Pricevra1. Controller
Pricevra ("we"), Résidence de Gaulle, Douala, Cameroon — publisher identified in the Legal notice — contact: [email protected]. The GDPR applies because the Service targets EU customers (Art. 3.2). EU representative (Art. 27): [TO COMPLETE: name and address]. No DPO is appointed (not mandatory).
2. Data, purposes and legal bases
- Account data (name, email, company, optional company/VAT number, role, hashed password, encrypted 2FA, Google identity) — account and authentication — contract (Art. 6.1.b).
- Products, competitor URLs, collected prices, alerts, Autopilot simulations — providing the service — contract.
- IP address, browser, device identifier, security logs, trial anti-abuse fingerprints (HMAC) — security and fraud prevention — legitimate interest (Art. 6.1.f).
- Plan, subscription status, payment references and amounts (never card numbers) — billing — contract; legal obligation.
- Alert channels (email, Telegram chat id, browser push) — alerts — contract.
- Business or Individual status, withdrawal requests and acknowledgements — applying the rules for each status (prices, withdrawal right) — contract; legal obligation.
- Marketing consent (unticked by default) — marketing — consent, withdrawable.
Monitored pages are public product pages; the Service is not meant to collect third-party personal data. We do not sell your data and no advertising or analytics tool is built into the Service.
3. Recipients and processors
| Provider | Purpose | Data | Country |
|---|---|---|---|
| Server host | Hosting the application and database | All service data | [À COMPLÉTER : hébergeur et pays du serveur] |
| Email server (SMTP)when configured (SMTP_HOST) | Sending emails | Email address, message content | [À COMPLÉTER : prestataire SMTP] |
| Cloudflare | Admin-area access control; encrypted off-server backups (R2) | Admin identity; encrypted database backups | United States |
| Resendwhen configured (RESEND_API_KEY) | Sending emails (when configured) | Email address, message content | United States |
| Brevowhen configured (BREVO_SMS_API_KEY) | Sending alert SMS; sending emails if Brevo is the chosen SMTP relay (when configured) | Phone number, email, message content | France |
| Twiliowhen configured (TWILIO_ACCOUNT_SID) | Alert SMS and WhatsApp (when configured) | Phone number, alert text | United States |
| Meta (WhatsApp Business)when configured (META_WHATSAPP_TOKEN) | WhatsApp alerts (when configured) | Phone number, alert text | United States |
| Telegramwhen configured (TELEGRAM_BOT_TOKEN) | Telegram alerts (if you enable this channel) | Chat id, alert text | United Arab Emirates |
| Googlewhen configured (GOOGLE_CLIENT_ID) | “Continue with Google” (if you use it) | Name, email, Google id | United States |
| Services de notification des navigateurswhen configured (VAPID_PRIVATE_KEY) | Browser notifications (if you enable them) | Encrypted subscription endpoint, alert text | Depends on the browser |
| Stripewhen configured (STRIPE_TRIAL_ENABLED) | Card payment and subscription (when enabled); Stripe is also a controller for fraud prevention and its legal obligations | Email, customer reference, amount (no card number at Pricevra) | United States |
| CinetPaywhen configured (CINETPAY_API_KEY) | XAF payment (when configured) | Name, email, phone, amount | Côte d'Ivoire |
| Flutterwavewhen configured (FLW_SECRET_KEY) | Payment (when configured) | Name, email, amount | United States |
| Google (Custom Search)when configured (GOOGLE_CSE_KEY) | Finding competitor pages (when configured) | Searched product names (no personal data intended) | United States |
Slack, Discord, Teams and webhook channels send the alert to the address you provide: they are your recipients, not our processors.
Each processor must be bound by commitments complying with Art. 28 GDPR (providers' data processing agreements).
4. Transfers outside the EU
Server country: [TO COMPLETE: host server country]. Data is accessed from Cameroon, where Pricevra is operated (no EU adequacy decision; access limited to the publisher and encrypted; safeguards: [TO COMPLETE: Art. 46 safeguards]). Transfers to the other countries in the table above: EU–US Data Privacy Framework, standard contractual clauses or contractual necessity (Art. 49.1.b), to be confirmed provider by provider. Copy of safeguards on request.
5. Retention
- Account and service data: for the life of the account; after a deletion request, 14-day grace period then automatic purge.
- Sessions: expire after 3 days idle or 30 days max; purged 30 days after expiry or revocation.
- Tokens (email verification, reset): purged 30 days after expiry.
- Security logs (sign-ins, two-factor authentication, email changes, exports): 12 months, then deleted automatically every day; IP address and browser erased as soon as the account is purged.
- Trial anti-abuse fingerprints (hashed values, no plain data): 24 months, then deleted automatically, including after the account purge.
- Inactive accounts: [TO COMPLETE: no automatic deletion for inactivity yet].
- Accounting records and invoices: 10 years (French Commercial Code, art. L123-22); invoices are issued and kept by the payment provider. When an account is deleted, Pricevra keeps a minimal copy of collected payments for 10 years, without name or e-mail (reference, plan, amount, currency, dates), then deletes it.
- Encrypted off-server backups: 35 rolling days, then one per week for 8 weeks and one per month for 12 months; deleted data may therefore remain in a backup for up to 12 months, without being accessed.
6. Your rights
You can exercise your rights at any time by writing to [email protected] (subject “Personal data”). We answer within one month of receipt, extendable by two months for a complex request, in which case we tell you within the first month (Art. 12.3 GDPR). We may ask you to prove your identity. Exercising your rights is free.
| Right | What you get | How to exercise it |
|---|---|---|
| Access (Art. 15) | A copy of your data | Yourself: Settings → My profile → Export my data (ZIP); or email [email protected], subject “Personal data” |
| Rectification (Art. 16) | Correction of inaccurate data | Yourself in Settings → My profile (name, email, company); otherwise by email |
| Erasure (Art. 17) | Deletion of your data | Yourself: Settings → My profile → Delete my account (purged after 14 days, see Deletion); or by email |
| Portability (Art. 20) | Your data in a structured, machine-readable format | Yourself: Export my data (ZIP), a JSON archive (account, active organisation, products, readings, alerts; billing depending on your role); passwords and secrets never included |
| Objection (Art. 21) | Stopping processing based on legitimate interest, unless compelling grounds | By email; marketing consent can be withdrawn at any time |
| Restriction (Art. 18) | Temporarily freezing a processing | By email |
You may also withdraw consent at any time and give instructions about your data after your death. You may complain to the CNIL (www.cnil.fr) or your EU supervisory authority.
7. Cookies
Strictly necessary cookies only (session, CSRF protection, language, appearance, device security). See the Cookie notice.
8. Security and breaches
HTTPS, hashed passwords and tokens, 2FA, per-organisation isolation, encrypted backups. Breaches are notified to the authority within 72 hours and to affected people if the risk is high.
9. Changes
Any significant change is notified by email or in the app; the version is shown at the top.
Changelog
- — Appearance cookie (pv_theme) added to the necessary-cookie list.
- — Payment methods updated: card payment through Stripe; monthly subscription that renews automatically.
- — Revision 41: plain-language summary, table of contents, changelog, print version; unproven promises removed.
- — Sub-processor table built from the code; detailed GDPR rights section; retention periods aligned with the code.
- — Publisher details (address, phone, publication director).
- — Opened to individuals (withdrawal, conformity guarantee, prices excl. VAT, mediator).
- — First version of the legal pages (draft).