Privacy policy

1. Data controller

The controller for personal data collected through the Brifay application and website is:

The data protection contact is reachable at: [email protected].

2. Personal data collected

Brifay collects only the data strictly necessary to operate the CMMS service. We do not collect any sensitive data within the meaning of Article 9 GDPR.

3. Purposes of processing and legal bases

Each data processing activity relies on a legal basis provided for by the GDPR (Article 6):

Brifay does not carry out any profiling or automated decision-making producing legal effects on users.

4. Recipients and subprocessors

Your data is never sold to third parties. It is shared only with the following subprocessors, which are contractually bound to process it solely on Brifay's instructions:

« Product » subprocessors (Brifay application)

« Website and acquisition » subprocessors (marketing site + warm marketing emails)

« Cold prospecting » subprocessors (only if enabled)

The following subprocessors are used only for outbound B2B prospecting (cold email), on the legal basis of legitimate interest (documented LIA — legitimate interest assessment), with a systematic 1-click opt-out (List-Unsubscribe). No customer « product » data passes through these tools.

Within Brifay, only authorised individuals (technical support, management) access the data within the limits of their duties.

Multi-tenant isolation

Each organisation using Brifay has an isolated workspace. A user can only access data belonging to the organisation to which they belong.

5. Transfers outside the European Union

Some of our subprocessors (Firebase/Google, Stripe, Cloudflare, Sentry, RADAAR, Google Workspace, and — if cold prospecting is enabled — Smartlead) may process data in the United States. These transfers are framed by:

• The EU-US Data Privacy Framework (European Commission adequacy decision)
• The Standard Contractual Clauses (SCC) issued by the European Commission
• Additional technical measures (end-to-end encryption, pseudonymisation)

Your main database (Supabase) is hosted within the European Union. You can obtain a copy of the transfer safeguards by contacting [email protected].

6. Retention periods

Your data is retained in accordance with the recommendations of the CNIL (France's data protection authority), following the three-phase cycle: active base, intermediate archiving, deletion:

At the expiry of these periods, data is irreversibly deleted or anonymised. You may request early deletion, subject to any contrary legal obligations.

7. Your rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights:

How to exercise your rights

• By email: [email protected]
• Via the page: Delete my account

We reply within one month (extendable by two months for complex requests). Identity verification may be requested.

Complaint to the CNIL

If you consider that the processing of your data does not comply with the regulations, you can lodge a complaint with the CNIL (France's data protection authority):

Commission Nationale de l'Informatique et des Libertés
3 Place de Fontenoy, TSA 80715
75334 Paris Cedex 07, France
www.cnil.fr

If you are based in another EU Member State, you may also lodge a complaint with the supervisory authority of your country of residence.

8. Cookies and trackers

Strictly necessary cookies

These cookies are essential for the service to operate and do not require your consent:

• Supabase Auth — authentication session, security tokens
• Stripe — transaction security and fraud prevention

Cookies subject to consent

• Firebase Analytics — audience measurement and service improvement (duration: 13 months max.)
• Google Maps — display of interactive maps
• Gleap — technical support and user feedback

Manage your preferences

You can change your cookie preferences at any time via your browser settings. Refusing non-essential cookies does not block access to the service.

9. Data security

Brifay implements technical and organisational measures to protect your data in accordance with Article 32 GDPR:

Technical measures

• Encryption of data in transit (TLS/HTTPS)
• Encryption of data at rest (AES-256)
• Password hashing (bcrypt)
• Authentication via JWT tokens
• Regular automatic backups
• Access logging (audit logs)
• Hosting in SOC 2 and ISO 27001 certified data centres

Organisational measures

• Access limited to strictly necessary personnel (least privilege principle)
• Strong password policy
• Security incident management procedures

In the event of a breach

In the event of a personal data breach, Brifay notifies the CNIL within 72 hours (Article 33 GDPR) and informs the data subjects if the risk is high (Article 34 GDPR).

10. Protection of minors

Brifay is a professional service intended for companies and public sector organisations (B2B). The service is not intended for individuals under 16 years of age. No data of minors is intentionally collected.

11. Changes to this policy

Brifay may update this privacy policy. In case of substantial change, we will inform you by email or by notification within the application. The date of the last update is indicated at the top of this page.

This policy is governed by French law. In case of dispute, the French courts shall have jurisdiction.

12. Contact

For any question relating to the protection of your data:

• Email: [email protected]
• Form: Contact page