This is a translation of the French privacy policy. If the two versions differ, the French version prevails.
In short
Le Secrétaire keeps your paperwork in order. Your documents are encrypted with a key created on your phone, which we do not have: neither Voidstorm nor our hosting provider can read them once they are stored.
If you turn on artificial intelligence analysis, the content of a document passes through our server in France and then through Mistral AI, a French provider, only for the time of the analysis. Mistral AI does not keep it and does not use it to train its models. This analysis only happens with your explicit consent, which you can withdraw at any time in the settings. Without it, the app still works.
Your documents and account data are hosted in France. You can delete your account from the app: your data is then erased within 14 days. Any questions: contact@lesecretaire.app.
Who is responsible for your data
The data controller is Voidstorm SAS, a French company with a share capital of €10, registered with the Nantes Trade and Companies Register under number 932 777 154, with its registered office at 6 rue Léon Bérard, 44200 Nantes, France.
Voidstorm has not appointed a data protection officer. For any question about your data or to exercise your rights, write to contact@lesecretaire.app.
What data we process and why
We only collect what the service needs to work. There is no advertising, no sale of data and no profiling.
| Situation | Data involved | Why |
|---|---|---|
| Creating your account | Email address (or the relay address provided by Apple if you hide your email), Apple or Google technical identifier, creation date, language | To create your account and recognise you. Email sign-in works with a link sent to your address: there is no password. |
| Your devices | Device identifier, device public key, enrolment date | To make sure only your devices can open your vault |
| Your documents (free version) | PDFs and their index stay on your phone | Nothing is sent to our servers, unless you turn on AI analysis (see below) |
| Your documents (Pro version, backup) | End-to-end encrypted files, size, date | To back up and sync your documents across your devices. We store encrypted files that we cannot read. |
| AI analysis (OCR and sorting) | Document content during processing; analysis result (document type, date, amount, issuer…) sent back encrypted | To read the document’s text and fill in its record automatically. Only with your consent. |
| Natural-language search | Your question and part of your index (names, types, dates, analysis results), never the content of your documents | To understand a search such as “all my invoices from 2022”. Only with your consent. |
| Subscription and purchases | Subscription identifier, chosen plan, subscription status, transaction identifiers provided by Apple or Google, pages used in the month | To manage your plan and quotas. We never see your banking details: payment is handled by Apple or Google. |
| Service emails | Email address, type of email sent (sign-in link, confirmation, security alert) | To send you the emails your account needs to work |
| Security and technical logs | IP address, device type and app version, request timestamps | To protect the service against abuse and outages, and to meet our legal obligations |
| Server error reports | Type of error, place in our code where it happened, route concerned, technical identifiers (account, document, job). Never the content of your documents, your searches, your email address or your IP address. | To detect and fix malfunctions of the service |
| App usage statistics | Actions taken in the app (for example “document imported”, “search started”), app and system version, device language, country and region derived from the IP address. No account, device or advertising identifier, and never the content or name of your documents. | To know which features are used so we can improve the app. Can be turned off at any time in the settings. |
| Support and requests about your rights | Email address, content of your message | To reply to you and keep a record of the request |
| Website lesecretaire.app | Email address if you sign up for the beta; visit statistics without cookies | To let you know when the service opens; to measure website traffic |
Your documents may contain sensitive data (identity document, health document, payslip…). We do not read them: they stay encrypted in your vault. Only AI analysis, if you turn it on, makes this content pass through our systems, under the conditions described below.
Encryption: what we cannot see
When you create your account, the app generates a master key on your device that belongs to you alone. We do not have a copy. Each document is encrypted with its own key, which is itself locked by your master key. Our servers only store encrypted files and locked keys, which they cannot open.
Your recovery phrase (24 words) is the only way to recover your master key. We do not know it and cannot reset it. If you lose it and no longer have any signed-in device, your backed-up documents become permanently unreadable, for you as well as for us.
To add a new device, you scan a code from a device that is already signed in, or you enter your recovery phrase. AI analysis results are also encrypted with your key before being stored.
The only exception to this principle is AI analysis, described in the next section.
Artificial intelligence analysis and your consent
The app works without AI: you can scan, import, sort and view your documents without anything leaving your device.
When you finish your first import or scan, the app asks whether you accept AI analysis. Your answer, its date and the version of the text you were shown are recorded on our servers. You can accept or withdraw this consent at any time in the settings. If you refuse, the analysis and natural-language search features are simply turned off.
If you accept, here is exactly what happens:
- The document is decrypted on your device and sent, over an encrypted connection, to our server hosted in France by OVH.
- Our server passes the content to Mistral AI, a French company, for text recognition (OCR) and analysis. Mistral AI processes the content in memory, without keeping it (“zero data retention” is turned on for our account) and without using it to train its models.
- Our server only keeps the content in readable form for the time of processing. Once the result is produced, the content is erased. The result (document type, date, amount, issuer…) is sent back encrypted with your key.
- For search, only your question and part of your index (names, types, dates, analysis results) are sent to Mistral AI. The content of your documents is never sent for a search.
Your documents may contain so-called sensitive data under the GDPR (health, origin, opinions…) or identity numbers. By accepting the analysis, you explicitly consent to this data being processed under the conditions above (Article 9(2)(a) GDPR).
The AI makes no decision about you. It suggests a classification and information that you can correct. It can be wrong: check important information.
Legal bases
The GDPR requires a legal ground for each use of your data. Here are ours.
| Processing | Legal basis |
|---|---|
| Account, devices, encrypted vault, subscription, service emails | Performance of the contract between us (our terms of use) |
| AI analysis and natural-language search | Your explicit consent, which you can withdraw at any time |
| Technical logs, protection against abuse | Our legitimate interest in securing the service, and our legal obligations to retain connection data |
| Server error reports | Our legitimate interest in detecting and fixing malfunctions of the service |
| Replying to requests to exercise your rights | Legal obligation |
| Keeping sales records | Legal obligation (accounting) |
| Signing up for the beta on the website | Your consent |
| Website audience measurement (without cookies) | Our legitimate interest in knowing how much the website is visited |
| App usage statistics | Our legitimate interest in improving the app; you can object at any time by turning them off in the settings |
Recipients and processors
Only Voidstorm has access to your account data. We use the following providers, each bound by a data processing agreement that complies with Article 28 GDPR.
| Provider | Role | What it processes | Location |
|---|---|---|---|
| OVH SAS (Roubaix, France) | Hosting of servers, database and backups; contact@lesecretaire.app mailbox | Account data, encrypted files, technical logs, messages sent to support | France |
| Mistral AI (Paris, France) | Text recognition, analysis and search | Document content during analysis, search queries and partial index. Zero data retention, no training. | European Union |
| Scaleway SAS (Paris, France) | Sending service emails | Email address, content of the emails sent | France / European Union |
| RevenueCat, Inc. (United States) | Subscription tracking | Subscription identifier, plan, status, transaction identifiers | United States |
| Aptabase (Technov Solutions SRL, Bucharest, Romania) | App usage statistics | Usage events, app and system version, language, country and region. The IP address is only used to derive the country and is not stored. | European Union (Germany) |
| Sentry (Functional Software, Inc., San Francisco, United States) | Error reports from our server | Type of error, place in our code, route concerned and technical identifiers (account, document). Never the content of your documents, your searches, your email address or your IP address. | European Union (Germany) |
Apple and Google are not our processors: they handle app downloads, payment and, if you use them, sign-in with your Apple or Google account. They act on their own behalf, under their own privacy policies.
Transfers outside the European Union
Your documents, your account data, AI processing and usage statistics stay in the European Union, and mostly in France.
Only one provider is located outside the European Union: RevenueCat, in the United States, for subscription tracking. It only receives a technical identifier, your plan, your subscription status and the store transaction identifiers, never your documents or your email address. This transfer is covered by the European Commission’s standard contractual clauses, included in RevenueCat’s agreement.
Sentry stores our server’s error reports in the European Union (Germany). As Sentry is an American company, its staff or subcontractors outside the European Union may access them, for example for technical support. This possible access is covered by the European Commission’s standard contractual clauses, included in Sentry’s agreement.
Apple and Google may process your data outside the European Union under their own rules, for the services they provide to you directly (account, payment).
How long we keep your data
| Data | Retention period |
|---|---|
| Account, devices, encrypted vault, analysis results, AI consent | As long as your account exists, then erased within 14 days after the account is deleted |
| Document content during AI analysis | For the time of processing, then erased immediately. Nothing is kept by Mistral AI. |
| Database backups | 30 days at most (encrypted backups at OVH), after which deleted data also disappears from backups |
| Subscription data | As long as your account exists; sales records needed for accounting are kept for 10 years in aggregated form |
| Technical logs (IP address, requests) | 12 months, the legal retention period for connection data in France |
| Server error reports (Sentry) | 30 days, then deleted by Sentry |
| Service emails | Sending history kept by Scaleway according to its own retention periods, then deleted |
| Support requests and requests to exercise your rights | 1 year after our reply (6 years for objections), in line with CNIL recommendations |
| Beta sign-up | Until the end of the beta, and at most 12 months after sign-up |
| Website visit statistics | Aggregated data without identifiers, kept for 25 months at most |
| App usage statistics | The IP address is never stored. The code that groups the events of a single day is erased within 48 hours; after that, the statistics can no longer be linked to anyone and are kept for at most 5 years by Aptabase. |
If your subscription expires, your documents remain available to read as long as your account exists. Only deleting your account triggers erasure.
Your rights and how to exercise them
You have the following rights over your data:
- Access: find out what data we hold about you and get a copy.
- Rectification: correct inaccurate data.
- Erasure: delete your account and your data. You can do this directly in the app, in the settings. Erasure takes effect within 14 days.
- Portability: get your documents and your index back in a readable format. Export is done from the app, because we cannot read your encrypted documents.
- Restriction: ask us to temporarily freeze a processing operation.
- Objection: object to processing based on our legitimate interest. For usage statistics, simply turn them off in the app settings.
- Withdrawal of consent: turn off AI analysis at any time in the settings, with no effect on the rest of the service.
- Instructions after death: tell us what you want to happen to your data after your death (French Data Protection Act).
To exercise a right that is not available in the app, write to contact@lesecretaire.app from the email address of your account, so that we can identify you. We reply within one month, which can be extended by two months for complex requests.
If you believe your rights have not been respected, you can lodge a complaint with the CNIL or with the data protection authority of the EU country where you live (see the last section).
Security
Security is at the heart of how Le Secrétaire is designed. The main measures:
- End-to-end encryption of documents and analysis results, with a master key we do not have.
- Each document has its own encryption key, locked by your master key.
- Passwordless sign-in: a one-time link sent by email, or Apple / Google sign-in.
- All communications are encrypted (TLS).
- Hosting in France, at OVH, on servers dedicated to the app. Database separate from the application server.
- Encrypted backups, kept for 30 days.
- Technical secrets (access keys to providers) are encrypted and never stored in plain text in the code.
- Administration interface only reachable from a restricted network, with a dedicated account. Even the administrator cannot read your documents.
- Account deletion by the administrator follows the same delay and process as deletion by the user.
- Duplicate detection and quota checks without access to document content.
In the event of a data breach likely to put you at risk, we will inform you and notify the CNIL within 72 hours, as the law requires.
Minors
Le Secrétaire is intended for people aged 15 and over. Under 15, creating an account requires the consent of a parent or guardian, who can write to us at contact@lesecretaire.app. If we learn that an account was created by a child under 15 without this consent, we delete it.
Usage statistics in the app
To know which features are used and which to improve, the app sends usage statistics to Aptabase, a privacy-focused analytics tool hosted in the European Union (Germany). These statistics are on by default and you can turn them off at any time in the settings: nothing is sent any more.
What is sent: the name of the action (for example “document imported” or “search started”), the date and time, the app and system version, and the device language. Aptabase uses your IP address when it receives the data to derive the country and region, then discards it. No account, device or advertising identifier is used, and nothing makes it possible to follow you from one day to the next or from one app to another. We never send the content, name or type of your documents, your searches, or your email address.
The app does not use any crash reporting tool. Only errors on our server are reported, to Sentry (see “Recipients and processors”).
Website, cookies and audience measurement
The lesecretaire.app website uses no advertising cookies and no third-party trackers. Audience measurement is done with Umami, hosted on our own servers in France and set up without cookies or persistent identifiers: we see how many people visit each page, from which country and with which type of browser, without being able to identify anyone. Under CNIL rules, this setup does not require your consent.
If you leave your email address to join the beta, we only use it to let you know when the service opens and to give you access to the test version. You can ask us to delete it at any time.
Changes to this policy
We may update this policy, for example if we add a provider or a feature. The date at the top of the document shows the version in force. In case of a significant change (new recipient, new purpose), we will let you know in the app or by email before it takes effect. If a change concerns AI analysis, you will be asked for your consent again.
Contact and complaints
For any question about your data: contact@lesecretaire.app
You can also lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at www.cnil.fr. If you live in another EU country, you can also contact your local data protection authority.