Privacy policy

Data controller

For marketing website, account and billing data, the data controller is the publisher of the Service: [TO COMPLETE: legal name + address], contact@maintvision.com.

Controller vs processor: our role

Two situations must be distinguished:

• Your organization’s data in the application (assets, work orders, inventory, files, your own customers and vendors…): your organization is the data controller, and Maint Vision acts as a processor within the meaning of Article 28 GDPR — we process this data only to provide the Service, on your instructions.
• Account, billing and website data (user identity, subscription, browsing the marketing site): Maint Vision is the data controller.

Data we process

Account and authentication

Email address, name, phone (optional), password (stored only as a bcrypt hash, never in clear text), role and permissions, last sign-in date.

Application content

The data you enter in the application: assets, work orders, requests, parts, procedures, messages, attached files and photos. This content may contain personal data (for example your own vendors’ or customers’ contact details), for which you are responsible.

Billing

When you subscribe to a paid plan, payment is processed by Stripe. We keep the organization name, billing email, plan and subscription status. We never have access to card numbers.

Technical and security data

Audit logs of sensitive events (sign-ins, password resets, role and permission changes), which may include the IP address and browser (user-agent), for security and traceability.

Mobile application

If you enable notifications, a push token (Expo Push) is associated with your device. It is deleted on sign-out or when the device is no longer registered.

Purposes and legal bases

• Provide and administer the Service, manage your account and access — performance of the contract.
• Ensure security, prevent fraud and trace access (audit logs) — legitimate interest and legal obligation.
• Manage billing and meet accounting obligations — performance of the contract and legal obligation.
• Send you service emails (password reset, invitations, important notices) — performance of the contract.
• Send mobile push notifications — consent (voluntary opt-in).

Sub-processors and providers

We rely on a limited number of sub-processors, each governed by a data processing agreement (DPA):

• Neon — managed PostgreSQL database (European Union). Hosting of application data.
• Cloudflare R2 — storage of attached files and photos.
• Brevo — sending of transactional emails (reset, invitations). Receives the recipient’s email and name.
• Stripe — subscription payment and billing processing.
• Vercel — hosting of the marketing website and web interface.
• Google (Google Analytics) — marketing-site audience measurement, only after your consent; transfer outside the EU (United States) covered by the Data Privacy Framework.
• Expo — push notification delivery service (mobile app only).
• API host: [TO COMPLETE: e.g. Railway, Render].

We do not sell or rent your personal data, and we do not use it for any advertising purpose.

Hosting and transfers outside the EU

Customer application data (database and files) is hosted in the European Union. Some providers (e.g. Vercel, Stripe) may be established outside the EU; any transfers are governed by appropriate safeguards (European Commission Standard Contractual Clauses and/or the applicable data protection framework).

Retention periods

• Account and application content: for the duration of the subscription, then deleted or anonymized within a reasonable period after the contract ends (subject to an export window — see the sales terms).
• Password reset tokens: 30 minutes.
• Audit and security logs: limited duration, for security and evidence purposes.
• Billing data: retained in accordance with legal accounting and tax obligations.

Security

We implement appropriate technical and organizational measures: password hashing (bcrypt), encryption in transit (HTTPS/TLS), strict data isolation between organizations (multi-tenant separation), httpOnly authentication cookies, request rate limiting, access logging and security headers (CSP, HSTS).

Your rights

Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability of your data. To exercise them: contact@maintvision.com.

If your data is processed by your organization within the application, please address your request to it first (data controller); we assist it in that capacity. You may also lodge a complaint with your supervisory authority (in France, the CNIL — cnil.fr).

Cookies

The marketing website uses no advertising cookies. With your consent (collected via the banner shown on your first visit), we use Google Analytics to measure site traffic; it then sets measurement cookies (_ga, _ga_*). Declining has no effect on browsing, and you can change your choice at any time by clearing the site’s cookies.

The application only uses technical cookies strictly necessary for authentication (mv_access, mv_refresh), without which the Service cannot function.

Contact and changes

For any question about this policy, write to contact@maintvision.com. We may update this policy; the last-updated date appears at the top of the page.