Privacy policy
Controller
cetome (see the legal notice). Contact: the contact form or the postal address in the legal notice.
What we process and why
- Account: Name, e-mail address, organisation, language, your product news choice, the date and version of the terms you accepted, your sessions and sign-ins. You sign in with a passkey (we keep only its public key, never your biometrics) or with an e-mail link or code: there is no password. Purpose: provide and secure the service. Basis: contract. Kept while the account exists. An address never confirmed is deleted after 7 days.
- Products and documents: What your team enters (product descriptions, inventory, assessments, components) and uploads (documents, pictures, bills of materials). Purpose: provide the service. Basis: contract. We act as processor for any personal data they contain. Kept until you delete them.
- Activity history: Who changed what and when in your products and organisation, shown to your team. Purpose: audit trail and security. Basis: contract and legitimate interest. Kept 24 months, security events (sign-ins, passkeys) 12 months.
- Request logs: Pages visited, response status and time, language, browser type and a keyed hash of the IP address (never the raw address). Purpose: security, support and aggregated usage statistics. Basis: legitimate interest. Kept 13 months.
- Sandbox: Work done without an account is deleted 24 hours after the last activity, unless you create an account.
- Payment: For paid plans, Stripe collects the billing name and address, VAT number and payment method on its own pages: card numbers never reach REDact. We keep the Stripe customer reference, the card type and its last 4 digits, and the subscription. Invoices are shown from Stripe. Before each payment we record the consent to start the service at once (date, person, terms version, keyed hash of the IP address), kept as proof while the organisation exists. Basis: contract and accounting obligations.
- AI processing: Only when a person in your team uses an AI feature, the relevant product data and document extracts are sent to the AI provider of the service, Google LLC / Google Ireland (Gemini API, paid tier), which processes them on our behalf to produce the proposal. On this paid tier, Google does not use prompts and responses to train its models (Gemini API terms for paid services). Guests never use the AI and your organisation can turn it off. Paid and Enterprise organisations may use their own model or key: their content then goes to the provider they chose, under their own contract with it.
- Known-vulnerability lookups: Only component identifiers (name, version, supplier, package URL, CPE, CVE identifiers) are sent to ENISA's EUVD, NIST's NVD and OSV.dev. The CISA catalogue of known exploited vulnerabilities is downloaded as a whole. Never a product, organisation or person name.
- E-mails: Sign-in links and codes, invitations, review notifications, and product news only if you opted in. Sent through IONOS.
- Contact form: Your name, e-mail address, company, topic and message, with a keyed hash of the IP address and the browser type. Purpose: answer you. Basis: legitimate interest (pre-contractual steps when you ask about an offer). Kept 12 months.
Subprocessors
- IONOS SE, Germany
- Hosting and e-mail delivery, in the European Union
- Stripe
- Payments and invoices (paid plans)
- Google LLC / Google Ireland (Gemini API, paid tier)
- AI proposals, only when a person uses an AI feature
Where
Hosting in the European Union. Stripe and the AI provider may process data outside the EU under the European Commission's standard contractual clauses.
Your rights
Access, rectification, erasure, restriction, objection and portability. You can export your data and delete your account from your account page, or write to us through the contact form or at the address in the legal notice. You may complain to the CNIL.