Where your data is, and who can look at it

An email testing service receives reset links, one-time codes and sometimes real addresses. “Who can read this” deserves a precise answer rather than a compliance badge.

Hosting

In France, with OVHcloud. Database, raw message storage and application services: all in the same place.

Sub-processors

The list is published on the site, it is short, and it is kept up to date with thirty days’ notice before any addition. It is short because that is a design commitment, not a coincidence:

• no behavioural analytics tool;
• no advertising network;
• no support tool hosted outside the European Union;
• no third-party data warehouse;
• no remote fonts, no CDN, no third-party script on the site.

The usage data used for billing is computed and kept in our own database.

How long your messages stay

The number of days depends on your plan, and the sweep is not optional: it removes the row and the raw file. See quotas-et-retention.

Keeping test messages indefinitely would be a risk for you before it was a cost for us.

The DPA

Downloadable online, without having to ask. So is the sub-processor register. Having to write to a salesperson to obtain a standard contractual document is exactly the friction this product refuses.

A support session: what we can see, and what we cannot

Diagnosing a problem sometimes requires seeing your account as you see it. That is called a support session, and it is bounded.

What you observe. A permanent banner that nobody can dismiss, with a button to end the session. If it is not there, there is no session.

The bounds:

Reason required	Recorded before the session opens, even if it is never used
Duration	One hour at most
Reading	Free, for diagnosis
Writing	Refused by default
Always refused	Password, address, two-factor, account deletion, SSO configuration, the shape of the organization — no consent unlocks these

If we need to change something, we ask you. A window appears in your application, carrying the reason exactly as we wrote it. An owner or an admin answers from their own session — never from the support session. Consent lasts one hour at most and you can withdraw it at any moment from the banner, without ending the session.

A refusal cannot be asked again within the same session. Trying again forces us to open a new one, which costs another journal entry and another reason.

Everything is journalled in an append-only record: opening, reason, write request, consent, refusal, withdrawal. “Why did somebody sign in to this account?” must be answerable six months later without asking anyone.

Your rights

Access, rectification, erasure, portability: deleting the account and deleting the organization are both done from the application, immediately — see compte-et-securite and organisation. For anything else, the contact address is on the site.