Privacy policy

1. Who we are and what data we collect

The data controller is Puwapi, 47 rue Vivienne, 75002 Paris, France. Any question about your data may be sent to contact@puwapi.com.

Data collected when creating an account

• Email address - required: it identifies your account and is how we reach you. Without it, the account cannot be created.
• Password - required, stored as a cryptographic hash and never in plain text. Without it, signing in is impossible.
• First and last name - optional: they personalise the interface and the messages we send you. Leaving them out has no effect on access to the service.

If you choose to sign up or sign in using a Google, Apple or Microsoft account, that provider sends us your email address and, where applicable, your name. We never receive your password.

Data collected while using the service

• Activity data: sign-ins, actions performed in your workspace, and the IP address and browser associated with them (audit log)
• Data you enter into the service yourself (customers, appointments, documents, messages): Puwapi then acts as a processor on your behalf, under the data processing agreement
• Billing data: Puwapi never stores a payment card number, which is handled directly by Stripe

Data collected when you write to us

The contact form on this site sends us your name, email address, company if you give one, and your message. They open a request in our internal support tool, hosted on our own servers in the European Union, and are used solely to reply to you. We keep them for 3 years after our last exchange. If the form is unavailable, it offers to send the same message from your own email client.

Data processed by our mobile apps

The Puwapi apps for iPhone, iPad and Android (Puwapi, Puwapi Boutique, Puwapi Chat) sign in to the same account as the web service and collect no data for advertising or tracking. They contain no third-party analytics tool.

• Camera and photo library: used only when you take or choose a photo (expense receipt, product photo, reading a barcode or QR code). A receipt is kept in your workspace, accessible only to its authorised members. A photo added to a product record is published at a public address so it can be shown on your sales pages. When you ask for a receipt to be read automatically or a product to be recognised, the image is sent to the service's artificial intelligence feature (see sections 4 and 5).
• Notifications: if you allow them, the app registers a notification identifier specific to your device, kept while you stay signed in and deleted when you sign out. Notifications are routed through Expo, then Apple or Google; they carry a title and a short text, never the content of a document.
• Sign-in credentials: your session is kept in the device's secure storage (iOS Keychain, Android Keystore) and erased when you sign out.

2. Site analytics

To know which pages of our sites and applications are being read, we record — without placing any tracker on your device — the page visited, the display language, the page that brought you here (referrer), your browser and operating system, the device type, an approximate location (country and city), the date and time, and a non-reversible cryptographic fingerprint of your IP address, renewed every day; the address itself is never stored. That fingerprint only serves to roughly tell two visits apart and cannot identify you or follow you from site to site. Any identifier appearing in a page address is replaced before the record is stored.

This measurement rests on our legitimate interest in understanding our pages' audience in order to improve them. It runs on open-source software that we host on our own servers: no data is passed to a third-party processor, nor outside the European Union. Detailed records are deleted no later than 14 months after collection, and aggregated statistics, which no longer contain any individual visit, no later than 25 months. You may object to it by writing to contact@puwapi.com or by enabling your browser's “Global Privacy Control” or “Do Not Track” signal, both of which we honour.

3. Why we use this data

4. Who has access to your data

Your data is never sold, rented or shared with ad networks. Only the following have access:

• The Puwapi team: access strictly limited to what support, operations and security require, and logged.
• The processors listed below, who act on our instructions alone.

This list is kept up to date. Any addition or replacement of a processor is notified to subscribers under the data processing agreement.

5. Transfers outside the European Union

Hosting of servers, databases and files is entirely located within the European Union (Germany and France). Five types of processing may nonetheless involve a transfer to the United States:

You can obtain a copy of the safeguards covering these transfers on request to contact@puwapi.com. No other transfer outside the European Union takes place.

6. Retention periods

7. Automated decisions and profiling

Puwapi takes no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. We carry out no scoring, no advertising segmentation and no profiling of our visitors or customers.

The service does, however, offer our subscribers analytics and artificial intelligence features that they may apply to their own data (a customer-relationship health indicator, for instance). In that case the subscriber is the controller of that processing: it is for them to inform the individuals concerned and to determine its legal basis. Puwapi acts only as a processor.

8. Your rights

Under the GDPR, you have the following rights:

• Access: confirm whether your data is being processed and obtain a copy of it
• Rectification: have inaccurate or incomplete data corrected
• Erasure: request deletion of your data, subject to our legal retention obligations
• Objection: object to processing based on our legitimate interest, in particular site analytics and marketing
• Portability: receive the data you provided to us in a structured, machine-readable format
• Restriction: have processing frozen while a challenge is resolved
• Withdrawal of consent: where processing rests on your consent, withdraw it at any time, without affecting what was done beforehand
• Post-mortem directives: give directions on what should happen to your data after your death and appoint someone to carry them out (article 85 of the French Data Protection Act)

For marketing, withdrawal takes one click on the unsubscribe link at the bottom of every message. For all other rights, write to contact@puwapi.com or to Puwapi, 47 rue Vivienne, 75002 Paris, France.

Exercising these rights is free of charge. We reply within one month of receiving your request, extended to three months where it is complex or where requests are numerous — you are then told so, with reasons, within the first month. We may ask for further information where there is reasonable doubt as to your identity, without ever systematically requiring identity documents. If our reply does not satisfy you, you may lodge a complaint with the CNIL - 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

9. Security

We put the following measures in place, appropriate to the risk:

• hosting within the European Union, on dedicated infrastructure;
• encryption of all communications (HTTPS, TLS 1.2 minimum, TLS 1.3 by default); obsolete versions of the protocol are refused;
• encryption at rest of mail data (AES-256);
• passwords stored as cryptographic hashes, never in plain text, and temporary account lockout after repeated failed sign-ins;
• data partitioned by organisation: one customer's data is never reachable from another's account;
• named accounts, rights granted by role, administration access restricted to those who need it;
• logging of sign-ins and sensitive actions;
• encrypted daily backups of databases and files, with periodic restore testing.

Two-factor authentication on administration access is being rolled out and will be available during August 2026; this page will be updated when it goes live.

10. Changes

This policy may be updated. The date of the last change is shown at the top of the page. In the event of a substantial change, active subscribers are notified by email 30 days before it takes effect.