Privacy policy

Vidimus processes the following categories of personal data:

• Identification & account data: name, professional email address, organisation, role, hashed password, authentication tokens.
• Usage & technical data: IP address, browser user-agent, device type, language, session timestamps, error logs, audit-log entries (actor, action, entity, timestamp, reason).
• Contractual data: billing contact, invoicing information, communication history with our support and account teams.
• Free tool requests: the email address you give to receive a result from the AI Act risk classifier or the Article 50 check, and the company and role if you add them.
• Content you submit: registration answers, evidence documents and anything else you upload, and the replies and tool calls recorded when we test your agents. Any of it may contain personal data, depending on your use. You are the controller of that data and we act as your processor (see the Data Processing Addendum).

We do not knowingly collect special-category data (Article 9 GDPR) through the website. Do not upload special-category data to the platform unless we have agreed it in writing.

We process personal data for the following purposes, on the following bases:

• Provide the service (account creation, authentication, platform features), performance of the contract, Article 6(1)(b).
• Bill and account (invoicing, accounting records), legal obligation, Article 6(1)(c), and French Code de commerce L.123-22 (10-year retention).
• Security & abuse prevention (audit logs, intrusion detection, rate limiting), legitimate interest, Article 6(1)(f), and our security obligation under Article 32 GDPR.
• Customer support (responding to your requests), performance of the contract, Article 6(1)(b), or legitimate interest, Article 6(1)(f), where you are not yet a customer.
• Contact and pilot requests (the contact form), pre-contractual measures at your request, Article 6(1)(b). The IP address and browser details sent with the form are recorded with it, to prevent abuse of the form, legitimate interest, Article 6(1)(f).
• Free tool results (the AI Act risk classifier and the Article 50 check): when you ask for your result by email, we use your address to send it, at your request, Article 6(1)(b). If you also tick the box that asks us to, we keep your email, company and role, and receive a copy of the result, to follow up with you about it: consent, Article 6(1)(a). Without the tick, we do not keep your details.
• Legal compliance (responding to requests from authorities, exercising and defending rights), legal obligation, Article 6(1)(c) / legitimate interest, Article 6(1)(f).

Personal data is accessed by:

• Authorised Vidimus personnel bound by confidentiality, on a strict need-to-know basis.
• Sub-processors acting on documented instructions (Article 28 GDPR). The current list is maintained in the Data Processing Addendum, which names every sub-processor, the service it provides and where the data is located. The same register is published on the Security page. A message sent through the contact form reaches us by email, relayed by Resend, one of the sub-processors in that register. A free tool’s result is sent to you the same way.
• Public authorities where required by an enforceable legal request.

Vidimus is designed to keep tenant data inside the European Economic Area. The production database, object storage, and authentication services reside in the EU (Supabase eu-central-1). Default LLM processing is performed by an EU-based provider (Mistral). Where a transfer outside the EEA is unavoidable for a strictly limited ancillary purpose (e.g., the Vercel global edge network for static assets), it is covered by the European Commission's Standard Contractual Clauses (SCCs, Decision 2021/914) and any further safeguards required by Schrems II.

We retain personal data for no longer than necessary:

• Account data: for the duration of the customer relationship, plus up to 3 years for the purpose of demonstrating compliance and managing post-contractual matters.
• Accounting records: 10 years (French Code de commerce L.123-22).
• Audit logs: at least 6 months, for security and accountability, and longer where sector-specific rules require it.
• Contact and pilot requests: 3 years from your last interaction with us (CNIL guidance on B2B prospect management), together with the IP address and browser details recorded with the request.
• Free tool details kept with your consent: twelve months from your consent, then deleted. You can ask us to delete them sooner, or withdraw your consent at any time.
• Tenant content (registration answers, evidence documents, test-run results): for the duration of the contract, then deleted or returned per the DPA.

Under GDPR Articles 15-22 you have the right to access, rectify, erase, restrict processing of, port, and object to the processing of your personal data, as well as the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (Article 22). You may also withdraw consent at any time where processing is based on consent, without affecting prior processing.

To exercise these rights, write to contact@vidimus.fr. We will respond within one month (Article 12(3) GDPR), extendable by two further months for complex requests.

You also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL) or with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement.

Vidimus applies technical and organisational measures appropriate to the risk (Article 32 GDPR), including encryption in transit (TLS 1.2+) and at rest, Postgres row-level security for tenant isolation, hardened authentication, secret rotation, and an append-only audit trail. Personnel access is granted on a least-privilege basis and is logged.

We set no cookie that needs consent, so no consent banner is needed. The cookie policy lists each cookie, its purpose and how long it is kept.

We may update this policy to reflect changes in our processing, in the regulatory environment, or in our sub-processors. Material changes will be notified to account holders by email and surfaced on this page at least 30 days before they take effect.