Privacy policy
Version of 1 August 2026
This is a translation. Wyncove's legal documents are drafted in French, and the French version is the only binding one. This English text is provided so that an English-speaking reader can review the terms; in the event of any discrepancy between the two, the French version prevails.
1. Two roles not to be confused
Wyncove processes two very different sets of data, and its legal role is not the same in each case.
- The data of its own customers and prospects — work email addresses, accounts, access logs, billing: Wyncove is the controller.
- The contracts uploaded and what is extracted from them: Wyncove acts as a processor, on behalf of the customer organisation, which is the controller. Those documents mention people — signatories, contacts, employees of a supplier — whom Wyncove has never met and cannot inform directly.
The commitments that processor status entails are detailed in the data processing agreement (GDPR art. 28), an annex to the terms of service: instructions, confidentiality, security, sub-processors, breach notification, the fate of data at the end of the contract.
A request from a person mentioned in an uploaded contract is therefore forwarded to the customer concerned, who alone can answer it.
2. Purposes and legal bases
| Purpose | Legal basis (GDPR art. 6) | Data |
|---|---|---|
| Providing the service: extraction, register, alerts | Performance of the contract (6.1.b) | Uploaded files, extracted text, structured data, accounts |
| Answering an access request submitted on the site | Pre-contractual steps at the request of the person (6.1.b) | Work email address, organisation, message |
| Security and traceability of access | Legitimate interest (6.1.f) | Audit log, technical logs without contract content |
| Improving extraction quality | Legitimate interest (6.1.f), on anonymised data, with a right to object | Corrections made by users |
| Billing | Performance of the contract and accounting obligation (6.1.b, 6.1.c) | Billing data |
3. What we do not do
- Your contracts train no model. The text sent to the AI provider is used to answer that request, and the no-training commitment is part of the processing agreement.
- No advertising trackers. The site loads no third-party advertising script, no remote font and no tracking pixel. The only audience measurement is the one described in article 4: no cookie, no profile, on redacted addresses — which is why there is no consent banner to click through.
- No resale and no sharing for commercial purposes.
4. Cookies
A single cookie is set, wyncove_session, and only after sign-in: it identifies the session. It is strictly necessary for the operation of the service, which exempts it from consent (article 82 of the French Data Protection Act). It is marked HttpOnly, Secure and SameSite, and is deleted on sign-out.
Audience measurement. We use Vercel Web Analytics to count page views. That tool sets no cookie and builds no advertising profile. Page addresses are sent to it redacted: contract identifiers are replaced with [id] and the query string is stripped entirely — so neither the words you type into the register search nor the record you are viewing leave the application. We measure which pages are useful, never who is looking at which contract.
5. Retention periods
| Data | Period |
|---|---|
| Uploaded files and extracted data | Term of the contract, then 30 days |
| User accounts | Term of the contract, then 30 days |
| Audit log | Rolling 12 months |
| Technical logs (without contract content) | 90 days |
| Encrypted backups | 30-day rotation |
| Access requests not converted | 12 months |
| Accounting records | 10 years (legal obligation) |
Deleting a contract is immediate on screen; the purge of files and associated data follows, and the record of the deletion — without the deleted data — remains in the audit log.
6. Subprocessors
Each is covered by a processing agreement (GDPR art. 28). None sees the content of a contract beyond what its function requires.
| Subprocessor | Role | What it sees | Location |
|---|---|---|---|
| Vercel | Running the application and audience measurement | Data in transit during processing. For audience measurement: the address of the pages viewed, redacted (identifiers replaced, query string stripped), with no cookie | Functions in the Paris region (cdg1) |
| Supabase (PostgreSQL and file storage) | Storage | Uploaded files, structured data, accounts | Paris (eu-west-3) |
| Anthropic | Extraction by language model | The text of the contract, for the duration of the request. No retention for training. | Covered by the processing agreement |
| Brevo (French company) | Sign-in emails and reminders | The recipient's address and the content of the message — never a contract | European Union |
To be completed before the first real customer data is processed: signature of the Supabase, Vercel and Anthropic processing agreements, and mention of the payment provider as soon as it goes live. Any addition or replacement of a subprocessor is notified to customers, who have a right to object.
The calendar feed: optional, and at your initiative
An organisation may publish its deadlines as a read-only calendar feed, at an unguessable address, so as to subscribe to it in Google Calendar or Outlook. The feature is off by default and is only enabled by an administrator of the organisation.
What the events contain: the counterparty name, the internal reference, the contract type, the date, the notice period and a link to the record. No amounts, no contract excerpts. Wyncove sends nothing: it is your calendar provider that comes to read the address you gave it. It is therefore not our subprocessor, and we hold no access to your calendar. The address can be regenerated or switched off at any time from the settings, with immediate effect.
7. Anonymised reuse of corrections
When a user corrects a badly extracted value, that correction is what makes it possible to measure and improve the quality of the system. This reuse is carried out on anonymised data: no party name, no identifying amount, no reference. An organisation may object, and the objection is recorded for the whole organisation.
8. Your rights
Access, rectification, erasure, portability, restriction, objection: write to privacy@wyncove.fr. Response within 30 days. You may also lodge a complaint with the CNIL, the French data protection authority.
For data appearing in a contract uploaded by a customer organisation, the request is forwarded to that organisation: it alone is the controller (article 1).
9. Data breach
In the event of a breach likely to create a risk, the CNIL is notified within 72 hours and affected customers are informed directly. The technical measures and the organisation of the response are described on the Security page.