only entries about an invoice (issue, cancellation, credit note, payment, refund) follow the 10-year accounting period, and without the IP address, which is erased after 12 months.

6. Data recipients (processors)

We neither sell nor rent your data. It is entrusted to the providers listed below, each acting as a processor within the meaning of Article 28 GDPR and strictly for the purpose of delivering the Service. The purpose and hosting region are given for each:

• Vercel — hosting of the web application and access logs — processed in the EU (Frankfurt region); company established in the United States
• Neon — PostgreSQL database, holding all of your project, invoicing and account data — EU (Frankfurt)
• Cloudinary — storage and delivery of site photos, documents, company logos and project template images — EU/United States
• Stripe — collection of subscriptions and of your clients' payments; card details never pass through our servers — EU/United States
• Resend — transactional email delivery: sign-in codes, notifications, invoice reminders, quote sharing — EU/United States
• Pusher — real-time messaging and notifications, on the European cluster — EU
• Upstash — Redis cache used for rate limiting; it holds visitors' IP addresses for a few minutes — EU/United States
• Google — “Sign in with Google” authentication (OAuth); and, only after you accept the cookie banner, Google Analytics 4 audience measurement and Google Ads advertising tracking — EU/United States
• Vercel Analytics — aggregated audience measurement for the site, with no cookie and no advertising identifier — EU/United States
• Render — hosting of the microservice that generates Factur-X and ZUGFeRD electronic invoices; it receives the invoice data only for as long as it takes to produce the file — United States
• Tiime — partner e-invoicing platform (PDP) responsible for transmitting your electronic invoices and returning their status to us — France
• Expo — delivery of push notifications to the mobile app (device token, notification title and body) — United States
• Base Adresse Nationale (data.gouv.fr) in France and Photon (komoot) in other countries — autocompletion of the site addresses you type in — France / Germany

None of these providers is allowed to use your data for its own purposes. No data is sold or passed on to third parties for advertising.

Technical logs: the application's access and error logs (IP address, page requested, timestamp, user agent) are kept for a maximum of 12 months, then deleted or anonymised.

7. If you connect your bank

Bank synchronisation is an optional feature, switched off by default: nothing is transmitted unless you enable it and give explicit consent to your bank.

Once enabled, the connection goes through Bridge (Bridge / Bankin', a French account information service provider). Bridge receives the credentials for your bank — which we never see — and sends us back the list of your transactions (label, amount, date, direction) so they can be matched against your invoices. This banking data is hosted in the EU. You may withdraw this consent at any time with your bank or with Bridge: synchronisation then stops immediately.

8. Transfers outside the European Union

Some of our providers are established in the United States. These transfers are governed by the standard contractual clauses (SCCs) approved by the European Commission and, where the provider is certified under it, by the EU–US Data Privacy Framework, in accordance with the GDPR.

9. Your rights

Under UK GDPR, you have the following rights:

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ('right to be forgotten')
• Right to restriction of processing
• Right to data portability
• Right to object to processing

To exercise these rights, contact us at the address in the Legal Notice. You may also lodge a complaint with the ICO (ico.org.uk).

10. Cookies and trackers

Strictly necessary cookies. They keep you signed in and remember your language, your theme and your cookie choice. They cannot be disabled and do not require your consent.

Cookie-free audience measurement. We use Vercel Analytics, which counts visits in aggregate without setting a cookie or creating an advertising identifier. It is declared here for transparency; it does not require your consent.

Measurement and advertising subject to consent. Google Analytics 4 and Google Ads set audience-measurement and advertising cookies. These trackers are loaded only after you have accepted them via the banner shown on your first visit. If you decline, none of these cookies is set and no data is sent to Google for those purposes.

You can change your mind at any time by clearing the site data your browser stores for openchantier.com, which brings the banner back, and you can configure your browser to refuse cookies — some features of the Service may then be affected.

11. Security

We implement appropriate technical and organisational measures to protect your data: encryption in transit (HTTPS/TLS), per-user data isolation, and restricted access to production data.