Privacy policy

Data controller

For marketing website, account and billing data, the data controller is the publisher of the Service, reachable at contact@maintvision.com.

Controller vs processor: our role

Two situations must be distinguished:

• Your organization’s data in the application (assets, work orders, inventory, files, your own customers and vendors…): your organization is the data controller, and Maint Vision acts as a processor within the meaning of Article 28 GDPR: we process this data only to provide the Service, on your instructions.
• Account, billing and website data (user identity, subscription, browsing the marketing site): Maint Vision is the data controller.

Data we process

Account and authentication

Email address, name, phone (optional), password (stored only as a bcrypt hash, never in clear text), role and permissions, last sign-in date.

Application content

The data you enter in the application: assets, work orders, requests, parts, procedures, messages, attached files and photos. This content may contain personal data (for example your own vendors’ or customers’ contact details), for which you are responsible.

Billing

When you subscribe to a paid plan, we keep the organization name, billing email, plan and subscription status. We never have access to card numbers.

Technical and security data

Audit logs of sensitive events (sign-ins, password resets, role and permission changes), which may include the IP address and browser (user-agent), for security and traceability.

Mobile application

If you enable notifications, a push token is associated with your device. It is deleted on sign-out or when the device is no longer registered.

Purposes and legal bases

• Provide and administer the Service, manage your account and access: performance of the contract.
• Ensure security, prevent fraud and track access (audit logs): legitimate interest and legal obligation.
• Manage billing and meet accounting obligations: performance of the contract and legal obligation.
• Send you service emails (password reset, invitations, important notices): performance of the contract.
• Send mobile push notifications: consent (voluntary opt-in).

Hosting and transfers outside the EU

Customer application data (database and files) is hosted in the European Union. Some providers may be established outside the EU; any transfers are governed by appropriate safeguards (European Commission Standard Contractual Clauses and/or the applicable data protection framework).

Retention periods

• User account: kept until it is deleted, including when an administrator deactivates it. An account can delete itself in the mobile app, except a requester account, which asks for it at contact@maintvision.com (an organization’s only owner first hands over that role): your name, your email address and your password are then erased immediately, along with your notification and reset tokens; what you entered stays in your organization’s workspace, attached to a deactivated account.
• Your organization’s application content: kept for as long as the organization’s workspace exists, including after a subscription ends. It is deleted within 30 days when the organization requests it in writing at contact@maintvision.com.
• Audit logs: 24 months, then deleted automatically.
• Webhook delivery history: 30 days; automation run history: 90 days; responses kept by the server so that the same operation sent again within that time is not run twice: 24 hours. This data is then deleted automatically.
• Password reset tokens: valid for 30 minutes; invitation links sent by email: valid for 7 days. Each can be used only once; only its hash is stored, and it is deleted with the account.
• Push notification token: deleted when the device signs out, when the account is deactivated or deleted, or when the notification service reports it as expired.
• Choice made in the cookie banner: 6 months (180 days); measurement cookies: at most 13 months (390 days) after your last visit (see the “Cookies” section).
• Billing data stored in the application: kept with the organization’s workspace. Invoices, as accounting records, are kept for the legal retention period for accounting documents.

Security

We implement appropriate technical and organizational measures: password hashing (bcrypt), encryption in transit (HTTPS/TLS), strict data isolation between organizations (multi-tenant separation), httpOnly authentication cookies, request rate limiting, access logging and security headers (CSP, HSTS).

Your rights

Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability of your data. To exercise them: contact@maintvision.com.

If your data is processed by your organization within the application, please address your request to it first (data controller); we assist it in that capacity. You may also lodge a complaint with your supervisory authority (in France, the CNIL: cnil.fr).

Cookies

The marketing website uses no advertising cookies. With your consent (collected through the banner shown on your first visit, and again 6 months after your choice), we use Google Analytics to measure site traffic; it then sets measurement cookies (_ga, _ga_*), which expire at most 13 months (390 days) after your last visit. Declining has no effect on browsing.

You can change your choice at any time with the “Cookie settings” button at the bottom of every page of the site: it clears your choice and the measurement cookies, then reopens the banner so you can choose again. If you withdraw your consent, the page reloads without Google Analytics, as do the other pages of the site open in your browser where it was active. Your choice, whether you accept or decline, is kept for 6 months (180 days) in your browser’s local storage (mv-consent, with its date in mv-consent-at), not in a cookie; after that, it is erased and the banner is shown to you again.

The application only uses technical cookies strictly necessary for authentication (mv_access, mv_refresh), without which the Service cannot function.

Contact and changes

For any question about this policy, write to contact@maintvision.com. We may update this policy; the last-updated date appears at the top of the page.