Privacy policy
Version 1.1, 28 September 2026. The French text prevails.
The short version
- This site sets no cookie. It measures its traffic with the SiteBehaviour tool, without cookies and without recording your sessions.
- We do not read the mailboxes our customers entrust to us. We run the storage, not the reading.
- Backups stay in France, at OVH, replicated across three independent availability zones.
- A question, an access or erasure request:
contact@istorel.com, and a person answers.
1. Two roles, not to be confused
For backed up content, we act as a processor under Regulation (EU) 2016/679. The customer who subscribes remains the controller: they decide which mailboxes are backed up, and why. The corresponding commitments are set out in annex 1 of the terms, which serves as the agreement required by article 28 of the Regulation.
For everything else, visiting this site, the contact form, creating an account, billing and connection logs, we act as a controller. That is what this policy describes.
2. What we process, and why
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Visiting the site | IP address, page requested, date, browser, in the host’s technical logs | security and troubleshooting | legitimate interest | as long as our host keeps its own logs |
| Contact form | name, email address, company if you fill it in, message | answering you | steps taken prior to entering into a contract | three years after the last exchange |
| Account and billing | login address, password hash, account type, legal name or name, postal address, VAT number | providing and billing the service | performance of the contract | duration of the contract, then fourteen days |
| Invoices issued | identity and amounts | accounting obligation | legal obligation, art. L. 123-22 French commercial code | ten years |
| Connection logs | date, IP address, action performed in the application | account security, evidence | legitimate interest | twelve months |
| Emails sent by the service | recipient address, content of the service message | telling you about a failure or an invoice | performance of the contract | the time it takes to deliver |
| Backed up content | messages, attachments and metadata of the mailboxes declared by the customer | providing the backup | the customer’s instructions, article 28 | duration of the contract, then destruction |
The login password itself is never stored: only its argon2id hash is, and it cannot be turned back into the password. The application passwords a customer provides for each mailbox are encrypted on write and are returned by no route.
3. Cookies and analytics
On this site, no cookie and no ad network. We measure traffic and how pages are browsed (page views, clicks, scrolling) with the SiteBehaviour tool, hosted in the European Union. It sets no cookie and does not record your sessions. These measurements are only used to improve the site: they are neither sold nor used for advertising. Fonts are served from our own domain rather than from Google Fonts.
In the application, one cookie, istorel_session. It keeps you signed in, lasts twelve hours, and carries the HttpOnly, Secure and SameSite=Lax attributes. It is strictly necessary to the service: without it you would retype your password on every screen. It measures nothing and follows nobody from one site to the next.
4. Who your data is passed to
We sell nothing, we trade nothing, and we pass your data to nobody other than the providers below, each for their own part.
| Provider | Role | Location |
|---|---|---|
| OVH SAS | hosting the application and storing the backups | France |
| Scaleway SAS | keeping the database backups | France |
| Infomaniak Network SA | hosting this marketing site | Switzerland |
| Stripe Payments Europe Ltd | collecting payments | Ireland |
| Pennylane SAS | issuing invoices | France |
| GetOnline Ltd (AuthSMTP) | delivering the emails the service sends | United Kingdom |
| Formspree Inc. | delivering this site’s contact form | United States |
| SiteBehaviour | measuring this site’s traffic | European Union |
None of these providers receives backed up content, except OVH, which stores it encrypted without ever having to read it. Stripe does not hand us your card number: it never leaves their own systems.
5. Transfers outside the European Union
Backups do not leave the European Union. Three exceptions, none of which concerns them:
- Switzerland, where this marketing site is hosted. It benefits from an adequacy decision of the European Commission.
- The United Kingdom, where the emails the service sends transit, meaning a recipient address and a mailbox name with a date. The transfer relies on the adequacy decision covering the United Kingdom, renewed in December 2025.
- The United States, where the company delivering this site’s contact form is established. What you write in that form therefore transits there. If you would rather avoid it, write straight to
contact@istorel.com: the same person reads both, and the message then only passes through our own providers.
6. Your rights
You have a right of access, rectification, erasure, restriction, objection and portability over the data concerning you.
To exercise them, write to contact@istorel.com or to LenoIT, 1 rue Anita Conti, 56000 Vannes, France. We answer within one month. We may ask you to prove your identity, but only where the doubt is real: it is a protection, not a formality.
If your messages are backed up because your employer or your IT provider subscribed, ask them first: we act on their instructions, and we cannot decide on our own to erase what they entrusted to us. Write to us anyway if you do not know who to ask, and we will tell you who the controller is.
You may also lodge a complaint with the French supervisory authority, CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr.
7. Security
The technical measures are detailed in annex 2 of the terms. In short: application passwords are encrypted in the database with AES-256-GCM, the master key living outside the database; mailbox access is read only; every object written is replicated across three availability zones; administration actions are logged.
Should a personal data breach occur, we notify the CNIL within seventy-two hours and inform the people and customers concerned without undue delay.
8. Changes
This policy carries a version and a date. Any change is published here. A change of provider that touches our customers’ data is additionally announced to them thirty days in advance, as the terms provide, and they may terminate free of charge if they refuse it.
9. Contacting us
LenoIT, a French limited liability company, 1 rue Anita Conti, 56000 Vannes, France, contact@istorel.com.
Your requests are handled by the manager, who is your contact on this subject. See also the legal notice and the terms.