What we know about you, and what we do with it.

This document says what is true. Where the answer is less flattering than it is elsewhere, it is written down all the same — that is the only way to make it checkable.

Courtesy translation. This page is provided in English so that you can read it. Only the French version is legally binding: it is the one the contract is made in, and the one a French court would read. Where the two differ, the French text prevails.

Who processes your data

GS Informatique, EURL, SIREN 925 179 079, 26 bis rue de la Mairie, 73460 Frontenex, Savoie, France. Data controller and publication director: Gerald Sonzogni.

One point that matters for professionals. We are the controller for what belongs to us: your account, your invoices, our exchanges. But for data that you upload and that concerns other people — your customers, the residents of your town, your staff — you are the controller, and we are only your processor. What that obliges us to do is written in the data processing agreement, which is public.

For any question, or to exercise your rights: contact@arkiasuite.fr or +33 9 51 56 59 54. It is the same person who answers.

Where your data physically is

On our own servers, in Frontenex, Savoie, France. Not at a hosting company, not in a rented data centre, not abroad. The backup copy is kept on a second site, in Faverges (Haute-Savoie) — our machines there too, and encrypted. None of your content leaves the European Union.

One single exception, and it is a necessary one: Stripe (Stripe Payments Europe, Ireland) handles card payments. Your card details never pass through our servers and are never recorded there.

Our chartered accountant receives the list of our invoices every month (name, address, VAT number where applicable, plan and amount): it is an accounting obligation, and they are bound by professional secrecy.

What we keep

Data	Why	For how long
Your ArkiaMail address and your contact address	To identify you, to reach you, to let you recover your access	Life of the account, then 30 days
Your password	To authenticate you	Never in clear text — only a hash is kept
Your content: files, emails, calendar, contacts, photos	To give it back to you; that is the service	As long as you keep it
Connection logs (IP address, date)	Legal obligation of a host, and security	1 year
Technical logs of the web server	Fault diagnosis, and counting visits to the site and use of the free tools, without cookies	6 months
Invoices (amount, date, plan)	Accounting obligation	10 years

When you delete something, it also disappears from the backup copies within twelve months at the latest — the time it takes for the monthly copies of the off-site backup to expire.

What we do not do

We do not read your files or your emails. Nothing is analysed or indexed for commercial purposes, and no content is sent to any third-party service, whatever it may be.
We sell nothing to anyone. Our model is the subscription; there is nothing else to sell.
No advertising, no profiling.
This site sets no cookies and contains no tracker. Even its typefaces are served from our own servers, so that no visitor IP address goes anywhere else.
Our free tools do not send us your files. Merging PDFs, shrinking a photo, creating a password or a QR code: it all happens in your browser. When a tool has been used, the page tells us so, once per visit, with nothing but the tool's name: that is how we know which ones are useful.

The Cloud and the mail service do set a session cookie once you are signed in. It is strictly necessary for your connection and disappears when you sign out.

Face recognition

ArkiaPhotos groups your photos by face. This feature is active on every account. Each recognised face produces a signature: that is biometric data, therefore sensitive within the meaning of article 9 of the GDPR, and here is how we handle it:

the computation takes place on our servers in Frontenex, within hours of the photo arriving, never at a third party;
the signatures serve only to group your own photos: they are neither shared, nor resold, nor used to train anything;
you may object at any time by writing to us: we switch the feature off for your account and delete the signatures already computed; your photos themselves do not move.

How your data is protected

Between you and us: everything is encrypted (TLS), without exception. Between our own machines, inside the room, some links are not — they do not leave the building.
Your passwords are never stored in clear text, and never sent by email — you choose them yourself, through a single-use link.
We check that the password you choose does not appear in known leaks. To do so, five characters of a fingerprint of that password are sent to the Have I Been Pwned service, which replies with a list. Neither your password, nor your address, nor your username leaves: apart from payment with Stripe, it is the only exchange between your account and a third party, and it protects you.
Two-factor authentication is available on your account.
Backups that leave our premises are encrypted, because they travel.
At rest, on site, the disks are not encrypted — and we prefer to write it down. They are in a locked rack, in a private room: it is a lock that protects them. Encryption whose key sleeps next to the disk would have protected nothing more.

The apps

The ArkiaSuite apps (Windows, macOS and Android) talk only to our servers. They contain no analytics tool and no advertising library.

Your folders are read only if you point them out yourself, folder by folder, for synchronisation.
Your photos are read only after you have explicitly granted the system permission, and only to send them to your own space.
Updates are signed: the app refuses to install anything that does not come from us.

Our videos on YouTube

To publish our own videos on our YouTube channel “ArkiaSuite”, we use the YouTube API Services, through our internal tool “ArkiaSuite Publication”. By watching these videos on YouTube, you agree to the YouTube Terms of Service, and your data there is processed under the Google Privacy Policy.

This tool only acts on our own channel. It never requests access to any Google or YouTube account of our customers or of the public, and touches no data in your ArkiaSuite space.
What it keeps: the access authorisation of our own account, on our servers, and the identifiers of the videos we have published. No data about viewers, comments or subscribers is collected, stored or shared.
Revocation and deletion: access can be revoked at any time from the Google security permissions page; we then delete the authorisation kept on our servers, and in any case within thirty days of the tool being stopped.

Your rights

You may at any time ask for access to your data, its correction, its erasure, its portability, the restriction of its processing, or object to a processing. Write to contact@arkiasuite.fr: we answer within one month.

You do not need to ask us to export your files: they are yours, and downloadable at any time from your account, in their original format. Leaving us requires no permission from anyone.

If our answer does not satisfy you, you may refer the matter to the French data protection authority, the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.

If this document changes

The date at the top of the page is what counts. Any change that affects your rights or the nature of the data processed will be announced to you by email, at your account contact address, before it comes into force.