Privacy

Version 2026-10-07

MAARS — Sole trader — French micro-enterprise scheme
17 rue Dunoir, 69003 Lyon, France
SIREN : 510504772
contact@wespeer.com

1. Data controller

MAARS, the trading name of Thierry DEMARS, a sole trader under the French micro-enterprise scheme, is the controller for processing required to operate Wespeer Pro, manage accounts, billing and service security. For questions or personal-data requests, contact contact@wespeer.com. Business customers remain responsible for their own use of files and information concerning their users and recipients.

2. Data processed

The service processes account and business information: name, email address, hashed password, contact details, billing details, supplied tax and registration identifiers, language and acceptance of terms. It also processes branding settings, logo, subdomain and client code; installation identifiers, platform and push notification tokens; and transfer metadata, including identifiers, filename, size, MIME type, direction, status and event timestamps. Support messages and technical logs may include identifiers, IP addresses, timestamps, browser information and technical errors.

3. File contents

File contents are transmitted directly between sender and recipient using P2P. The Wespeer Pro back office does not store those files or provide backups. The absence of file storage does not mean that no metadata or network information is processed to establish the connection.

4. Purposes and legal bases

Account management, authentication, transfers, branding, transactional notifications, history and support are used to perform the customer contract. For customers’ users or business contacts, processing may be based on the legitimate interest in delivering the service and managing the business relationship. Billing and accounting retention meet legal obligations. Logging, abuse prevention and incident diagnosis rely on the legitimate interest in protecting and maintaining the service. Notification permissions are managed in device settings. Required information is identified in forms; failure to supply it may prevent access to the relevant feature.

5. Recipients and service providers

Data is accessible to authorized persons at MAARS and providers needed to operate the service, according to their roles: Scaleway for hosting, Stripe for payments and subscriptions, Brevo for transactional emails, and Firebase/Google for push notifications and the technical connection services used. Each recipient receives information needed for their role. Payment details are processed by Stripe; MAARS does not store full card numbers. Authorities may receive information where legally required.

6. Processing outside the European Economic Area

Depending on providers, some data may be processed outside the European Economic Area. International transfers must be covered by safeguards required by law, such as an applicable adequacy decision or standard contractual clauses with any necessary additional measures. You may contact MAARS for information about destinations and safeguards applicable to the services used.

7. Retention periods

Operational account data, settings and transfer metadata are retained for the lifetime of the account and removed when it is closed, except for legal obligations or information needed to establish or defend legal claims. Cancellation alone does not delete the account. Client-portal access cookies and tokens authorize a browser for up to 90 days before expiry; expiry alone does not mean that the technical database record has been erased. Technical security and diagnostic logs are retained for up to twelve months and then deleted or anonymized, except where targeted retention is justified by an incident, dispute or legal obligation. Invoices and accounting records are retained for ten years from the close of the relevant financial year. Transferred file contents are not retained by the back office.

8. Cookies, local storage and security

The site uses cookies and storage mechanisms for sessions, form protection, language selection and authorized portal access. The access cookie is attached to the relevant subdomain. These mechanisms do not store transferred files. Site communications are protected by HTTPS and access is controlled. You must protect your credentials, client code and sharing links. Do not send passwords, private keys or secret tokens in support requests.

9. Your rights and contact

Subject to GDPR conditions, you may request access, rectification, erasure, restriction or portability of your data, and object to processing based on legitimate interests for reasons relating to your particular situation. Where processing relies on consent, you may withdraw it without affecting earlier processing. Send requests to contact@wespeer.com. Proportionate identity verification may be required. A response is normally provided within one month; a reasoned extension may apply under statutory conditions. You may also lodge a complaint with the French supervisory authority, CNIL, at cnil.fr. Retention obligations and legal claims may limit some erasure requests.

10. Updates

This policy may be updated to reflect processing actually implemented. Material changes are communicated through appropriate means. The version and update date appear on this page.