Privacy policy

Who is responsible

The controller of your personal data is [TO CONFIRM: registered company name], [TO CONFIRM: registered address]. You can reach us at [TO CONFIRM: privacy contact email] or through the contact page.

Data we process

Account: your email address, password hash, two-factor authentication factors and sign-in times, and optionally a display name; your organization membership, role and seat. For Exona staff, their back-office staff role.

Devices: for each installation of the desktop app, a random identifier generated by the app, a label you can edit, the operating system, the app version and when it was last seen, plus the device's sign-in credential and the one-time codes of desktop sign-in, both stored only as one-way hashes. We never collect MAC addresses, serial numbers or other hardware identifiers.

Licenses: the signed license leases issued to your devices. Usage metrics: totals derived from license renewals and downloads, with no per-user analytics events and never any dataset content. Demo and contact requests: your name, email, organization, the topic of your request, your message, the time you gave consent and the time the request was sent on to our team.

Security records: an audit log of actions that holds account ids only, never emails or names, and short-lived rate-limit keys stored as one-way hashes. Our code stores no IP addresses.

What the desktop app never sends

Your analysis runs on your computer or on a server you choose. The license checks of the desktop app never send dataset content or dataset metadata to Exona, and the app sends no usage telemetry.

Why we process it

We process account, device and license data to provide the service your organization has contracted (performance of a contract). We keep the audit log and rate-limit keys to protect the service (legitimate interest). We use demo and contact requests to answer you, based on your consent, which you can withdraw at any time.

How long we keep it

Account data is kept until the account is deleted, membership until you leave the organization, and a staff role until it is removed; an account with no organization is deleted after 90 days. Invitations are deleted 30 days after they are accepted or expire.

Devices are deleted when removed or 12 months after they were last seen, with their sign-in credential; desktop one-time codes expire after 60 seconds and are purged soon after; license leases are deleted 90 days after they expire. The audit log is kept for 24 months and rate-limit keys for at most 24 hours. Demo and contact requests are kept for 24 months after the request, or deleted earlier on request. The copy of each request in the Exona team's inbox is kept for [TO CONFIRM: team inbox retention period] and is deleted with the request.

Invoices and other commercial records are kept for the statutory period [TO CONFIRM: statutory retention period]. Backups are kept for 30 days, so deleted data also leaves our backups within 30 days.

Where the data is stored and who processes it

We use these providers (processors), each under a data processing agreement: Supabase for the database and sign-in, in its EU region; S3-compatible file storage in the EU; an email provider able to process data in the EU, for account emails and to send each demo or contact request to the Exona team's inbox, which keeps the content of those messages under its own retention; [TO CONFIRM: team mailbox provider] for the Exona team's inbox; and [TO CONFIRM: hosting provider] for hosting in the EU. These providers may keep technical logs that include IP addresses, under their own retention periods.

If we enable website analytics, we use a cookieless service ([TO CONFIRM: Plausible or Umami], hosted in the EU) that sets no cookies and stores no personal data.

Your rights

You can access your data and receive a copy in a machine-readable format, have it corrected or deleted, restrict or object to its processing, and withdraw your consent. Account deletion removes or pseudonymizes everything you own within 30 days; audit records then keep only an id that no longer points to you. A demo or contact request is not part of an account: ask us through the contact page or the privacy email to receive or delete it, and we also delete its copy in our team's inbox.

To exercise a right, ask us through the contact page or at [TO CONFIRM: privacy contact email]. We check that the request comes from the person the data is about before sharing or deleting anything, and answer within one month, as the GDPR requires.

You can also complain to a data protection supervisory authority: [TO CONFIRM: competent supervisory authority].

Cookies

We use only the essential cookies that keep you signed in. The cookie notice lists them.

Data Processing Agreement

For customer organizations, a Data Processing Agreement (DPA) is available on request. Ask for it through the contact page.

Changes to this policy

We publish every change on this page with a new date, and tell account holders about important changes by email.