Privacy policy
Last updated: 2 August 2026
1. Data controller
The controller of the personal data collected through paktPot is:
- Name / Company name : Florent Leprovost
- Trading name : Nanoed SaaS
- Address : 1, rue Geneviève de Gaulle Anthonioz, 44400 Rezé, France
- DPO email : privacy@paktpot.app
2. Data collected
When you use the Service, we collect the following data:
Account data
- Email address (login identifier)
- Username / display name
- Password (stored as a bcrypt hash, not readable)
Agreement data
- Title, type and terms of the deals created
- Email addresses of invited participants
- History of actions (signature, counter-proposal, closure, etc.)
- Timestamps of actions
- Cryptographic fingerprint of signed agreements
Technical data
- Server logs (IP address, user agent) for security purposes
- Session cookie (authentication) and language preference cookie
- Analytics data (pages viewed, actions in the Service, pseudonymous identifier) — only if you have consented to analytics
3. Purposes of processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Account creation and management | Performance of the contract (art. 6.1.b) |
| Operation of the agreements (invitation, signature, PDF) | Performance of the contract (art. 6.1.b) |
| Sending transactional emails (invitations, notifications) | Performance of the contract (art. 6.1.b) |
| Password reset | Performance of the contract (art. 6.1.b) |
| Security and fraud prevention | Legitimate interest (art. 6.1.f) |
| Analytics (analysis of Service usage) | Consent (art. 6.1.a) |
| Compliance with legal obligations | Legal obligation (art. 6.1.c) |
| Feedback sent during the beta | Fixing bugs and improving the Service |
4. Retention periods
- Account data : kept for the lifetime of the account, then 3 years after the last activity (statutory limitation). If the account is deleted, personal data is anonymised immediately — except the name an agreement was already signed under, which is kept with the agreement as proof for the other signatories
- Agreement data : kept for 5 years after the agreement is closed or expires (evidentiary value)
- Technical logs : 12 months maximum
- Reset tokens : 1 hour
- Beta feedback : kept until the end of the beta phase, and deleted immediately if you delete your account
5. Data recipients
Personal data is neither sold nor transferred to third parties for commercial purposes. It may be shared with:
- Vercel Inc. (application hosting (United States — see “Transfers outside the EU” below))
- Neon (database hosting)
- Resend (transactional email delivery (invitations, notifications, password resets))
- Zoho (hosting of the contact mailboxes (contact@ and privacy@), datacentre located in the European Union)
- PostHog (analytics, hosted in the European Union, only if you have consented)
- Competent authorities (where required by law)
Participants in an agreement can see the username and partially masked email address of the other signatories, in line with the normal operation of the Service.
6. Transfers outside the EU
Where processors are established outside the European Union, data transfers are governed by standard contractual clauses approved by the European Commission or by other appropriate safeguards within the meaning of the GDPR.
7. Your rights
Under the GDPR, you have the following rights over your data:
- Right of access : obtain a copy of your personal data
- Right to rectification : correct inaccurate data
- Right to erasure : request deletion of your data (subject to statutory retention obligations)
- Right to restriction : request temporary suspension of a processing operation
- Right to object : object to processing based on legitimate interest
- Right to portability : receive your data in a structured format
To exercise these rights, contact us at privacy@paktpot.app. You also have the right to lodge a complaint with the CNIL, the French data protection authority. The right to object to emails can also be exercised directly, via the “stop receiving these emails” link at the bottom of every invitation and reminder.
8. Cookies
paktPot uses the following cookies:
| Cookie | Purpose | Duration |
|---|---|---|
session | Maintains the authentication session (essential) | Session (browser close) |
locale | Language preference (essential) | 1 year |
pp_consent | Remembers your analytics choice (essential) | 6 months |
ph_* (PostHog) | Analytics — set only after your consent | Up to 12 months |
Essential cookies are strictly necessary and exempt from consent under CNIL guidelines. No advertising cookies are used. Analytics cookies (PostHog) are only set after your explicit consent, collected through the banner shown on your first visit; you may refuse without any loss of Service functionality, and change your mind at any time via the “Manage cookies” link in the page footer.
9. Security
paktPot implements appropriate technical and organisational measures to protect your data: encrypted communications (HTTPS), password hashing (bcrypt), single-use invitation tokens, cryptographic fingerprint of agreements.
10. Changes
This policy may be updated. In the event of a substantial change, users will be informed by email or by a notification on the platform. The date of the last update appears at the top of this document.
This document was drawn up in French. In the event of any discrepancy between language versions, the French version prevails.