Privacy Policy

1. Data controller

The data controller is Badreddine Oussaih, publisher of Comptyx. For any question about your data: badreddine@comptyx.com.

2. Data we collect

Account data: name, email address, password (stored hashed) and the company information you provide.

Documents you upload: invoices and accounting records, along with the data extracted from them (amounts, dates, counterparties, journal entries).

Usage data: technical logs, IP address, browser type and pages visited, for security and service improvement.

Payment data: processed by our provider Paddle, acting as Merchant of Record. We never store your card numbers.

3. Purposes and legal bases

Providing the service (extraction, generation and export of entries): performance of the contract.

Billing and subscription management: performance of the contract and legal obligations.

Security, fraud prevention and service improvement: legitimate interest.

Any marketing communications: consent, revocable at any time.

4. Subprocessors and recipients

OpenAI: the content of the documents you upload is sent to OpenAI, in the United States, to perform AI-based extraction and structuring. Data sent through the OpenAI API is not used to train its models.

Paddle: payment processing and billing (Merchant of Record).

Vercel: hosting of the website and app (United States).

Render: hosting of the API and database (Oregon region, United States).

Transactional email delivery: a third-party SMTP provider, used only for service email (account verification, password reset, notifications).

We never sell your data and never share it with any third party for advertising purposes.

5. Transfers outside the European Union

Some subprocessors (OpenAI, Vercel, Render) are located in the United States. These transfers are governed by the European Commission's standard contractual clauses and/or the applicable adequacy mechanisms.

6. Retention periods

Account data: kept while the account is active, then deleted within 30 days of its closure.

Uploaded documents: not archived — deleted as soon as the extraction ends, at the latest 30 minutes afterwards (see the "Data security and hosting" page).

Billing data: kept in accordance with accounting and tax obligations (generally 10 years).

7. Your rights

Under the GDPR, you have the rights of access, rectification, erasure, portability, restriction and objection. You can exercise them, including exporting or deleting your data, by writing to badreddine@comptyx.com.

You may also lodge a complaint with the CNIL (France) or the CNDP (Morocco).

8. Security

The technical and organizational measures protecting your data are detailed on the "Data security and hosting" page.

9. Cookies

We use only strictly necessary cookies (authentication session, language preference). No advertising cookies are set.