Privacy policy
Provisional text, pending legal review. It is not the final version.
Who we are
The service is published by Stéphane T., on behalf of Scaliamo, a société par actions simplifiée unipersonnelle (SASU) being formed, future subsidiary of upto9. Its details are given in the legal notice. The service brings together several tools for online software publishers, such as Gradiamo for measuring NPS, Proofiamo for customer reviews and Referiamo for referral programmes.
This policy explains which personal data we process, why, for how long, and how to exercise your rights.
Two different roles
Scaliamo is the controller of the data described below: visitors to our websites, waitlist subscribers, people who write to us, users of the accounts and billing data.
Scaliamo is a processor of the data its customers entrust to it: their contacts, the respondents to their surveys, their referrers, their referees and the authors of testimonials. In that case, our customer decides how your data is used. See the section "You received a survey or a request from one of our customers".
Website visitors
Our showcase websites (for example gradiamo.com) measure their audience with Matomo, which we host ourselves. No measurement data is passed on to a third party.
- Data: pages viewed, date and time, browser and device type, referring website, IP address (anonymisation to be configured, to be checked).
- Purpose: measure the traffic of the websites and improve their content.
- Legal basis: our legitimate interest.
- Retention period: to be defined in the Matomo configuration.
To limit abuse, the IP address of visitors is also used temporarily to count signup attempts (rate limiting).
Waitlist
You can sign up on our websites to be told when a tool launches.
- Data: e-mail address, language, website of the signup, proof of your consent (date and text displayed at the time of the signup).
- Purpose: inform you of the launch and of the opening of the service.
- Legal basis: your consent, given by ticking a box that is not ticked by default.
- Access: only the Scaliamo team, through an internal tool protected by two-factor authentication.
- Retention period: not set to date (proposal to be validated: until the launch, then a short period to be defined).
You can withdraw your consent and ask for your signup to be deleted at any time, by writing to us (see "Your rights"). No confirmation e-mail (double opt-in) is sent at signup yet.
Contact form
When you write to us through the contact form:
- Data: name, e-mail address, company (optional), content of your message.
- Purpose: answer your request and follow it up.
- Legal basis: our legitimate interest in answering requests, or pre-contractual measures taken at your request.
- Retention period: 12 months after the last exchange (default value, to be validated).
Users of the accounts
When you use the application as a user of a customer account:
- Data: name, e-mail address, password (stored in protected form), two-factor authentication factors, identifier provided by Google, Microsoft or your company's single sign-on provider, language, role in the account, actions recorded in the audit log with the IP address, exchanges with support.
- Purposes: create and secure your access, provide the service, send you the necessary e-mails (verification, alerts, invoices), ensure the security and traceability of actions, answer your support requests.
- Legal basis: the performance of the contract concluded with your employer or customer, and our legitimate interest in security.
- Retention period: for as long as your access exists, then a period to be defined. The audit log is kept 3 years. Technical logs are kept 12 months.
Support never has access to the data of your account. To help you, it asks you to share your screen. Messages sent to support may be translated and prepared with the help of an artificial intelligence service located in the European Union (anonymisation to be checked).
Billing
When your company subscribes to a paid plan:
- Data: company name, country, billing e-mail address, SIREN or VAT number, history of invoices and payments. Card and direct debit data are processed by our payment provider; we do not store them (to be checked).
- Purposes: invoice, collect payments, calculate taxes, issue electronic invoices, keep our accounts.
- Legal basis: the performance of the contract and our legal obligations (accounting and tax).
- Retention period: for the duration of the business relationship, then the legal retention period of accounting records (10 years, to be checked).
Cookies
Our showcase websites set no audience measurement cookie and no session cookie. Two cookies are set only when you make a choice: "site_language" remembers the language you choose (it only holds a language code and lasts 12 months); "mtm_consent_removed" remembers your objection to audience measurement, if you make it (its lifetime is set by Matomo and your browser may shorten it). A password-protected page also sets a session cookie, on that website only, once the password has been entered.
The application sets a session cookie, needed to sign you in.
The widget our customers install in their application sets no cookie and writes nothing in the browser.
Recipients
Your data is accessible to the Scaliamo team members who need it, and to our subprocessors, within the limits of their task. The list of our subprocessors, their services and their location are published on the subprocessors page (in French).
We do not sell your data. We do not use it for targeted advertising.
Hosting and transfers
Our data is hosted in France by Scaleway, as are its backups. During a transition period, the Scaleway subscription is held on our behalf by the company Five Two Ten (see the subprocessors page, in French).
Some providers may transfer data outside the European Union, in particular our payment provider and our error tracking tool (to be checked). These transfers are then covered by an adequacy decision of the European Commission or by standard contractual clauses.
Security
We protect your data with appropriate measures: hosting in France, two-factor authentication, isolation of each customer's data, encryption of communications, secrets and backups, audit log, no real data in our test environments.
Deleted data may remain in our encrypted backups until they expire. The retention period of backups is not set yet.
You received a survey or a request from one of our customers
If you received a survey, a referral invitation or a review request from a company that uses our tools, that company is the controller of your data. Scaliamo acts on its behalf, following its instructions, under a data processing agreement (in French).
To exercise your rights, contact that company first. If you write to us, we will forward your request to it.
Scaliamo will never contact you on its own behalf using this data.
Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability of your data. When the processing is based on your consent, you can withdraw it at any time. You can also set instructions on what happens to your data after your death.
To exercise these rights, write to: privacy@upto9.fr, or by post to Stéphane T., on behalf of Scaliamo, 5, square du Poitou, 76240 Le Mesnil-Esnard, France. We may ask you to prove your identity if in doubt.
No data protection officer has been appointed to date.
If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr).
Changes
We may change this policy. The date of the last update is shown at the top of the published page. In case of a significant change, the users of the accounts are informed by e-mail.