Privacy Policy

Last updated: 2026-10-25

Retesco is operated by Positive Science (France). This policy explains what we collect, why, and your rights under the GDPR.

1. Data we collect

Account data: email address, workspace name, password hash (Argon2id — we never store plaintext passwords).
Workspace content: the entities, relationships, files and audit events you or your agents create in your workspace.
Technical logs: IP addresses and request metadata retained for security auditing (30 days).
Billing: processed by Stripe; we store only the customer/subscription identifiers and plan state, never card numbers.

2. Where data is hosted

All application data is hosted in Europe on OVHcloud (a European, non-US provider). Cloudflare is used at the network edge for DDoS protection and CDN — traffic is encrypted end-to-end via Cloudflare Tunnel. Transactional email is delivered through Mailjet (EU region).

3. Legal bases

Contract (Art. 6(1)(b)): operating your workspace, billing, transactional email.
Legitimate interest (Art. 6(1)(f)): security logs, abuse prevention, product telemetry.
Consent (Art. 6(1)(a)): optional marketing communication, where enabled.

4. Sub-processors

OVHcloud (hosting, EU)
Cloudflare (edge network)
Stripe (payments)
Mailjet (transactional email)

5. Retention & deletion

Workspace data is retained while your account is active. Backups rotate out after 30 days. You may request full workspace deletion (Art. 17) at hello@retesco.com; audit records necessary for legal compliance are kept as required.

6. Your rights

You may request access, rectification, erasure, portability or restriction of your personal data, and lodge a complaint with your local supervisory authority (for France: CNIL). Write to hello@retesco.com.

7. Cookies

We use a single session cookie (authentication) and strictly-necessary technical cookies. No tracking cookies, no third-party advertising cookies.

8. Contact

Positive Science — France · hello@retesco.com