Privacy policy
This policy describes the processing of personal data carried out as part of the EasyConstat service.
1. Data controller
The data controller is PROBANTIA SAS, a French simplified joint-stock company with share capital of EUR 8,000, registered with the Grasse Trade and Companies Register under number 942 694 951, whose registered office is located at 535 route des Lucioles, Les Aqueducs B3, 06560 Valbonne Sophia Antipolis, France.
Contact: contact@probantia.com - +33 9 72 19 84 15.
2. Data protection officer
The data protection officer of PROBANTIA SAS is:
Deshoulières Avocats Associés
121 boulevard de Sébastopol, 75002 Paris, France
Email: contact@deshoulieres-avocats.com
Telephone: +33 1 77 62 82 03
3. Data processed
Depending on the features used, EasyConstat processes the following categories of data:
- account data: email address, internal identifier, hashed password and authentication events;
- security data: IP address, browser, technical logs, verification codes and trusted-device information;
- order and billing data: email address, Stripe references, quantity, amount, identity and billing address provided to Stripe;
- report data: URLs, instructions, dates, request identifiers, captured content, source code, screenshots, HAR files, audio or video recordings and operation logs;
- data required to access protected content, when voluntarily provided for an operator-assisted report;
- evidentiary deposit data: uploaded document, filename, size, type, cryptographic fingerprints, technical metadata, certificate and processing events;
- publication data: decision to make a capture public, link identifier and publication or revocation events;
- support data: contact details, message content and any files voluntarily provided.
Payment-card data is not stored by EasyConstat. It is collected and processed directly by Stripe.
4. Purposes, legal bases and retention periods
| Purpose | Legal basis | Main retention period |
|---|---|---|
| Account creation and management, authentication and support | Performance of the contract and legitimate interest in securing the service | For the lifetime of the account, followed where necessary by intermediate archiving for up to 5 years for the establishment, exercise or defence of legal claims |
| Order, credit and payment management | Performance of the contract | For the contractual relationship; accounting data and invoices are retained for 10 years |
| Production, delivery and verification of evidence reports | Performance of the contract | Evidence archives are retained for 3 years from their creation |
| Evidentiary deposits and certificate verification | Performance of the contract | Documents and certificates are retained for 5 years, unless a different period is announced before the deposit |
| Voluntary publication of a capture | Consent and the user's explicit request | Until revoked by the user or until the associated archive expires |
| Abuse prevention, security, diagnostics and evidence of operations | Legitimate interest of PROBANTIA SAS | Routine logs for up to 12 months; longer retention in the event of an incident or dispute |
| Handling contact requests and complaints | Pre-contractual measures, performance of the contract or legitimate interest | For the time required to process the request, then up to 3 years after the last exchange |
At the end of these periods, data is deleted or anonymised. Retention may be extended where required by a legal obligation, official request, dispute or the defence of a legal right. Backups follow their own rotation cycle and are used solely for restoration purposes.
5. Recipients and service providers
Data is accessible only to persons authorised by PROBANTIA SAS and, as required to provide the service, to the following categories of recipients:
- OVH SAS: hosting of the primary infrastructure in France;
- OneProvider: restricted-access remote backup infrastructure;
- Stripe: payments, fraud prevention and collection of billing details;
- Cloudflare: Turnstile bot protection on exposed forms;
- electronic-signature and timestamp providers, including AlfaTrust, DigiCert and Universign: processing of cryptographic fingerprints and technical data required for sealing, without the full content of documents being intentionally transmitted;
- advisers and administrative or judicial authorities where required by law, a decision or the defence of PROBANTIA SAS's rights.
An operator-assisted report may be captured on an additional node located in France and placed under the exclusive control of PROBANTIA SAS. Target websites necessarily receive the technical information associated with navigation from the capture node, including its IP address.
6. Transfers outside the European Economic Area
Some international providers, including Stripe and Cloudflare, may process data from countries outside the European Economic Area. Depending on the circumstances, these transfers are governed by an adequacy decision, the EU-US Data Privacy Framework applicable to certified organisations, or the European Commission's standard contractual clauses, supplemented where necessary by additional safeguards.
7. Cookies and local storage
EasyConstat uses only trackers that are necessary for the operation and security of the service:
- a session cookie, deleted when the browser is closed or the session expires;
- an optional trusted-device cookie, retained for no more than 7 days when enabled by the user;
- technical elements required for Cloudflare Turnstile bot protection on certain forms.
EasyConstat does not use advertising trackers or audience-measurement trackers requiring consent. If this policy changes, the relevant trackers will remain disabled until the user has made an explicit choice.
8. Security
PROBANTIA SAS implements technical and organisational measures appropriate to the risks, including encrypted communications, password hashing, strong authentication, access controls, logging, service segmentation, backups, cryptographic fingerprints and availability monitoring.
Users remain responsible for keeping their credentials confidential. They should include in their instructions only information that is strictly necessary to perform the service.
9. Your rights
Subject to the conditions laid down by the GDPR, you may exercise your rights of access, rectification, erasure, restriction, objection and, where applicable, data portability. Where processing is based on your consent, you may withdraw that consent at any time without affecting processing already carried out.
You may send your request to the DPO at contact@deshoulieres-avocats.com, or to PROBANTIA SAS through the contact form. Proof of identity will be requested only where there is reasonable doubt about the requester's identity and only to the extent required for verification.
A response will be provided within one month. This period may be extended by two months where requests are complex or numerous. You may also lodge a complaint with the French data protection authority, the CNIL.
10. Changes to this policy
This policy may be updated to reflect changes to the service, its providers or applicable law. Users will be informed of any material change by an appropriate means.
Version CONF-2026-10-24.1 - Effective from 24 October 2026.