Privacy policy

This policy explains what personal data Dataminutes SAS ("we") collects through this website, dataminutes.tech, and through the Dataminutes application at app.dataminutes.tech, why, and what you can do about it. Your use of the application is also governed by our terms and conditions.

Who is responsible for your data

The data controller is Dataminutes SAS. For any question or request about your data, write to [email protected].

What we collect and why

When you request beta access. We collect the email address you enter.

• We first send that address a confirmation link, valid for 48 hours. Nothing is added to our list unless you click it, so nobody can sign you up without your knowledge.
• Once you confirm, we keep your address to invite you to the beta and to send you occasional news about Dataminutes.
• The legal basis is your consent (GDPR art. 6(1)(a)), given by ticking the box on the form and confirming your address. You can withdraw it at any time with the unsubscribe link in every email, or by writing to us.

Technical data. When you submit the form or open a confirmation link, our server:

• uses your IP address to limit how often the form can be used, against abuse. This count is held in memory for at most an hour and never stored;
• records your IP address and email address in its technical logs, to keep the service secure and fix problems.

The legal basis is our legitimate interest in running a secure, working service (GDPR art. 6(1)(f)).

When you use the application. We collect your name, email address and password (stored only as a hash) to run your account, and the billing details of your organization's subscription. The legal basis is the performance of our contract with you (GDPR art. 6(1)(b)).

The data your organization loads into Dataminutes, through its connectors, file uploads and transformations, is your data: we process it only on your instructions, to provide the service, and never use it for anything else.

No cookies, no tracking. This website sets no cookies and uses no analytics or advertising trackers. The application sets only the cookies it needs to keep you signed in and to secure the Google authorization.

We may later add anonymized analytics, only to understand how the website and the application are used and improve them, never for advertising or profiling. Before we do, we will update this policy, and ask for your consent where the law requires it.

Google user data

The Google Sheets connector asks for access to your Google account, through Google's own consent screen, to load a spreadsheet into your organization's database.

• What we access. Read-only access to the spreadsheet whose ID you enter in the connector (scope spreadsheets.readonly), and the email address of your Google account (userinfo.email, openid). We cannot create, change or delete anything in your Google account.
• How we use it. Only to copy the contents of the spreadsheets you connect into your organization's database, each time the connector runs (on its schedule or when you start it), so your organization can query and chart them. The email address identifies which Google account authorized the connector.
• How we store it. The authorization (an OAuth refresh token) is kept encrypted in our database. The spreadsheet contents are stored in your organization's own database. Both are hosted by DigitalOcean, on servers in Europe.
• Who we share it with. Nobody. We do not sell Google user data, use it for advertising, or use it to train artificial intelligence or machine learning models. Our staff do not read it, except with your agreement to help you, for security purposes, or where the law requires it. It is only visible to members of your organization.
• How to remove it. You can revoke our access at any time from your Google account permissions; the connector then stops loading data. You can delete the data loaded into your organization's database at any time, from the Tables page of the application (once you have deleted the connector and anything that reads the table). To have the stored authorization deleted, write to [email protected].

Dataminutes' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who receives your data

We do not sell or rent your data. Only these providers process it, on our behalf and under contract:

• Resend, Inc. (United States), which sends our emails and stores the beta list.
• Stripe Payments Europe, Ltd. (Ireland), which processes subscription payments.
• Grafana Labs (United States), which stores our technical logs.
• DigitalOcean, LLC (United States), which hosts this website and our servers, located in the European Union and the United Kingdom.

Transfers outside the European Union

Resend, DigitalOcean and Grafana Labs are American companies, so your data may be transferred to the United States:

• Resend, under the European Commission's Standard Contractual Clauses, part of its data processing addendum;
• DigitalOcean, under its certification to the EU-U.S. Data Privacy Framework, with the Standard Contractual Clauses as a fallback (data processing agreement);
• Grafana Labs, under the Standard Contractual Clauses of its data processing addendum.

How long we keep it

• Your beta list address: until you unsubscribe or ask us to delete it. After you unsubscribe, we keep only a record that you did, so you are not emailed again.
• Your account and your organization's data: for as long as your organization uses Dataminutes. Ask us and we delete them, except what the law requires us to keep, such as invoices.
• An unconfirmed request: nothing is added to the list, and the link expires after 48 hours.
• Technical logs: at most 30 days, then deleted.

Your rights

You can ask to access, correct or delete your data, to restrict or object to its processing, or to receive it in a portable format, and you can withdraw your consent at any time. Write to [email protected]; we answer within one month.

If you think your rights are not respected, you can complain to the French data protection authority, the CNIL (www.cnil.fr).

Changes

We will update this page if our practices change, and change the date at the top.