Draft version
Privacy policy
This document will be reviewed by legal counsel before commercial launch.
Data controller
The controller of the personal data described in this policy is OPTINOC, SASU, 10 allée Louis Breguet, 94310 Orly, France, which designs and builds vApp. For any question about your data, or to exercise your rights, write to info@optinoc.com.
Data we process
We only process the data needed to provide the service: (1) account data: name, email address and, if you provide it, your company name; (2) license data: the licenses, seats and activations linked to your account. Activating a license requires a customer account and an internet connection; vApp’s activation server then records the license identifier, the Mac identifier and the activation date; (3) orders and invoices; (4) payment data, handled directly by Stripe (Stripe Payments Europe, Ltd., Ireland), our payment processor (OPTINOC does not store card numbers); (5) messages sent through the contact form: name, email address, optional company, topic and message; (6) technical or crash reports, only if you choose to send them; (7) data related to the update check: IP address and app version.
What vApp does not collect
vApp runs locally on your Mac. The content of your virtual machines and what is on your screens stay on your Mac and are never collected by OPTINOC. Apart from license activation, the update check and any crash reports you choose to send, vApp does not transmit any data. The AI-agent server built into vApp runs only locally on your Mac.
Purposes and legal bases
(1) Performance of the contract: creating and managing your account, supplying and managing licenses (recording and checking activations), the free trial and technical support; (2) legal obligation: issuing and keeping invoices; (3) legitimate interest: security of the website and accounts, the update check, and replying to messages sent through the contact form; (4) consent: optional technical reports, which you can stop sending at any time.
Update check
To let you know about new versions, vApp contacts an update server. This request necessarily includes your IP address and the installed app version. It contains no data about your virtual machines or files. Retention period for the related logs: [to be completed].
Cookies
The website and customer account only use cookies that are strictly necessary for them to work, in particular to keep you signed in. These cookies do not require your consent. No advertising cookies are used. Audience measurement tool, if any: [to be completed].
Retention periods
Proposed periods: account data, for as long as the account is active and then 3 years after the last activity; invoices, 10 years as required by the French Commercial Code; messages received through the contact form, 3 years after the last exchange; technical reports, 12 months; license activation data (license identifier, Mac identifier, activation date), for the duration of the license and then for the applicable statutory limitation periods. At the end of these periods, data is deleted or anonymized.
Recipients
Your data can only be accessed by authorized OPTINOC staff and, to the extent needed for their tasks, by our service providers: the hosting provider for the website and customer accounts ([to be completed]) and Stripe Payments Europe, Ltd. (Ireland), our payment processor, for payment data only (see Stripe’s privacy policy: https://stripe.com/privacy). These providers act on our instructions or under their own regulatory obligations. We do not sell or rent your data.
Transfers outside the European Union
Payment data may be transferred outside the European Union within the Stripe group, in particular to Stripe, Inc. in the United States. These transfers are covered by the EU–U.S. Data Privacy Framework and/or the European Commission’s standard contractual clauses; see Stripe’s privacy policy (https://stripe.com/privacy). OPTINOC itself makes no other transfer of data outside the European Union.
Security
OPTINOC applies appropriate technical and organizational measures to protect your data against loss, unauthorized access, alteration or disclosure, including encrypted connections, access restricted to authorized personnel, and the use of service providers offering sufficient guarantees.
Your rights
Under the GDPR and the French Data Protection Act, you have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability, as well as the right to give instructions on what happens to your data after your death. Where processing is based on your consent, you can withdraw it at any time. To exercise these rights, write to info@optinoc.com; we may ask for proof of identity if we have reasonable doubts. You can also lodge a complaint with the CNIL, the French data protection authority, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr).
Changes to this policy
We may update this policy, in particular when vApp or the applicable regulations change. The version in force is the one published on this page.
