Privacy policy

1. Data controller

The data controller is MODULO44, 32 rue de Paris, 92100 Boulogne-Billancourt, France, reachable at contact@verixis.app.

Data protection officer: Mohamed Nhari, contact@verixis.app.

2. Data concerned

On the marketing site

• Technical logs (IP address, user agent) for security and diagnostics.
• Demo form: name, professional email, organization, role, estimated volume, message.
• Cookie preference stored on your device.

In the service

• Account: professional identity, authentication, organization, phone number.
• Proofs: media captured at the time of the shot, session metadata, timestamping, and seals. No file imported from the gallery becomes a VERiXiS proof.
• Billing according to the subscribed plan.

3. Purposes and legal bases

• Process demo and contact requests (pre-contractual measures).
• Provide the proof service, dossiers, and verification (contract performance).
• Secure infrastructure and prevent abuse (legitimate interest).
• Meet legal retention and billing obligations.
• Audience measurement, if any, only after cookie acceptance (no script loaded before that).

4. Cookies

The banner at the bottom of the page records your choice. Strictly necessary cookies ensure the site works. No analytics tool is loaded until you accept.

Cookie contact: contact@verixis.app.

5. Recipients and processors

Data is processed by authorized MODULO44 staff and by providers required to host and operate the service.

• SCALEWAY SAS: cloud hosting, object storage, databases, transactional email (TEM) (European Union (FR / NL)).
• Stripe: payments, subscriptions and invoicing (EU, with possible transfers outside the EU under Stripe safeguards).
• Twilio: SMS OTP delivery (phone verification and MFA) (EU / outside the EU depending on Twilio configuration, under contractual safeguards).
• Certigna: qualified eIDAS electronic timestamping (TSA) (European Union (France)).
• MaxMind: GeoIP enrichment / network classification (abuse prevention) (outside the EU, under appropriate contractual safeguards).
• Google LLC: Android integrity attestation (Play Integrity) (possible outside the EU, limited to device attestation tokens).
• Apple Inc.: iOS device attestation (App Attest / DeviceCheck) (possible outside the EU, limited to device attestation tokens).

The data processing agreement (DPA) is available at /en/dpa.

6. Hosting and retention

Proof data is hosted in the European Union with SCALEWAY SAS.

• Proofs, sealed dossiers and data linked to proof processing (including algorithm logs required for the service): maximum retention of 6 years while the account and platform hosting remain active.
• The user may delete their data (account, proofs, dossiers) at any time from the customer area or by writing to contact@verixis.app; deletion applies subject to legal retention duties (e.g. invoices).
• Demo / contact requests: for the time needed to handle the commercial request, then limited archiving (12 months max. unless required by law).
• After platform hosting stops: 30-day grace period, then deletion of hosted media; already exported seals remain verifiable outside VERiXiS storage.
• Technical security logs outside the proof path: limited duration as needed (typically 12 months).
• Invoices and accounting records: applicable legal retention (independent of product retention).

7. Your rights

You may request access, rectification, erasure, restriction, portability, and object to certain processing.

DPO contact: contact@verixis.app. You may lodge a complaint with the CNIL (cnil.fr).

8. Transfers outside the European Union

Proof media and metadata remain hosted in the European Union with SCALEWAY. Some operational providers (Stripe payments, Twilio SMS, MaxMind GeoIP, Google / Apple attestation) may process data outside the EU. Those transfers rely on standard contractual clauses or equivalent GDPR mechanisms, and remain limited to the service purpose (billing, OTP, abuse prevention, device attestation).