Privacy notice

Who is responsible

DASKALOS APPS SAS, [FULL ADDRESS], Péronnas, France, RCS Bourg-en-Bresse 928 998 715, is the controller for the data described on this page, except where we act as processor for a customer (see "Customer materials and the portal" below).

Data protection contact: [DPO OR PRIVACY CONTACT EMAIL]. You can also write to the registered office.

Visiting the site

We measure site traffic with Plausible Analytics, a European service that sets no cookies and collects no personal data we could use to identify you. Page views are counted in aggregate by country, referrer, browser type and language. There is no cookie banner because there is nothing to consent to.

Our hosting provider, Scaleway SAS in Paris, keeps standard server logs (IP address, time, page requested) for security and troubleshooting. [SERVER LOG RETENTION TO CONFIRM]

The scope check

You can complete the scope check and read the result without giving any personal data. Your answers are processed in your browser and, when you submit them, on our server to compute the result. If you do not give an email address, we store the answers and the result without any identifier that links them to you, for product improvement.

If you enter an email address (to receive the PDF summary), we store the address, the company name if given, the answers and the result as a lead. We use them to send the PDF, to follow up once about the result and, if you ask for it, to book a call. Legal basis: steps taken at your request before a contract, and our legitimate interest in answering an enquiry. Retention: [LEAD RETENTION PERIOD TO CONFIRM] after the last contact from you.

Contact, booking and referral forms

The contact form, the scoping-call booking and the distributor referral form ask for your name, email, company, country and message (and, for referrals, the supplier's company details). Forms are provided by Brevo, a French email and CRM service; bookings by cal.com. We use the data to answer you, to prepare and run the call and to send you what you asked for. Legal basis: steps taken at your request before a contract. Retention: [LEAD RETENTION PERIOD TO CONFIRM] after the last contact.

If you book a call, we may send a short series of follow-up emails related to the subject of the call. Every email has an unsubscribe link. In countries where business email requires prior consent, we ask for it before sending anything beyond the answer to your request.

Prospect data notice

We identify companies that may need our services from public sources and licensed data: company registers and open company data, public app store listings, public source-code hosting, EU project and public procurement databases, published exhibitor and association lists where their terms allow it, and job-posting data. From these we build a record at the level of the company: name, web domain, country, activity code, size band, public evidence of the products it makes, and a score with the reasons for it. We record general or role mailboxes (such as info@ or security@) where they are published. We do not record the names, roles or contact details of individuals, we do not use professional social networks as a source, and we never send scan results or security findings unsolicited.

We contact companies on this list by the channels permitted in their country for business-to-business prospecting, with an opt-out in every message. Legal basis: our legitimate interest in offering services to businesses that appear to need them.

Your right to be suppressed. If you do not want your company contacted, write to [DPO OR PRIVACY CONTACT EMAIL] with the company domain. We add it to a suppression list that is checked before every contact and every push to our CRM, and the record is not contacted again. Prospect records that have had no activity for 12 months are deleted automatically.

Customer materials and the portal

When you become a customer, the source code, SBOMs, documentation and other materials you give us may contain personal data (names and email addresses of your engineers in commit metadata, for example). For that data we act as processor on your behalf under the data processing agreement annexed to our services agreement. We process it only to perform the services, on EU-hosted infrastructure, with access limited to the engineers working on your engagement, and we delete customer materials 30 days after the end of the engagement except evidence you ask us to keep and records we must retain by law.

Portal accounts use your business email address for magic-link login. We keep an audit log of actions in the portal for the life of your account plus [AUDIT LOG RETENTION TO CONFIRM].

We do not use customer materials to train, fine-tune or evaluate machine-learning models, and we contract with our AI model providers on terms under which materials we send them are not used to train their models. How we use AI sets out which steps use a model, what a named engineer decides, and where the model runs.

Billing

For invoicing we process your company's billing details and, for card payments, the data handled by Stripe, our payment provider; we do not see or store card numbers. Contracts are signed electronically through Yousign. Accounting records are kept for the period required by French law.

Sub-processors

Scaleway SAS (hosting, France); Brevo (forms, email and CRM, France); cal.com (booking); Stripe (payments); Yousign (electronic signature, France); [AI MODEL PROVIDER AND EU REGION]; our affiliated entity in Greece for delivery [ENTITY NAME TO CONFIRM]. We give customers 30 days' notice of any change. Data is not transferred outside the EU or EEA without appropriate safeguards.

Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, to portability where it applies, and to withdraw consent where consent is the basis. Write to [DPO OR PRIVACY CONTACT EMAIL]. You may also lodge a complaint with the CNIL, the French supervisory authority, or with the authority of your own country.

Changes

We update this notice when our processing changes. The date at the top of the page is the date of the current version.