Privacy policy

1. Data controller

The data controller is the publisher of the WorkFloor app, an individual. Contact for any question about your data: workfloor@tutamail.com.

2. Data collected

Account: email address, password (stored hashed, never in plain text), creation and last sign-in dates. If you sign in with Apple or Google, we receive your email address from that provider (possibly a relay address hidden by Apple) and a technical identifier, never your password.

Contributions: reviews (ratings, texts, job title, contract type, declared salary), “helpful” votes, reports and hidden authors. Reviews are published without any identifier; the link between your account and your reviews is kept internally so you can edit them and to enforce the one-review-per-company rule, until your account is deleted.

Anti-abuse data: when you publish, your IP address is recorded in hashed (irreversible) form to limit bursts of submissions and detect fake review campaigns. The creation date of your account is used for the same purposes.

Crash reports: when the app crashes, technical information (device model, system and app version, error trace) is sent to our diagnostics tool, without your email address.

Preferences: your language, your answers to the welcome questionnaire and your display choices stay on your device and are not sent to us.

We do not collect your location, contacts or photos, and we do not use any advertising identifier.

3. Purposes and legal bases

Providing the Service (account, publishing, votes, reports, password reset): performance of the terms of use.

Preventing spam and abuse, moderating content, securing the Service, diagnosing errors: legitimate interest.

Responding to judicial requests concerning existing data: legal obligation.

4. Recipients and processors

Your data is never sold or used for advertising. It is processed by our service providers, strictly within the scope of their mission:

Supabase Pte. Ltd. (Singapore): database and authentication, data hosted in France (Paris) on Amazon Web Services infrastructure.

OpenAI Ireland Ltd (Ireland): automated moderation of review texts, sent without any identifier. Texts may be processed in the United States by OpenAI, L.L.C.; this transfer is covered by the European Commission’s standard contractual clauses. Texts are not used to train OpenAI’s models.

Google Ireland Ltd: sign-in with Google if you choose it.

1&1 Mail & Media GmbH (GMX, Germany): sending password reset emails.

Tutao GmbH (Tuta, Germany): encrypted mailbox of the contact address, which receives your requests and reports by email.

GitHub, Inc. (United States): hosting of the information web pages (support and legal documents), which technically logs their visitors’ IP addresses; transfer covered by the EU-US Data Privacy Framework.

Apple Distribution International Ltd: sign-in with Apple if you choose it.

Functional Software, Inc. (Sentry): crash reports, data hosted in the European Union (Germany).

650 Industries, Inc. (Expo, United States): delivery of app updates, transfer covered by standard contractual clauses.

Judicial authorities may obtain certain data upon request.

5. Retention periods

Account, reviews, votes, reports and hidden authors: until your account or the content concerned is deleted.

Hashed IP addresses: 30 days.

Account deletion: all data linked to the account (email address, reviews, votes, reports, hidden authors, hashed IP addresses) is erased immediately and permanently. No copy or archive is kept. Only company pages remain, taken from the public SIRENE register and not linked to your account.

Crash reports: 90 days at most.

Requests sent by email (exercise of rights, content notices): three years from the last exchange, to evidence how they were handled.

6. Your rights

You have the right of access, rectification, erasure, restriction, objection and portability, as well as the right to set instructions regarding your data after your death. Account deletion is available directly in the app. For other requests, write to workfloor@tutamail.com from your account’s email address; we reply within one month.

You can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

7. Deleting your account

In the app: open the “Account” tab, tap “Delete my account”, then “Delete permanently”. Deletion is immediate: your email address, reviews, votes, reports and hidden authors are erased, with no copy kept.

If you no longer have access to the app, write to workfloor@tutamail.com from your account’s email address asking for its deletion. It is carried out within 30 days and you receive a confirmation.

8. Security and on-device storage

Connections are encrypted, passwords hashed and access to data restricted by database-level security rules.

The app stores on your device your sign-in session (strictly necessary), your language and your preferences. It contains no analytics or advertising tools and uses no advertising identifier.

The information web pages use no cookies and no analytics.

9. Minors

The Service is reserved for people aged 16 or over. If you become aware that a child under 16 has created an account, write to workfloor@tutamail.com: the account will be deleted.

10. Changes

This policy may change. You will be informed in the app of any significant change.