Privacy policy
This policy explains what personal data METEORA processes when you visit brandesk.io, write to us or use Brandesk, why, and how to exercise your rights.
This translation is provided for information. In case of discrepancy, the French version prevails.
1. Who is responsible for your data?
METEORA, a SARL (French limited liability company) registered with the Annecy Trade and Companies Register (RCS) under number 807 875 315, publisher of Brandesk, is the controller of the data described in this policy: website visitors, prospects, user accounts and billing.
The data of a customer company's employees (profile, signature, digital card) and of the contacts who leave their details on a card is processed by METEORA on behalf of that company, which is the controller. This processing is governed by the Data Processing Agreement (DPA). To exercise your rights over this data, please contact the company concerned first; if you write to us, we will forward your request to it.
2. Visiting the brandesk.io website
- No cookies or advertising trackers are set.
- Audience measurement: Plausible, hosted by METEORA in France. It does not set cookies and does not retain your IP address; only aggregate statistics (page views, referral source, device type, country) are retained. Legal basis: legitimate interest in measuring the website's audience.
- Technical logs: the server may temporarily record the IP address and the requested page, for security and troubleshooting purposes. Legal basis: legitimate interest in securing the website.
3. Communications with us
When you write to hello@brandesk.io (demo request, question, support), we process your name, email address, company and the content of your messages in order to reply to you. Legal basis: legitimate interest or pre-contractual measures. Retention: 3 years after our last exchange.
4. Brandesk accounts
For users of the service (administrators, managers, employees who log in), we process:
- name, business email address, organization, roles;
- authentication data: hashed password, encrypted two-factor authentication secret, or login via Google, Microsoft or your company's SSO;
- an audit log of administrative actions, with an anonymized IP address.
Purposes: providing the service, securing access, providing support. Legal basis: performance of the contract concluded with your company and legitimate interest in securing the service. Retention: for the term of the contract, then deletion no later than 60 days after it ends (including the export period).
5. Billing
Company name, billing contact, email address, invoice history. Payment is processed by Stripe; METEORA never has access to credit card numbers. Legal basis: performance of the contract and legal obligation. Retention: 10 years for accounting records.
6. Recipients
Your data is accessible only to authorized METEORA personnel and to the service providers required for the service:
| Provider | Role | Location |
|---|---|---|
| OVH SAS | Hosting of the website, the application and files | France |
| Twilio Inc. | Sending transactional emails | United States |
| Stripe | Payment and billing | European Union and United States |
The full list of sub-processors handling customer data is set out in Appendix 2 of the DPA. We do not sell or rent any personal data.
7. Transfers outside the European Union
Data is hosted in France. Where a provider processes data outside the European Union (sending emails, payment), the transfer is governed by the EU–U.S. Data Privacy Framework or by the European Commission's Standard Contractual Clauses.
8. Security
HTTPS connections, encrypted secrets, hashed passwords, two-factor authentication and SSO, isolation of each organization's data, audit log and encrypted backups. Details are set out in Appendix 1 of the DPA.
9. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, as well as the right to set instructions regarding the handling of your data after your death. Write to hello@brandesk.io; we respond within one month.
If you believe your rights have not been respected, you may lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
10. Changes
This policy may change. The date of the last update is shown at the top of the page; customers are informed by email of any material change.