Privacy policy
1. Who is responsible for your data
Deploy4000, also called “D4”, is a service provided by Nosytech. Nosytech is the controller of the processing described here, carried out on the deploy4000 website and in your client area.
Nosytech, a simplified joint-stock company (SAS) registered with the Paris Trade and Companies Register under number 793 507 708, with its registered office at 1 B avenue Franco-Russe, 75007 Paris, France.
For any question about your data or to exercise your rights: deploy4000@nosytech.fr.
Personal data we process on behalf of a client while developing their product is governed by our terms and conditions (Article 28 GDPR).
2. The data we process
- Your account: name, email address, chosen language, password (stored only as an irreversible hash), date of creation and of address confirmation.
- Your projects: name, description, features, specification and documents you upload, project status and schedule.
- Your commitments: acceptance of the terms and signed test extensions, with the signing name, date, IP address and browser used, which serve as proof.
- Your payments: amounts, dates declared and received, proofs you upload (transfer notice, screenshot of the transaction).
- Your exchanges: requests sent from your area, our replies, and the emails we send you at each stage of the project.
- Your sign-ins: open sessions, devices you choose to have recognised, sign-in attempts and sensitive actions on your account, with the IP address, to protect your account.
- For team accounts: the two-factor authentication factor.
Messages you send us by email are processed in our mailbox, to reply to you.
3. Why we process it
- Creating and managing your client area, delivering your project and keeping you informed: performance of the contract or of pre-contractual steps taken at your request (Article 6(1)(b) GDPR).
- Proving your commitments and keeping our accounts (payments, proofs, invoices): legal obligations (Article 6(1)(c)) and legitimate interest in being able to evidence the contract (Article 6(1)(f)).
- Securing accounts and the service (limiting attempts, detecting attacks, logging sensitive actions): legitimate interest in protecting your data and ours (Article 6(1)(f)).
- Answering your requests and the exercise of your rights: legal obligation (Article 6(1)(c)).
Your data is used solely for these purposes. The emails we send you relate to your account and your projects.
4. Who has access
The Nosytech team working on your project, to the extent necessary for its work. Team access is protected by two-factor authentication.
Our processors, each for a specific task and within the European Union:
- OVHcloud (France): hosting of the servers and the database.
- Scaleway (France): sending of transactional emails.
- Hetzner Online (European Union): encrypted backup copy, unreadable without our keys. A data processing agreement under Article 28 GDPR is signed.
Your data stays in the European Union.
5. How long we keep it
- Account without a project: until it is deleted, which you can do yourself at any time, and at most 3 years after your last sign-in.
- Projects, signed commitments, related requests and emails: for the duration of the contractual relationship, then 5 years, the limitation period for civil claims (Article 2224 of the French Civil Code).
- Payments, proofs and invoices: 10 years from the end of the financial year, the period required for accounting records (Article L123-22 of the French Commercial Code).
- Security log (sign-ins, sensitive actions, IP addresses): 1 year.
- Sessions: closed after 14 days of inactivity, and at most 30 days after sign-in. Recognised devices: 30 days.
- Requests relating to your rights: as long as needed to show how they were handled, at most 5 years.
Encrypted backups are used solely to restore the service after an incident. They are kept for 6 months at most, so deleted data disappears from them within that time, and it is never restored for reuse.
These periods are applied automatically, every day for the database and every week for backups.
6. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to set instructions for what happens to it after your death.
- From your client area, on the “My account” page: correct your name, email address and password; immediately download a copy of your data in a format another application can read; delete your account if it is not linked to any project, or request the deletion of your data if it is.
- For any other right: write to us at deploy4000@nosytech.fr from your account address.
We reply within one month at the latest. Where data must be kept under a legal obligation (contracts, accounting records), we tell you so and delete or anonymise everything else.
If you believe your rights have not been respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
7. Cookies and storage in your browser
The site only uses items necessary for it to work, which are exempt from consent:
- Client area session cookie: keeps you signed in, for 30 days at most.
- Recognised device cookie, if you ask for it when signing in: 30 days.
- Temporary two-factor authentication cookie, while you enter the code.
- Browser local storage: chosen language, dismissal of the information banner, plan chosen on the home page and draft of the project being entered, so you do not lose your input; during sign-up, the address entered, erased when the tab is closed.
The site’s fonts and scripts are served by our own servers.
8. Security
Encrypted connections (HTTPS), passwords stored as hashes (scrypt), uploaded files stored in the database and downloadable only by you and the team, encrypted backups, mandatory two-factor authentication for the team and a log of sensitive actions.
In the event of a data breach likely to pose a risk to you, we notify the CNIL within 72 hours and inform you where the law requires it.
9. Changes
This policy may change as the service evolves. The update date appears at the top of this page; for any significant change, we will inform you by email.