Your employees’ data deserves to know where it sleeps
Names, job titles, photos, phone numbers, prospects’ contact details: Profiles Flow hosts personal data, that of your teams and your contacts. We tell you precisely where it is, who has access to it and which law applies to it.
Where your data is
Why it matters: the CLOUD Act
Hosting data in Europe is not always enough. Since 2018, the CLOUD Act has allowed US authorities to demand from a company subject to US law the data it controls, wherever in the world it is stored. Section 702 of FISA, for its part, authorizes the surveillance of communications of non-US persons through these same providers.
In other words: a server located in Paris but operated by a US company remains exposed to these laws. For the part of Profiles Flow that stores your data, we chose a French publisher and a French hosting provider, Scaleway, with data centers in France.
This choice does not cover the whole chain, and we do not claim otherwise: some of the providers listed below, such as the payment service or the Apple and Google wallets, are companies governed by US law. We would rather tell you clearly than promise total sovereignty.
Our subprocessors, with no blind spot
An online service always relies on providers. Here are the ones involved, and why:
| Provider | Role | Data location | Company’s governing law |
|---|---|---|---|
| Scaleway | Hosting of the application, data and backups | France | French |
| Scaleway | Sending the service’s emails (sign-in codes, contact request notifications) | France | French |
| Stripe | Card payment and SEPA direct debit | Ireland | US (European entity in Ireland) |
| Sellsy | Invoicing | France | French |
| Apple | Apple Wallet cards, for employees who add one | Determined by Apple | US |
| Google Wallet cards; signature installation if you turn on the Google Workspace module | Determined by Google | US |
We say it plainly: an Apple Wallet or Google Wallet card necessarily goes through Apple or Google, since it is stored in their wallet. It contains only what is displayed on it (name, job title, photo, logo, link to the profile). If you would rather do without it, your employees still have their profile page and their QR code, which stay with us.
The full, dated list is published on the Subprocessors page. We inform you of any change.
Security, by design
GDPR: each party’s role
You are the controller
For the data of your employees and of the contacts you receive: you decide what is published and how it is used.
We are your processor
Within the meaning of Article 28 of the GDPR: we process this data only to provide the service and on your instructions, we ensure its security and confidentiality, we help you respond to requests from individuals, and we notify you of any breach without undue delay. These commitments are set out in our terms of sale.
At the end of the subscription
Your data can be retrieved on request for 30 days, after which it is deleted.
Data-frugal, by principle
No tracking cookie
Profile page analytics set no cookie and keep no IP address. No banner, and no consent to collect from your visitors.
Prospects’ consent kept on record
When a visitor leaves their contact details, the text they accepted is kept as is, with the date.
A cookie-free website
This website also measures its audience without cookies, with a European tool.
Frequently asked questions
Is Profiles Flow SecNumCloud-qualified?
No. Profiles Flow is not SecNumCloud-qualified and does not claim this qualification. Our commitment covers a French publisher, hosting in France with a French hosting provider, French law and transparency about our subprocessors.
Is my data used for other purposes?
No. It is used only to provide the service. It is neither resold nor used for advertising.
Can I get a data processing agreement?
The processor obligations set out in Article 28 of the GDPR are included in our terms of sale. For any further question, leave us a message from the Support page of the application.
Where are backups stored?
At Scaleway, in France.