Data collected
When creating an account: last name, first name, email address, password (hashed), company name, country.
When using the platform: documents you upload for review, your review settings, processing history, credits consumed.
Technical: application logs (timestamp, IP address) for security and traceability purposes.
Documents space: the files your organisation deposits there and their SHA-256 fingerprint, and a journal of every action on these files and folders (author, date, action, name, fingerprint, IP address).
Processing purposes
Provision of the AI-assisted document review service, billing, customer communication, security and fraud prevention, legal obligations.
No AI model training is performed on your documents.
Documents space: storage and sharing of the files of your organisation, and a journal of their actions to keep track of them; the owners and administrators of your organisation can read the journal, as can Eryon's administrators for support and security, each of their readings being itself recorded.
Legal basis
Performance of the contract (provision of the service), legal obligations (billing, accounting retention), legitimate interest (security, fraud prevention).
Retention period
Account data: for the entire duration of the contractual relationship, then 3 years after account closure.
Uploaded documents: kept as long as the review exists, deleted on request or when the review is deleted; when the account is deleted, archived out of reach then permanently purged after six months.
Technical logs: 12 months maximum.
Documents space: files are kept until they are deleted; a deleted file stays 15 days in the trash, then is erased. Journal of actions: 5 years; IP addresses of this journal: 1 year, or 5 years on the written request of your organisation.
Billing data: 10 years (accounting obligation).
Your GDPR rights
Right of access, rectification, erasure, restriction, objection, portability. To exercise your rights: write to contact@eryon.eu.
You also have the right to lodge a complaint with the CNIL (www.cnil.fr).
Processors and transfers
Hosting: 3DS OUTSCALE (France, EU).
Transactional email delivery: Brevo (France, EU).
Time-stamping of the documents space journal: every day, for each organisation whose journal changed, only a cryptographic fingerprint (SHA-256) of a control line of the journal is sent to a time-stamping authority: FreeTSA (a service run by a private person, server in the United States) or, as a fallback, Open TSA (Germany). No document, no file name and no personal data is sent to them.
AI processing: providers involved to be qualified depending on the use case, with contractual commitments to be verified according to the scope.