Privacy Policy

Chiara Cornu, sole trader, 39 rue Lejeune, 31000 Toulouse, France, SIRET 992 202 200 000 18, is the data controller for the processing described below.

Contact: ex.erp.contact@gmail.com

EX ERP processes data at two distinct levels:

• Your own data, as a user of the application (account, billing, login): here, EX ERP is the data controller.
• The data of your own customers, which you enter into the application as part of your reselling activity (a buyer's name, contact details, for example): here, EX ERP acts as a data processor, on your behalf. You remain the data controller for this data with respect to your own customers, and must in particular inform them of their rights where necessary.

• Account data — name, email, password (encrypted), company, SIRET: to create and manage your account.
• Billing data — subscription history, payment method (managed by Stripe, never stored by us): to bill your subscription.
• Usage data — pages viewed, actions taken in the application: for support and to improve the service.
• Data you enter — product records, sales, returns, your customers' contact details: for the operation of the service (see point 2).

We do not currently collect any data through an audience-measurement or emailing tool (Google Analytics, Mailchimp, or equivalent) — if this changes, this policy will be updated beforehand.

• Performance of the contract between us (providing the service you subscribed to) for account and billing data.
• Legitimate interest (security, fraud prevention, service improvement) for usage data.

• Stripe (payment) — receives and retains only the data necessary for payment; EX ERP never stores your card number.
• Supabase (database hosting, European Union region).
• Vercel (application hosting).

No data is sold or transferred to third parties for commercial purposes.

Your account data is kept for the entire duration of your subscription, then for 30 days after your account is closed, after which it is deleted, unless a longer legal retention period applies (accounting records, in particular).

Under the General Data Protection Regulation (GDPR), you have the right to access, rectify, erase, restrict, object to, and port your data.

To exercise any of these rights, write to ex.erp.contact@gmail.com. You also have the right to lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

Data is hosted on secure infrastructure (Supabase, EU region), with access protected by an encrypted password. Data isolation between each user company is guaranteed at the database level: one company can never access another's data.

EX ERP only uses cookies strictly necessary for the service to function (keeping you logged in). No audience-measurement or advertising cookies are used at this time.

This policy may be updated, in particular in the event of changes to the service or to applicable regulations. The last-updated date is shown at the top of this document.