Privacy Policy

Two separate scopes: 1. Public website — via the contact/audit form: name, email address, message, project type (optional). No tracking cookies, no automatic collection. 2. DataDawn platform (subscribed clients) — to provide the subscribed automations, we process the data the client entrusts to us: documents, quotes and invoices, inbound and outbound emails, contact details of the client's own customers (policyholders, tenants, etc.). For this data, DataDawn acts as a processor under the GDPR, on the client's instructions, the client being the controller.

• Website: respond to your requests and follow up about a project. • Platform: strictly run the subscribed automations (reminders, replies, document generation, document search). Your data is never sold, rented, or used for advertising. Legal bases: performance of the contract (Art. 6.1.b GDPR) and legitimate interest for security and service improvement (Art. 6.1.f).

If you connect your Google account to DataDawn via Google OAuth, we only access the Gmail data strictly necessary for the service you subscribed to: • Reading incoming emails relevant to your automation • Sending emails and creating draft replies on your behalf This data is used solely to operate the automations you have configured (replies, follow-ups, sorting). It is never used for advertising, sold, or shared with third parties. DataDawn's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke this access at any time from your Google account settings (myaccount.google.com/permissions) or by contacting us at contact@datadawn.fr.

This site does not use advertising or tracking cookies. Only essential technical cookies may be used for the proper functioning of the site (language preference).

Encryption in transit (HTTPS/TLS) and at rest. Database hosted in the European Union (Neon, Frankfurt). Strictly limited access, hashed passwords (bcrypt), and strict per-client isolation (multi-tenant). Confidential documents are stored privately and served via short-lived signed links. Identifying personal data is anonymized before any processing by an AI model located outside the EU.

To deliver the service we rely on sub-processors, governed by a data processing agreement (DPA): • Neon — database (EU, Frankfurt) • Vercel — application hosting (EU/US) • Mistral AI — OCR and document indexing (EU) • Anthropic (Claude) — AI reasoning on anonymized data (United States) — see "Transfers outside the EU" • Stripe — subscription payments (EU/US) • Resend — transactional emails (EU/US) • Twilio — SMS/WhatsApp messages when the client enables that channel (EU/US) The up-to-date list of sub-processors is available on request at contact@datadawn.fr.

Some AI reasoning is performed by Anthropic (Claude), located in the United States. Before any data is sent to that model, identifying personal data is pseudonymized: the real values never leave the EU. The residual transfer is governed by the European Commission's Standard Contractual Clauses (SCCs) and a zero-retention policy on the provider side. At the client's request, AI reasoning can be switched to an EU-hosted model (Mistral): the residency of AI processing is configurable per client.

Under the GDPR you have the following rights: • Right of access • Right to rectification • Right to erasure • Right to data portability • Right to object and to restriction • Right to lodge a complaint with the CNIL (www.cnil.fr) To exercise these rights, write to contact@datadawn.fr. If your data is processed through a DataDawn client, we will direct you to the relevant controller.

For any questions regarding your personal data, contact me at contact@datadawn.fr

Data controller