Privacy policy.

This Privacy Policy informs users of the cahierautonome.fr website about how their personal data is collected, used and protected, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act.

The data controller is: VSBG, SASU (French simplified joint-stock company with a single shareholder). Share capital: EUR 100. Montpellier Trade Register: 915 013 809.

Email: contact@cahierautonome.fr.

Depending on the use of the site, the following data may be collected:

• First and last name
• Email address
• Postal address
• Phone number
• Billing information
• IP address
• Browsing data
• Order history
• Any information voluntarily submitted via the site forms

No banking data is stored on our servers.

Each studio runs in your browser, on your device, and stores your working data there. It connects to our server to check the licence. Depending on the studio, other features also go through a server: an encrypted shared logbook, forms sent to your clients, public data services. Each product page states what is sent, when and why.

• Prélèvement Studio: Your readings are stored on your devices. When several devices share the centre's logbook, it is encrypted on the device, with a key our server never receives: we keep it for a rolling 36 months without being able to read it, and it is deleted 30 days after the licence ends. The QR page is optional: if you turn it on, its values are published unencrypted, without any operator's name. Text messages and invitations are sent from your devices. The licence, the email address and the devices' technical information (name, fingerprint, IP address) are processed to run the service.
• Invoice Studio (Facture Studio): Your quotes, invoices and clients are stored in your computer's browser, not in the file: your backup is a file you download. The studio connects to our server to check the licence and keep a single session open. When you send a form for a client to fill in, the form (your business name, legal notice, colours, logo) is placed unencrypted on our server; your client's answers come back through it encrypted, with a key the server never receives, and are deleted as soon as they are retrieved, at the latest after 7 days. The licence, the buyer's email address and the device fingerprint are processed to run the service. The studio contains no audience measurement.
• Pilote PDF: Your PDFs are processed in your browser's memory and sent nowhere: the result is downloaded to your device. Your settings, signature and stamp are stored in the browser. On opening, if it is online, the tool asks cahierautonome.fr whether a newer version exists: no document is sent, only what any web request transmits (IP address, browser). The tool allows no other connection. To receive the download link, you give your email address: our server records it with the date and IP address of the request, then sends you the link. With your consent, it also writes to you about new versions and new Cahiers Autonomes; every email contains an unsubscribe link.

Server hosted by Hetzner (Germany), emails sent by LWS (France), payment by Stripe.

Personal data is used to:

• process orders
• deliver digital products
• manage customer support
• respond to contact requests
• issue invoices
• comply with legal and accounting obligations
• improve the site's operation
• prevent fraud
• run the studios' licences and the online features described in article 04
• send the Pilote PDF download link and, with your consent, its new versions and news of new Cahiers Autonomes

Processing is notably based on:

• the performance of the sales contract
• compliance with legal obligations
• consent when required
• the legitimate interest of VSBG to ensure the security and proper operation of the site

Data may be transmitted only to providers necessary for the operation of the service, notably:

• Stripe (secure payment)
• Hetzner, Germany (hosting of the website and of our server)
• LWS, France (sending emails)
• Google (audience measurement, only with your consent, see article 11)
• technical providers involved in the operation of the site

These providers only access the data strictly necessary for their missions.

Data is kept for the time strictly necessary to fulfill the purposes pursued and in accordance with legal obligations.

Billing data may be kept for the period required by tax and accounting regulations.

Retention periods specific to the studios (Prélèvement Studio's shared logbook, Invoice Studio's forms) are stated in article 04. Technical logs of the licence server are deleted after 90 days.

VSBG implements technical and organizational measures to ensure the confidentiality, integrity and security of personal data in accordance with the GDPR.

In accordance with the GDPR, you have the following rights:

• right of access
• right of rectification
• right to erasure
• right to restrict processing
• right to object
• right to data portability
• right to withdraw your consent when processing is based on it

Any request can be sent to contact@cahierautonome.fr. A reply will be provided within the timeframes set by the regulations.

The site uses cookies necessary for its operation.

Audience measurement or third-party service cookies may only be used after obtaining consent when required.

With your consent, Google Analytics, a service of Google Ireland Limited, measures the site's audience and the purchases made on it. No personalised advertising cookies are used.

The user can change their preferences at any time from the "Cookie settings" link at the bottom of every page.

Payments are exclusively processed by Stripe.

Banking information is never transmitted nor stored on VSBG servers.

If you believe that your rights are not respected, you can lodge a complaint with the CNIL (French data protection authority).

This Privacy Policy may be modified at any time to reflect legal, regulatory or technical changes.

The version published on the site is the only one that applies.