What we know about you, and what we do with it.

This document says what is true. Where the answer is less flattering than it is elsewhere, it is written down all the same — that is the only way to make it checkable.

Courtesy translation. This page is provided in English so that you can read it. Only the French version is legally binding: it is the one the contract is made in, and the one a French court would read. Where the two differ, the French text prevails.

Who processes your data

GS Informatique, EURL, SIREN 925 179 079, 26 bis rue de la Mairie, 73460 Frontenex, Savoie, France. Data controller and publication director: Gerald Sonzogni.

One point that matters for professionals. We are the controller for what belongs to us: your account, your invoices, our exchanges. But for data that you upload and that concerns other people — your customers, the residents of your town, your staff — you are the controller, and we are only your processor. What that obliges us to do is written in the data processing agreement, which is public.

For any question, or to exercise your rights: contact@arkiasuite.fr or +33 9 51 56 59 54. It is the same person who answers.

Where your data physically is

On our own servers, in Frontenex, Savoie, France. Not at a hosting company, not in a rented data centre, not abroad. The backup copy is kept on a second site, in Faverges (Haute-Savoie) — our machines there too, and encrypted. None of your content leaves the European Union.

One single exception, and it is a necessary one: Stripe (Stripe Payments Europe, Ireland) handles card payments. Your card details never pass through our servers and are never recorded there.

What we keep

Data	Why	For how long
Your ArkiaMail address and your contact address	To identify you, to reach you, to let you recover your access	Life of the account, then 30 days
Your password	To authenticate you	Never in clear text — only a hash is kept
Your content: files, emails, calendar, contacts, photos	To give it back to you; that is the service	As long as you keep it
Connection logs (IP address, date)	Legal obligation of a host, and security	1 year
Technical logs of the web server	Fault diagnosis	6 months
Invoices (amount, date, plan)	Accounting obligation	10 years

When you delete something, it disappears from the backup copies too, within 30 days at the latest — the time it takes for the backup rotation to come round.

What we do not do

We do not read your files or your emails. Nothing is analysed or indexed for commercial purposes, and no content is sent to any third-party service, whatever it may be.
We sell nothing to anyone. Our model is the subscription; there is nothing else to sell.
No advertising, no profiling.
This site sets no cookies and contains no tracker. Even its typefaces are served from our own servers, so that no visitor IP address goes anywhere else.

The Cloud and the mail service do set a session cookie once you are signed in. It is strictly necessary for your connection and disappears when you sign out.

Face recognition

ArkiaPhotos knows how to group photos by face or by object. None of those models is switched on on our servers to this day: your photos are analysed by nothing. If we do switch one on, it will be biometric data, therefore sensitive within the meaning of article 9 of the GDPR, and here is how we will handle it:

you will be told before any activation, and you will be able to refuse it;
the computation happens on our servers in Frontenex, never at a third party;
if you switch it off, the computed signatures are deleted; your photos themselves do not move.

How your data is protected

Between you and us: everything is encrypted (TLS), without exception. Between our own machines, inside the room, some links are not — they do not leave the building.
Your passwords are never stored in clear text, and never sent by email — you choose them yourself, through a single-use link.
We check that the password you choose does not appear in a known breach. To do that, five characters of a hash of that password are sent to the Have I Been Pwned service, which answers with a list. Neither your password, nor your address, nor your username leaves: it is the only call to a third party in the whole service, and it protects you.
Two-factor authentication is available on your account.
Backups that leave our premises are encrypted, because they travel.
At rest, on site, the disks are not encrypted — and we prefer to write it down. They are in a locked rack, in a private room: it is a lock that protects them. Encryption whose key sleeps next to the disk would have protected nothing more.

The apps

The ArkiaSuite apps (Windows, and soon Android, macOS and iOS) talk only to our servers. They contain no analytics tool and no advertising library.

Your folders are read only if you point them out yourself, folder by folder, for synchronisation.
Your photos are read only after you have explicitly granted the system permission, and only to send them to your own space.
Updates are signed: the app refuses to install anything that does not come from us.

Your rights

You may at any time ask for access to your data, its correction, its erasure, its portability, the restriction of its processing, or object to a processing. Write to contact@arkiasuite.fr: we answer within one month.

You do not need to ask us to export your files: they are yours, and downloadable at any time from your account, in their original format. Leaving us requires no permission from anyone.

If our answer does not satisfy you, you may refer the matter to the French data protection authority, the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.

If this document changes

The date at the top of the page is what counts. Any change that affects your rights or the nature of the data processed will be announced to you by email, at your account contact address, before it comes into force.