1. Controller and contact
The controller is Pepiva Technology, [TO BE COMPLETED: legal form, RCS or SIREN number, registered office address]. For any question about your data or to exercise your rights, write to contact@proxtrace.com.
Pepiva has not appointed a data protection officer [TO BE CONFIRMED: no appointment obligation under article 37 GDPR]; the address above is the contact point for data protection.
2. What this policy does not cover
The infrastructure data that the collector sends to the console (configuration, inventory, firewall, storage, backups, events and logs, which notably contain Proxmox user names and IP addresses) is processed on behalf of our customers. For this data, the customer is the controller and Pepiva its processor, under the Data Processing Agreement. If your data appears in those logs, contact the organisation that operates the infrastructure concerned; we will forward any request we receive about it.
The self-hosted edition runs on the customer’s infrastructure: Pepiva has no access to the data it processes.
3. Processing, legal bases and retention
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Website and console access, security and abuse prevention | IP address, date and time, page or resource requested, browser information, in the server’s technical logs | Legitimate interest: operating and securing the service | [TO BE COMPLETED: web server log rotation period] |
| Contact requests and prospects | Email address, name, company, job title and content of the messages you send us | Legitimate interest: answering requests and presenting our plans to professionals; pre-contractual steps when you request a quote or a trial | Three years after the last contact initiated by you |
| Console account creation and management | Email address, name, hashed password, two-factor secret and recovery codes, role, organisation, language and preferences | Performance of the contract (Terms of Service) | For the lifetime of the account; deleted when it is closed or when the customer’s contract ends, within the reversibility period set by the Terms [TO BE COMPLETED: backup erasure period] |
| Sign-in security | Sign-in log: account, IP address, date, success or failure, use of a recovery code; active sessions | Legitimate interest: protecting accounts and detecting fraudulent access | Sessions: eight hours at most. Log: [TO BE COMPLETED: period, for example one year] |
| Service emails | Email address, message content (address verification, password reset, chosen notifications) | Performance of the contract | Console send log, with encrypted content: 90 days after sending. Relay logs: [TO BE COMPLETED] |
| Commercial relationship, invoicing and support | Identity and contact details of customer contacts, quotes, orders, invoices, support exchanges | Performance of the contract; legal obligation for accounting records | Term of the contract, then five years as proof of the contract; ten years for accounting records (article L. 123-22 of the French Commercial Code) |
We carry out no profiling and no automated decision-making with legal effects. Neither the website nor the console includes advertising tools or third-party analytics.
4. AI assistant
The console’s AI assistant is optional and only runs at your request. When you use it, your question and the organisation data extracts needed for the answer are sent to OpenAI, in the United States, under standard contractual clauses. Your conversations are kept in the console, where you can delete them. This data mainly falls under the Data Processing Agreement concluded with your organisation.
5. Recipients
Data is accessible only to authorised Pepiva staff, within the limits of their duties. It is hosted by OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, in the European Union [TO BE CONFIRMED: data centre location]. Emails are sent by a mail relay operated by Pepiva, without a third-party provider. Other sub-processors are listed on the Sub-processors page. Within a customer organisation, administrators can see their members’ accounts.
Data may be disclosed to an authority that requests it within a legal framework.
6. Transfers outside the European Union
Apart from the AI assistant described above, the data for which Pepiva is the controller stays in the European Union.
7. Security
Exchanges are encrypted with TLS, two-factor authentication is mandatory for every console account, passwords are hashed and the session cookie can only be read by the server. Detailed measures are set out in annex 2 of the Data Processing Agreement.
8. Your rights
You have the right of access, rectification, erasure, restriction and portability, and the right to object to processing based on legitimate interest and to direct marketing. Under French law, you may also set instructions regarding your data after your death (article 85 of the French Data Protection Act).
Write to contact@proxtrace.com. We answer within one month, which may be extended by two months for a complex request; we may ask you to prove your identity in case of reasonable doubt. Some data is kept where the law requires it, for example invoices.
If you believe your rights are not respected, you may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at cnil.fr, or with the supervisory authority of your country of residence.
9. Cookies and local storage
The website sets no cookies. The console uses only cookies strictly necessary for signing in. Details are on the Cookies and preferences page.
10. Changes
This policy may change with the service. Each version is dated; for significant changes, console users are informed by email or in the console.