Privacy notice

Who is responsible

DASKALOS APPS SAS, 183 rue de l'Abbé Griffon, 01960 Péronnas, France, RCS Bourg-en-Bresse 928 998 715, is the controller for the data described on this page, except where we act as processor for a customer (see "Customer materials and the portal" below).

Data protection contact: dpo@daskalos-apps.com. You can also write to the registered office.

Visiting the site

We set no cookies of our own, so there is no cookie banner, and we run no analytics on this site today — nothing counts your visit, not even anonymously. If we ever add analytics it will be a European service that sets no cookies, and it will be named on this page before it starts. The one exception to the no-cookie rule is the booking page: once you open it at the end of the scope check, Zoho sets cookies inside that frame (see "Contact, booking and referral forms").

This site is delivered by a worldwide content delivery network run by Amazon Web Services. The pages are stored in Amazon's Paris region, but they are served to you from whichever of Amazon's edge locations is nearest, anywhere in the world, and what you type into the contact, referral and scope-check forms passes through that edge location on its way to our server in Paris. Nothing else does: no customer code, no evidence and no scan result is ever served or sent through it.

Our hosting providers keep standard server logs (IP address, time, page requested) for security and troubleshooting. Scaleway SAS in Paris keeps them for the platform behind this site, and we delete them after 30 days. For the website itself we collect no access logs of our own; if we turn them on they will be stored in the Paris region and deleted on the same 30-day rule, and this page will say so. Legal basis: our legitimate interest in keeping the service secure, available and working.

The scope check

You can complete the scope check and read the result without giving any personal data. Your answers are processed in your browser and, when you submit them, on our server to compute the result. If you do not give an email address, we store the answers and the result without any identifier that links them to you, for product improvement.

If you enter an email address (to receive the PDF summary, to book a call, or both), we store the address, the company name if given, the answers and the result as a lead. We use them to send the PDF, to follow up once about the result and to prepare and run the call if you book one. Giving the address is also what opens the booking calendar on that page when booking is open; see "Contact, booking and referral forms" for what reaches Zoho. Legal basis: steps taken at your request before a contract, and our legitimate interest in answering an enquiry. Retention: 30 days after the last contact from you, unless you become a customer, in which case the engagement record takes over.

Contact, booking and referral forms

The contact form asks for your name, email, company and message. The distributor referral form asks for the same, plus the supplier's company name, website and country. The forms are ours, not a third party's: what you type goes to our own server in Paris and the lead is then copied to Brevo, our French email and CRM service. We also store the language you were reading in, the consent you gave, and two timestamps that help us tell a person from a spam robot. We use all of it to answer you, to prepare and run the call and to send you what you asked for. Legal basis: steps taken at your request before a contract. Retention: 30 days after the last contact, unless you become a customer.

Bookings are handled by Zoho Bookings, and the call itself is held on Zoho Meeting. Both are services of Zoho Corporation B.V., which is established in the Netherlands and keeps our account on Zoho's European data centre, under Zoho's Data Processing Addendum, which covers every Zoho application rather than any one of them and which Zoho provides on request to legal@zohocorp.com. Zoho's group company in India is named on Zoho's own published list as able to reach data held for us there, for support and engineering work, under the safeguards in that agreement.

The booking page loads only at the end of the scope check, after you submit the email step, and we say so on that step before you submit it; there is no booking page on the contact page. From that moment your browser is connected to Zoho, which receives your IP address and the email you have just given, whether or not you go on to pick a time. If you never submit that step, nothing reaches Zoho, and reading your result never requires it. If you do pick a time, Zoho also receives the name you type on its page, the time you choose and your answer to the one question it asks.

We show Zoho's booking page in a plain frame and run no Zoho script of our own, so the cookies it needs — zalb (a load balancer cookie), zccpn, JSESSIONID and cli_rgn — are set by Zoho inside that frame and none is set by us. One thing worth naming plainly: although the booking page is at a European address, it loads its scripts and styling from static.zohocdn.com, a .com name on Zoho's own delivery network, which answers from Europe; what comes back from it is files that make the page look right, not your booking.

A confirmed booking stays with Zoho: it is held in our Zoho account, and the confirmation carries a Zoho Meeting link. You join that call in your browser, without an account or an installation, and Zoho Meeting receives the name you enter, your IP address, the connection data a video call needs and, while the call runs, your voice and, if you switch it on, your camera image. We do not record calls. No other company holds your booking or your call.

Zoho keeps the booking record, and Zoho Meeting's record of the call — who joined and when — in our account. We delete them on the same rule as the rest of the lead data — 30 days after the last contact, unless you become a customer.

For a period in September 2026 a Google calendar sat behind the booking page. The booking page was first published here at 12:57 UTC on 11 September 2026. From then until we disconnected it, before this version of the notice was published, a confirmed booking was also written into a Google calendar, with the call held on Google Meet. We removed it because the account behind it was an ordinary personal account on our own domain, not a business subscription, so Google did not hold a booking for us under an agreement made on your behalf: it decided for itself what to do with it, and that includes Google's company in the United States and the support firms Google uses. That is not an arrangement we are willing to put a visitor into. If you booked a call while it was connected, write to dpo@daskalos-apps.com. We will tell you exactly what we hold and what went to Google, delete what is ours, remove the entry from that calendar, and confirm to you that it is gone.

If you book a call, we may send a short series of follow-up emails related to the subject of the call. Every email has an unsubscribe link. In countries where business email requires prior consent, we ask for it before sending anything beyond the answer to your request.

Newsletter

If you subscribe on a blog post, we store your email address, and the post you subscribed from, as a lead on our platform and in Brevo, the French email service that sends the newsletter, and we send you one email a month about the Cyber Resilience Act. Legal basis: your consent, which you can withdraw at any time with the unsubscribe link in every email or by writing to dpo@daskalos-apps.com. Retention: 30 days after the last contact, as above. When you unsubscribe we stop sending, and we add your company's email domain — the part after the @ — to a do-not-contact list that we check before any contact, so nobody else at your company is contacted either. If your address is a personal one at a public mail provider, such as gmail.com or outlook.com, we add the address itself instead, so the rest of that provider's users are not affected. The list holds that domain or address and nothing else, and we keep it indefinitely because its only purpose is to stop us contacting you. Write to dpo@daskalos-apps.com if you want your record deleted straight away. We do not use the newsletter list for any other purpose.

Prospect data notice

We identify companies that may need our services from public sources and licensed data: company registers and open company data, public app store listings, public source-code hosting, EU project and public procurement databases, published exhibitor and association lists where their terms allow it, and job-posting data. One source is not public: our own customers and distributors refer suppliers of theirs to us. When we first write to a company that reached us that way, we say who referred it. From these we build a record at the level of the company: name, web domain, country, activity code, size band, public evidence of the products it makes, and a score with the reasons for it. We record general or role mailboxes (such as info@ or security@) where they are published. We do not record the names, roles or contact details of individuals, we do not use professional social networks as a source, and we never send scan results or security findings unsolicited.

We contact companies on this list by the channels permitted in their country for business-to-business prospecting, with an opt-out in every message. Legal basis: our legitimate interest in offering services to businesses that appear to need them.

Your right to be suppressed. If you do not want your company contacted, write to dpo@daskalos-apps.com with the company domain. We add it to a suppression list that is checked before every contact and every push to our CRM, and the record is not contacted again. Prospect records that have had no activity for 12 months are deleted automatically.

Customer materials and the portal

When you become a customer, the source code, SBOMs, documentation and other materials you give us may contain personal data (names and email addresses of your engineers in commit metadata, for example). For that data we act as processor on your behalf under the data processing agreement annexed to our services agreement. We process it only to perform the services, on EU-hosted infrastructure, with access limited to the engineers working on your engagement, and we delete customer materials 30 days after the end of the engagement except evidence you ask us to keep and records we must retain by law.

Portal accounts use your business email address for magic-link login. Every action in the portal is written to an audit log. If you ask us to erase your account we anonymise it rather than delete it — the address becomes an unusable placeholder, the name is dropped and the account is switched off — and we keep the audit log, because it is the proof that a named engineer signed each of your deliverables. Article 17(3)(b) and (e) of the GDPR is the ground for keeping it: we need it to establish a legal claim and to meet an obligation the law puts on us.

We do not use customer materials to train, fine-tune or evaluate machine-learning models. We send material to a model provider only where its terms say that inputs and outputs are not used to train its models and the processing happens in an EU region — and that connection is switched off today. How we use AI sets out which steps use a model, what a named engineer decides, and where the model runs.

Billing

For invoicing we process your company's billing details and, for card payments, the data handled by Stripe, our payment provider; we do not see or store card numbers. Stripe contracts with us through Stripe Payments Europe, Ltd. in Ireland and transfers some of that data to the United States for payment processing and fraud checks, under its own data processing agreement and the European Commission's standard contractual clauses. Contracts are signed electronically through Yousign. Our accountant sees the invoices and the billing records, because French law requires our accounts to be kept and filed. Accounting records are kept for the period required by French law.

Sub-processors

Amazon Web Services EMEA SARL (this website, Paris region; outgoing email from an EU region); Scaleway SAS (the platform and the database, France); Brevo (forms and CRM, France); Zoho Corporation B.V. (call booking and the video call; the Netherlands, on Zoho's European data centre, with support access from its group company in India); Stripe Payments Europe, Ltd. (payments; Ireland, with a transfer to the United States as described under "Billing"); Yousign (electronic signature, France); Anthropic, for large language models, reached through Amazon Web Services (Bedrock) with processing in the European Union — a connection that is authorised here but switched off today, as how we use AI explains. There is no group, no subsidiary and no affiliated entity: DASKALOS APPS SAS is the only company involved, and the work is done by its own people. We give customers 30 days' notice of any change. This list is the published sub-processor list our data processing agreement refers to: it is the one a customer authorises when it signs, and the signed version repeats it as a schedule.

Two names appear in older versions of this list and are not on it now, and they are not the same case. Calendly LLC was the booking service this site was first written against; no account was ever opened and nothing was ever connected to it. Google went a step further: a personal Google calendar was connected behind the booking page from 11 September 2026 until we disconnected it, so a booking made in that period went into it. Why Google is gone for good, and what to do if you booked in that period, is under "Contact, booking and referral forms".

Three things leave the EU, and we would rather name them than gesture at them. One: this site is delivered from Amazon's edge locations all over the world, so a page you read, and the form you send us, pass through the one nearest you — see "Visiting the site". Two: Stripe transfers billing data to the United States for payment processing and fraud checks — see "Billing". Three: Zoho's group company in India can reach booking and call data for support and engineering work, under the safeguards in Zoho's data processing addendum. Older versions of this page named a fourth, through a Google calendar and onward to the United States. That connection has been removed — see "Contact, booking and referral forms". Nothing else leaves the EU or EEA — and in particular no customer code, no evidence and no scan result ever leaves it at all: they are processed on our own machine in France and on our servers in Paris, and they are never part of a booking, a payment or a page on this site.

Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, to portability where it applies, and to withdraw consent where consent is the basis. Write to dpo@daskalos-apps.com. You may also lodge a complaint with the CNIL, the French supervisory authority, or with the authority of your own country.

Changes

We update this notice when our processing changes. The date at the top of the page is the date of the current version.