Privacy

Data controller

SeveUp, contact@seve-up.com (same details as the legal notice).

Data collected

• Account: email and organisation, entered at sign-up, needed to create and secure your account.
• Session cookie: an authentication token (httpOnly, not readable from JavaScript), valid up to 7 days or until the token expires. Strictly necessary, no consent required.
• Language cookie: remembers FR/EN. Strictly necessary, no consent required.
• Business content (IFC models, BIM requirements, dashboards): uploaded by your organisation, processed on your organisation's behalf. SeveUp does not use it for its own purposes.

Audience measurement on public pages

• Cloudflare Web Analytics counts visits to public pages (page views, referring page, device type, country). It sets no cookie and uses no persistent identifier, so no consent is requested.
• Google Analytics 4 is only loaded after you click "Accept" in the banner. It then sets the _ga and _ga_* cookies, kept for 13 months at most, to tell visits apart and measure journeys. Google's advertising signals stay denied. Without acceptance, no request is sent to Google.
• Your choice is kept in your browser's local storage: 13 months after accepting, 6 months after declining, after which the banner is shown again. You can change it at any time with the "Manage cookies" link at the bottom of every public page; withdrawing consent deletes the _ga cookies.
• Both measurements only cover public pages (home, help, blog, glossary, legal pages). The logged-in application loads neither.

Behavioural analytics (PostHog)

SeveUp App integrates PostHog (EU hosting) to understand product usage by logged-in accounts: click paths, and session replay with input fields masked. As of this page, this measurement is NOT active in production: the activation key is not set. If it ever is, this page will be updated before activation, together with the required consent collection.

Purposes

Providing the service, authenticating accounts, support and, if activated, improving the product. No data is sold or used for advertising.

Subprocessors and hosting

Vercel Inc. (site hosting, Frankfurt), Render (API hosting, Frankfurt), Supabase (database and file storage, Ireland), Modal (processing of uploaded IFC files), OpenAI (extraction of requirement rules by an AI model, on the document pages you submit only), Resend (sending of the service's emails, Ireland). Each acts as a subprocessor on SeveUp's behalf. These are US companies; transfers outside the European Union are covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses. For audience measurement on public pages: Cloudflare (Web Analytics) and, only if you accept, Google (Google Analytics 4).

Retention period

Account data is kept for the lifetime of the account. Account deletion requested at contact@seve-up.com is carried out within 30 days; at the end of a contract, content is deleted as set out in article 14 of the terms of service. A detailed retention policy per data type is available on request at contact@seve-up.com.

Your rights

Access, rectification, erasure, portability and objection, on simple request at contact@seve-up.com. You can also lodge a complaint with the CNIL (3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr) or your local data protection authority.