Translation provided for information only; only the French version is legally binding. Read the French version
Data controller
The company 022, a French SAS with a share capital of €1, 27 avenue Jean Médecin, 06000 Nice, France, SIREN 131 478 737, publisher of Nebus. Contact: contact@nebus.app.
Data collected
When you create your account: name or username, e-mail address, password (stored in hashed form), preferred language. When you order: billing details (name, company, address, VAT number if any), printed on your invoices. When you pay: PayPal transaction reference and amount (we never receive your bank details). For security: IP address when you log in. If you turn on two-factor authentication: a secret key (encrypted) and recovery codes (stored in hashed form). If you contact support: the content of your tickets (subject, messages, panel concerned).
Purposes and legal bases
Performance of the contract (setting up and managing your panel, invoicing, service e-mails: order confirmation, renewal reminders, password reset, answering your support tickets), legal obligations (accounting) and legitimate interest (security, fraud prevention).
Retention period
Account data is kept for as long as the account is active, then for 3 years. Accounting records are kept for 10 years. If you delete your account, your personal data is erased immediately, except for accounting records (invoices and credit notes, with the details printed on them). Encrypted backups, stored in France (OVHcloud, Strasbourg), are kept for at most 13 months: erased data may remain in them until they expire. Support tickets are kept as long as the account exists and erased with it.
Recipients
PayPal (payment), OVHcloud (hosting), Cloudflare (network), Proton (sending service e-mails from no-reply@nebus.app, including those of your panel). No data is ever sold.
Your rights
You have the right to access, rectify, erase, restrict, object to the processing of and port your data. Write to contact@nebus.app. From the client area (My account → Your data), you can also download all your data at any time (access and portability) and delete your account (erasure). You may lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
Cookies
The client area only uses strictly necessary cookies (session, CSRF protection, two-factor verification step for 10 minutes) and the language cookie described below.
When you choose a language, the nebus_lang cookie remembers your choice for one year. It contains only the language code (for example en) and is shared between the website, the client area and the documentation (subdomains of nebus.fr). The website sets no other cookie: no analytics, no advertising.