Home › Privacy
Privacy policy
What data ProcNest collects, why, for how long, who it is shared with and how to exercise your rights (GDPR).
Who is responsible?
For the website and sign-ups, the data controller is the publisher named in the legal notice. For the data your organization enters in the application (tasks, documents, comments, participant names…), your organization is the controller and ProcNest acts as a processor.
Data collected
| Situation | Data | Purpose and legal basis |
|---|---|---|
| Demo request (site form) | Name, email, company, message. The form opens your mail app: nothing reaches our servers until you send the message. | Answer your request (legitimate interest, pre-contractual steps). |
| Plan sign-up | Email, name (optional), chosen plan, language. | Set up your access and send a welcome or confirmation email (performance of the contract). |
| Team plan payment | Entered at Stripe, never on ProcNest: we neither see nor store your card number. We receive the payment status and the customer identifier. | Billing and subscription management (performance of the contract, accounting obligations). |
| Using the application | Identity provided by your Microsoft account (name, email, identifier), roles and teams, entered content, history of actions on tasks. | Provide the service to your organization (performance of the contract). |
| Technical logs | IP address, date, route called, errors. | Security and proper operation (legitimate interest). |
Cookies and local storage
The site uses no advertising cookie and no analytics tool. It only remembers your language choice in your browser’s local storage (key tribox-lang), without sending it to our servers. The application likewise remembers the language and working team you chose. Sign-in relies on Microsoft Entra ID session tokens, which are strictly necessary.
Because these items are strictly necessary, no consent banner is required.
Recipients and processors
- Microsoft Azure (Ireland, EU): hosting, database, file storage and authentication (Entra ID).
- Stripe: Team plan payment (the one month trial needs no card).
- Resend: sending of welcome and confirmation emails.
- IONOS: domain name.
We do not sell or rent your data. Some of these providers (Stripe, Resend) may process data outside the European Union: such transfers are covered by the European Commission’s standard contractual clauses or an adequacy decision.
Retention periods
- Demo request: 3 years after the last contact.
- Sign-up and account: for the duration of the subscription, then 3 years for the commercial relationship.
- Billing data: 10 years (accounting obligation).
- Application content: as long as your organization’s contract is active; deleted or returned on its request at the end of the contract. A deleted process stays in the database (soft delete) until the organization asks for it to be purged.
- Technical logs: 12 months at most.
Your rights
You can request access, rectification, erasure, restriction and portability of your data, and object to its processing. Write to the contact address given in the legal notice. If you use ProcNest through your employer, contact them first, as the controller.
If you believe your rights are not respected, you can lodge a complaint with the CNIL (cnil.fr) or your local data protection authority.
Security
Sign-in through Microsoft Entra ID (SSO), encrypted traffic (HTTPS), databases and files separated per organization, access rights by role and permission, hosting in the European Union.
Changes
This policy may change; the date of the last update is at the top of the page.