Droid FACTORY EURL (share capital €1,000, 1470 route de la Commanderie, 81500 Ambres, France, RCS Castres 912 234 150), represented by Maxime Ferrier, managing director, is the controller of the processing described here. For any question or request: contact@droidfactory.fr.
This policy covers the droidfactory.fr website, the client area and our business exchanges. Data about users of the apps we build for our clients belongs to the client, as controller; we process it as their processor, under article 15 of the terms of service.
1. What we process, why, and for how long
| Situation | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| Visiting the site | IP address, browser, requested page, in the host’s logs | Running and securing the site. Legitimate interest | 30 days |
| Errors on our servers | Technical error message and request concerned, without visitor IP address | Detecting and fixing failures, securing the site and the client area. Legitimate interest | 90 days |
| Errors in your browser | Technical error message and page concerned, without sign-in tokens or form content. Relayed through our server: Sentry receives neither your IP address nor your device characteristics | Detecting and fixing failures on the site and client area, and keeping them secure. Legitimate interest: a site handling payments and client accounts cannot run reliably without this monitoring | 90 days |
| Audience measurement, only with your consent | Page views, clicks on “Book”, offer chosen, call booked, sign-up and payment started, with the offer concerned. Relayed through our server, without IP address | Understanding which pages and offers interest our visitors. Consent, which you can withdraw at any time | 90 days |
| Booking a call | Name, email, company, time slot, what you write in the form | Preparing and holding the call. Pre-contractual steps at your request | 3 years after the last exchange |
| Contact by email or WhatsApp | Your contact details and messages | Answering and, where relevant, making you a proposal. Pre-contractual steps or legitimate interest | 3 years after the last exchange |
| Client account | Email, password (stored irreversibly hashed), authenticator app secret if you turn it on, company, billing address, version of the terms accepted | Managing your account, subscription and our services. Performance of the contract | Term of the contract, then 5 years (limitation period) |
| Company verification | Company identifier (SIRET, VAT number or Companies House number), verification result (company active or not, registered name) and its date. Only the identifier is sent to the registers: the French government’s Recherche d’entreprises API, the European Commission’s VIES and Companies House in the United Kingdom | Checking that our clients are active businesses, as our services are for businesses only. Performance of the contract and legitimate interest | Term of the contract, then 5 years |
| Payments and invoices | Amounts, payment status, invoices. Your card or bank details are entered at Stripe; we never see them | Collecting payment and invoicing. Performance of the contract and accounting obligations | Invoices and accounting records: 10 years |
| Prospecting | Name, role, company, business email, from public or professional sources | Presenting our offers to relevant professionals. Legitimate interest | 3 years after the last contact, unless you object earlier |
The cookies and trackers we use, and how to manage your choice, are described in the cookie policy.
2. Who has access
Only Droid FACTORY accesses your data, together with the following providers, bound by contract and acting only on our instructions:
| Provider | Role | Data location |
|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) | Hosting of the website and the client area, with its database | France (Paris), US parent company |
| Calendly LLC | Booking | United States |
| Anthropic (artificial intelligence tool) | Development assistance: the content of client requests may be processed there | United States |
| GitHub, Inc. | Code repositories, in the client’s or Droid FACTORY’s GitHub organisation | United States |
| Stripe Payments Europe Ltd | Payments and invoices | Ireland, with possible transfers to the United States |
| OVH SAS | Domain name, email, and sending verification and sign-in emails | France |
| Functional Software, Inc. (Sentry) | Error monitoring and audience measurement | European Union (Frankfurt), US company |
| WhatsApp Ireland Limited | Messaging, if you choose that channel | Ireland, with possible transfers to the United States |
Stripe and WhatsApp also process some data on their own behalf (fraud prevention, banking obligations, running their service), under their own policies.
We never sell or rent any data.
3. Transfers outside the European Union
Where data is processed in the United States, the transfer relies on the EU–US Data Privacy Framework for certified companies, or otherwise on the European Commission’s standard contractual clauses (with the UK addendum for UK data). You may ask us for a copy of these safeguards.
4. Your rights
You may access your data, have it corrected or erased, restrict its processing, object to processing based on our legitimate interest (including prospecting, at any time and without giving a reason), and receive the data you gave us in a common format.
Write to contact@droidfactory.fr. We answer within one month. We may ask you to prove your identity if we have reasonable doubt.
If you believe your rights are not respected, you may complain to the CNIL (www.cnil.fr) or, if you are in the United Kingdom, to the ICO (ico.org.uk).
5. Security
Connections to the site are encrypted. Passwords are stored irreversibly hashed. Signing in to the client area requires, in addition to the password, a code sent by email or given by an authenticator app.
6. Changes
We may update this policy. The date of the last update is shown at the top of the page; for significant changes, account holders are notified by email.