Privacy Policy
What personal data Notiamo handles, why, for how long, who helps us, and the rights you have. We collect as little as we can, and we never sell data or use it for advertising.
1. Who is responsible
Veziro SASU, 15 Chemin du Tanit, Rés. Mas de Tanit, Bât. TYR 402, 06160 Antibes, France, R.C.S. Antibes 900 603 952 (“we”). Contact for all privacy questions: [email protected].
- We are the controller for the data of our customers’ accounts, workspace requests, billing, support, and visitors of www.notiamo.com.
- We are a processor for the content our customers and their clients put into Notiamo (comments, replies, photos, screenshots, documents, the names and emails of invited people). For that data, the agency or company that owns the workspace is the controller, and our Data Processing Agreement applies. If you are a client of an agency, please contact that agency first.
2. What data we handle and why
| Data | Why | Legal basis |
|---|---|---|
| Workspace request: email, name, agency name, website, language, IP address, date of acceptance of the terms | Review the request, prevent abuse, prove the acceptance of the terms | Steps before a contract; legitimate interest (fraud prevention) |
| Account: email, name, language, theme, workspace and role, login times | Provide the service and log you in | Contract |
| Content in workspaces (comments, files, page addresses, screen size and browser of the person who commented) | Provide the service on behalf of the workspace owner | Contract (as processor) |
| Billing: plan, subscription status, Stripe customer reference | Manage the subscription | Contract; legal obligation (accounting) |
| Technical logs: IP address, time, request, errors | Security, rate limits, troubleshooting | Legitimate interest |
| Early-access list on www.notiamo.com: email, agency name (optional), language | Tell you when early access opens | Consent (you can withdraw it at any time) |
| Emails you send us | Answer you | Legitimate interest; contract |
We do not use your data to train AI models, and we do not make automated decisions that have legal effects on you. Workspace requests are reviewed by a person.
3. How long we keep it
- Account and workspace data: as long as the workspace exists. After a workspace is closed: 30 days for an export, then deleted; backups are overwritten within 14 more days.
- Deleted comments and replies: hidden at once, deleted for good after 30 days.
- Uploads never attached to a comment: deleted after 1 day.
- Login links: valid 15 minutes. Expired widget logins and invites: deleted after 30 days.
- Workspace requests: until they are handled; refused or unconfirmed requests are deleted by an administrator. Approved requests are kept with the account.
- Billing records: 10 years, as French accounting law requires (Stripe keeps its own records as merchant of record).
- Technical logs: at most 30 days.
- Early-access list: until launch or until you unsubscribe.
4. Who helps us (sub-processors)
| Provider | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Servers, database, file storage, backups | Germany (EU) |
| Wise Cloud SASU | Sending and receiving email | France; servers in Romania (EU) |
| Cloudflare, Inc. | DNS, network protection, bot check (Turnstile) | Global network; USA |
| Stripe | Payments, invoices and taxes, as merchant of record | EU and USA |
| Form2X | Early-access form on www.notiamo.com | EU |
Each provider only gets the data it needs for its role and is bound by a contract. When data goes outside the European Union (Cloudflare, Stripe), the transfer relies on the EU–US Data Privacy Framework and/or the European Commission’s standard contractual clauses. Stripe is an independent controller for the payment data it collects at checkout; see Stripe’s privacy policy.
5. Cookies and similar storage
We only use what the service needs to work. No advertising or tracking cookies, no analytics that follow you.
| Name | Where | Purpose | Duration |
|---|---|---|---|
Login session cookies (better-auth.*) | my.notiamo.com | Keep you logged in | Session, up to 7 days |
NOTIAMO_LOCALE | my.notiamo.com | Remember your language | 1 year |
theme | my.notiamo.com | Remember light or dark mode | 1 year |
| Local storage | www.notiamo.com, and websites where the Notiamo widget is installed | Remember your language, dark mode, and whether you opened the review tools | Until you clear it |
| Cloudflare Turnstile | Login, sign-up and early-access forms | Check that you are a person, not a bot | Single use |
Because these are strictly necessary, they do not require consent under French and EU rules.
6. Security
Data is encrypted in transit (HTTPS). We log in with single-use email links instead of passwords, limit login attempts, keep each workspace’s data separate, restrict server access, and back up the database every day. If a breach puts your data at risk, we inform you and the authorities as the law requires.
7. Your rights
You can ask to access, correct, delete or export your data, to limit how we use it, or to object to its use based on legitimate interest. You can withdraw consent at any time. You can also give instructions about what happens to your data after your death. Write to [email protected]; we answer within one month. We may ask you to prove your identity.
If you think we did not respect your rights, you can complain to the CNIL, the French data protection authority: cnil.fr, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.
8. Changes
We update this policy when our practices change. The date at the top shows the current version. For important changes, we inform account holders by email.