Privacy policy

Prepared edition: 4 October 2026 Edition: 2026-10-04.3 English translation of the French reference version

French reference version. The English and Spanish versions are translations of the French document intended to make it easier to understand. In the event of a discrepancy, contradiction, ambiguity or difficulty of interpretation between the language versions, the French version shall prevail to the extent permitted by law. This priority does not restrict any mandatory right, including consumer protections, the requirement to provide clear and comprehensible information, and rules requiring doubts to be interpreted in the consumer's favour. It does not change the specific terms expressly accepted for an order.

1. Controller and scope

SASU Alpha Inova, inovaspaces brand, share capital EUR 1,000, Rouen Trade and Companies Register number 914 975 735, 72 rue de la République, 76140 Le Petit-Quevilly, France, controls processing necessary for the website, customer relationship and studio services. Contact and exercise of rights: contact@inovaspaces.com or post to the registered office. This notice covers browsing, forms, accounts, quotations, orders, payments, production, delivery, support and administration.

2. Data used

We use names, email addresses, verified account identities, language and notification preferences; contact, billing, telephone and business details when supplied; property information, photographs, languages, formats, instructions and quotation prices. Orders include payment references, amounts, taxes, statuses, refunds, consents, availability and deadlines. Messages and attachments, dates and replies are retained for contact and support. Technical data includes available access and security logs, abuse-limiting identifiers, preferences and cookie choices. Stripe receives card data directly; the website does not retain full card numbers or security codes. Send only useful material; remove private documents, faces, third-party contact details, occupancy information and sensitive data unnecessary for a property presentation.

3. Purposes and lawful bases

Accounts, requested quotations, orders, payment, production, translation, delivery and related support rely on the contract or requested pre-contractual measures, GDPR Article 6(1)(b). Required fields enable the corresponding service. Accounting, tax and lawful authority requests rely on legal obligations, Article 6(1)(c). Proportionate security, fraud prevention, abuse limitation, troubleshooting and defence of rights rely on legitimate interests, Article 6(1)(f), with the applicable right to object. A general enquiry is handled on the basis of pre-contractual steps or the legitimate interest in responding, according to its purpose. Optional external players require the applicable prior consent, Article 6(1)(a) and tracking rules. Consent is withdrawn in Cookie settings. No advertising or audience-measurement tracker is installed in this edition. Transactional and support messages concern the requested service; a notification preference is not marketing consent. Browsing and reading this notice are not blanket consent.

4. Recipients and providers

Only authorised studio personnel and necessary contributors access data useful for their task. Google Firebase and Google Cloud provide hosting, authentication, database and storage; Stripe handles payment and fraud prevention; Resend provides transactional emails. Vimeo or YouTube receive data relating to an embedded player only after external-media permission. Accountants, advisers and authorities may receive necessary data that can lawfully be disclosed. Data is not sold. Certain text-generation or translation functions send useful property text to OpenAI when those functions are requested. This does not authorise unrelated use of photographs or private data. If we process personal data on a customer's behalf in production, an agreement compliant with Article 28 must define instructions and subprocessors; ordinary website terms do not replace that agreement.

5. Location and transfers

The App Hosting backend is in the Netherlands; this does not limit every provider operation to the EU. Authentication, email, payment, media and AI may involve access or processing in other countries. A transfer requires a valid mechanism under GDPR Chapter V, such as an applicable adequacy decision or standard contractual clauses with necessary supplementary measures. Details and safeguards may be requested from the studio contact. A cookie choice does not replace safeguards for other transfers.

6. Retention

Periods respond to the purpose, obligations and justified evidence needs. Account and performance data remain necessary during the relationship and orders. Inactive accounts and ordinary communications are reviewed after three years without relevant activity; closing an account may trigger earlier review. Enquiries without orders are reviewed no later than three years after the last substantive contact; ordinary support cases three years after closure. Contract evidence may require restricted archiving during the applicable limitation period, ordinarily five years; accounting records and invoices generally ten years. Statutory archiving of electronic consumer contracts worth at least EUR 120 also applies for ten years under its conditions. An ongoing dispute or specific obligation may justify a restricted extension. The download deadline, normally 30 days, is not a promise to erase sources, production copies and evidence simultaneously. Files are reviewed according to the configured retention target and deleted when no longer necessary, subject to justified retention. Security logs and technical limits are handled separately and proportionately. Cookie choices expire after 180 days. Closing an account does not erase legally required records. The studio manages reviews and requests; the notice does not promise automatic purging of every database.

7. Security and access

Private orders and administration functions require role and identity checks; downloads are controlled and data transports secured. The guest flow uses an HTTP-only token. A custom presentation requires its customer's authorised session; a ready-made presentation accessed by direct link is not confidential merely because of that link. Email or download links may contain tokens: do not share them unnecessarily. The studio limits operational access. A breach is notified to the authority within 72 hours of awareness where required, and to affected people according to the statutory risk threshold.

8. Your rights

Subject to legal conditions, you may request access, rectification, erasure, restriction, portability, objection to legitimate-interest processing and withdrawal of consent without retroactively affecting prior lawfulness. French law also provides for instructions after death. Send your request to contact@inovaspaces.com, specifying the account or order; identity is verified proportionately without routinely requesting an identity-document copy. A response is normally provided within one month. If complexity or volume permits two additional months, we explain this within the first month. Handling is normally free; a legally permitted exception is explained. An accounting obligation or evidence need may limit erasure, with information and restricted access. You may complain to the CNIL, https://www.cnil.fr/fr/plaintes, or a competent authority without first contacting us.

9. Automated decisions and minors

The studio does not use the website to make exclusively automated decisions producing legal or similarly significant effects for its customers. Technical anti-abuse checks and the payment provider's own checks exist. The service is intended for adults or authorised representatives; do not send minors' data without an agreed necessity and justification.

10. Updates and information

The date and edition identify the notice. A change of purpose or provider requires an update and appropriate legal steps; publishing a notice does not create consent. Information: https://firebase.google.com/support/privacy/; https://cloud.google.com/privacy; https://stripe.com/privacy; https://resend.com/legal/privacy-policy; https://openai.com/policies/privacy-policy/; https://vimeo.com/privacy; https://policies.google.com/privacy.

2026-10-04 · Version 3

Your privacy