Privacy policy

The controller of the personal data collected on the upluce.com site and the Upluce platform is:

UPLUCE — SASU with share capital of €1,000.00

Registered office: 66 Avenue des Champs-Élysées, 75008 Paris

SIRET: 103 055 166 00013

Email: contact@upluce.com

Phone: +33 9 79 24 53 16

In the course of its business, UPLUCE collects and processes the following categories of personal data:

Identification data: surname, first name, email address, telephone number, company name.

Account data: username, password (hashed), avatar, role within the organisation.

Connection data: IP address, browser type (user-agent), country (via IP geolocation), device type.

Browsing data: pages visited, scroll depth, time spent on pages, web performance metrics (LCP, CLS, INP), entry and exit URL, referrer.

Communication data: content of messages sent through the contact and booking forms.

Commercial data: quotations, invoices, contracts, payment history.

Appointment data: client name, email, telephone, date, service, notes.

Form data: responses to forms created through the platform, metadata (IP, user-agent, referrer).

This data is collected when you:

- Complete a contact or quotation request form

- Create an account on our platform

- Book an appointment online

- Respond to a form created with Upluce Forms

- Browse our website

- Correspond with us by email or telephone

- Make an online payment

The personal data collected is used for the following purposes:

- Client relationship management: responding to your requests, drawing up quotations, following up our services and managing appointments.

- Provision of our services: managing your account, access to the platform, processing forms and bookings.

- Payment and invoicing: processing payments via Stripe, issuing invoices, cash-flow monitoring.

- Audience measurement: analysing traffic and browsing behaviour through our in-house measurement system (not a third-party service) in order to improve the user experience.

- Security: logging user actions (activity logs) for fraud detection and platform security.

- Legal obligations: accounting, invoicing, dispute management.

The processing of your personal data is based on the following legal bases, in accordance with the GDPR:

- Your consent: for the setting of non-essential cookies.

- Performance of a contract: for processing the data necessary to carry out our services (client account, invoicing, appointments).

- UPLUCE's legitimate interest: for audience measurement, improving our services and platform security.

- Legal obligations: for compliance with our accounting and tax obligations.

UPLUCE uses an in-house audience measurement system (developed by us, hosted on our servers) rather than a third-party service such as Google Analytics.

This system collects the following data:

- Pages visited, URL, page title, referrer

- Scroll depth and engagement time on each page

- Web performance metrics (LCP, CLS, INP)

- Clicks on elements marked for tracking

- JavaScript errors (for technical diagnosis)

- Device type, browser, country (via anonymised IP geolocation)

Visitors are identified using a device fingerprint (screen size, language, time zone) or a random identifier. No third-party cookie is set for this purpose. The session identifier is stored in sessionStorage (cleared when the tab is closed).

This data is processed in aggregate form and cannot identify you personally.

Our site and our platform use the following cookies:

Strictly necessary cookies (do not require your consent):

- upluce_token: authentication cookie containing your session token (JWT). Lifetime: 7 days. Required to keep you signed in to the platform.

Local storage:

- Browsing session (sessionStorage): anonymous session identifier for audience measurement. Cleared when the tab is closed.

UPLUCE sets no advertising cookie and no social network cookie. No third-party cookie is used on the upluce.com site.

Your personal data may be passed to the following recipients strictly within the scope of our activities:

- IONOS SARL (hosting): 7 Place de la Gare, 57200 Sarreguemines, France — hosting of the web infrastructure.

- Stripe Inc. (payments): secure processing of online payments. Your email and billing metadata are sent to Stripe when a payment is made. Stripe is PCI-DSS Level 1 certified.

- SMTP server (transactional emails): sending notification emails (appointment confirmation, password reset, form notification). The recipient's email address and the message content are transmitted.

- AWS S3 / MinIO (file storage): uploaded files (form attachments, documents) are stored on a secure object storage service.

UPLUCE neither sells nor rents your personal data to third parties. Data is disclosed to authorities only under a legal obligation.

Your personal data is retained for a period proportionate to the purpose for which it was collected:

- Client account data: for the entire duration of the business relationship, then 3 years after the last contact.

- Contact form data: 3 years from submission.

- Billing and payment data: 10 years in accordance with accounting obligations.

- Appointment data: duration of the business relationship, then 3 years.

- Browsing and audience measurement data: 13 months maximum.

- Authentication cookie: 7 days.

- Activity logs: 12 months.

On expiry of these periods, your data is deleted or anonymised.

In accordance with the GDPR and the French Data Protection Act, you have the following rights:

- Right of access: to obtain confirmation that your data is being processed and to receive a copy of it.

- Right to rectification: to request the correction of inaccurate or incomplete data.

- Right to erasure: to request the deletion of your data under the conditions provided by law.

- Right to restriction: to request the restriction of the processing of your data.

- Right to portability: to receive your data in a structured, machine-readable format.

- Right to object: to object to the processing of your data on legitimate grounds.

- Right to withdraw consent: to withdraw your consent at any time for processing based on it.

To exercise these rights, contact us at: contact@upluce.com

We undertake to respond within a maximum of one month.

You also have the right to lodge a complaint with the CNIL (the French data protection authority) — www.cnil.fr

UPLUCE implements appropriate technical and organisational measures to ensure the security and confidentiality of your personal data:

- Encryption of data in transit (HTTPS/TLS)

- Passwords hashed with bcrypt (never stored in clear text)

- Encryption of sensitive data at rest (dedicated encryption key)

- Restricted access to data on a need-to-know basis (roles: admin, manager, client)

- Regular, secure database backups

- JWT authentication tokens with expiry

- Logging of access and actions (activity logs)

For any question about the protection of your personal data or to exercise your rights:

UPLUCE

66 Avenue des Champs-Élysées, 75008 Paris

Email: contact@upluce.com

Phone: +33 9 79 24 53 16