Privacy Policy

1. Who we are

The Olyteck products are operated by Olyteck from France under SIRET 993 174 499 00018. For the purposes of the EU GDPR:

• Olyteck is the data controller for personal data we collect to operate your account (e.g. the admin email used to sign in, billing details) and for optional marketing email you agree to receive (§16).
• For the data each product derives from your Microsoft 365 or your uploaded content, we act as a data processor on behalf of your organisation (which remains the controller). Our processor obligations are in the Data Processing Agreement and its per-product Schedule.

Privacy contact: [email protected].

Data Protection Officer. Olyteck has designated a data protection officer, who handles every privacy enquiry and data-subject request. Contact them at the privacy address above.

2. Data we collect

Account data

Received from Microsoft Entra ID when someone signs in — an administrator, or, in products that offer a page to employees (Cyber's "My space", also inside Microsoft Teams), an employee of the customer organisation:

• Email address and display name
• Opaque user and tenant identifiers (the "oid" and "tid" claims)
• Workspace role
• Timestamps: account creation, last login, session activity; the IP address of the last sign-in

For employees, this data is processed on behalf of their employer (the controller), who decides whether to offer the page; see the product's Schedule.

Product-derived data

The categories of data each product processes about your Microsoft 365 or your content differ by product and are listed in its DPA Schedule — for example, configuration/permission metadata and security findings, including findings about people such as their sharing counts (Cyber), uploaded documents and answer history (Ask), or mail signals, scores and verdicts (Guard).

Usage data

• IP address and user-agent of console requests (for abuse detection)
• Audit entries for privileged and state-changing actions

Billing data

• Stripe customer identifier, subscription status, plan code, invoice metadata
• We never store full card numbers or CVC — card data is entered into Stripe's hosted Checkout and stays at Stripe
• A Stripe customer record is created for administrators only, never for an employee who signs in to a page offered to staff

3. Data minimisation — "counts findings, never files"

Across products we store the minimum needed to deliver the service: derived signals, scores, findings, verdicts, answers and metadata rather than your raw files, message bodies or document contents wherever the product design allows. Exactly what each product stores — and what it never stores — is set out in its DPA Schedule.

Cyber ("SAFE payload"). Cyber keeps findings per site, person, group or app: an identifier, a name, counts, flags, a severity and dates. It never stores file contents, message bodies or share URLs, and never stores the scanner's access tokens. The file-level detail of an administrator's deep scan stays in that administrator's browser. File names reach our servers in two cases only: a share an employee confirms in My space (with the reason they typed, so the confirmation is remembered) and a fix waiting for an approval (up to 30 minutes). Optional connections that act or send messages for a person (fixing, Teams chat) keep that person's refresh token, encrypted. The full list, with retention windows, is the Cyber Schedule.

Tenant isolation. Every record that touches your data is bound to the tenant that owns it; every query filters on the server-side session's tenant identifier, never on a value taken from the request. Cross-tenant access attempts return a not-found response.

4. AI & training

• We never train our own models on your data. Your content, signals and outputs are not used by Olyteck as training data for a product sold to others.
• Third-party AI varies by product. Some products use third-party AI/LLM sub-processors under contractual "no training on API data" terms (e.g. Ask); others use none (e.g. Cyber, Guard). Each product's DPA Schedule states its AI stance and lists any AI sub-processors with links to their data-use terms.

5. How we use your data

• To authenticate sessions (administrators, and employees where a product offers them a page) via Microsoft Entra ID single sign-on, including inside Microsoft Teams.
• To deliver the product's function (scanning, answering, detection, reporting) as configured.
• To bill you accurately and issue invoices through Stripe.
• To send transactional email — trial reminders, account-state changes, security alerts.
• With your consent only, to send product tips and onboarding email (§16).
• To detect abuse and secure the platform.
• To comply with our legal and accounting obligations in France and the EU.

6. Legal basis for processing (GDPR)

• Contract (Art. 6(1)(b)) — to deliver the Service your organisation signed up for.
• Legitimate interest (Art. 6(1)(f)) — to secure the environment, detect threats and fraud, and debug. Network and information security is a recognised legitimate interest (Recital 49).
• Legal obligation (Art. 6(1)(c)) — to retain billing records under French tax law.
• Consent (Art. 6(1)(a)) — only where relied on (e.g. non-essential analytics cookies, optional marketing email). Withdrawable at any time.

7. Sub-processors

Each product uses a short list of vendors as data sub-processors under written processing agreements. The authoritative, version-dated list per product is in its DPA Schedule; the Trust Center shows the company-wide view. Common to all products: Scaleway (EU hosting), Microsoft (identity, and where connected, Graph), and Stripe (billing). Whether a product uses third-party AI sub-processors is stated in its Schedule.

8. Payments

Paid subscriptions are processed by Stripe Payments Europe, Ltd. (Ireland). We receive a transaction reference, amount, currency, subscription state and the last four digits of the card. Full card data is entered directly into Stripe's hosted Checkout and never touches our servers. Stripe's privacy policy applies to that portion of the flow.

9. Storage & retention

Application data is hosted in France (Paris, PAR1) (EU-27). Product-specific retention windows are in each product's DPA Schedule. Windows common across products:

• Account data — while your tenant is active, plus 30 days after deletion.
• Audit logs — 24 months.
• Billing records — 10 years (required by French accounting law).

10. Sharing with third parties

We only share data with:

• The sub-processors listed in the product Schedule, strictly to run the Service.
• Tax authorities, lawyers, auditors or courts when legally required.
• A successor entity in case of merger or acquisition, under the same privacy commitments — we would notify customers (by in-app notice and the Trust Center) at least 30 days before the transition takes effect.

11. International transfers

Applications, databases and workers run in France (Paris, PAR1) (EU-27). Current sub-processors process through their EU entities, so processing stays within the EEA. If a future sub-processor processes data outside the EEA, transfers will rely on the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914) and, where available, the EU-US Data Privacy Framework, and the product Schedule will be updated.

12. Your rights

If you are in the EU, the UK, or otherwise subject to GDPR, you have the right to access, correct, delete, export, restrict or object to processing of your personal data, and to withdraw consent where processing is based on it. You may also lodge a complaint with the French data-protection authority (CNIL) at cnil.fr.

To exercise any right, email [email protected] from the address associated with your account. We respond within 30 days. Where a product processes data on behalf of your employer, individual requests are usually routed through your organisation (the controller); we assist your administrator in responding.

13. Automated processing

Some products automatically score or classify items (e.g. Guard scores messages) and can, where an admin has enabled it, apply reversible actions. These are security decision-support outputs about items, not automated decisions producing legal effects on individual data subjects within the meaning of GDPR Art. 22. We do not profile, score, rank or compare individual employees. Where a product shows security facts per person (for example, in Cyber, the shares a person owns that are open beyond the organisation, or where they stand in a clean-up campaign their employer runs), these concern the security of the organisation's resources, are shown only to the organisation's administrators and to the person concerned, and are not used to assess anyone's work. Output quality varies; the Terms of Service set out the customer's responsibility to review outputs before acting on them.

14. Security

The full technical and organisational measures are in the Security overview and DPA §5. Key points: encrypted transport (TLS 1.2+), encrypted storage, Microsoft Entra SSO with PKCE, strict per-tenant isolation, least-privilege staff access and audit logging.

15. Cookies & analytics

Inside the authenticated console we set only strictly necessary cookies (session, CSRF, language) and run no third-party analytics; the browser storage a product needs to work (for example Cyber's saved lists) is described in the Cookie Policy. On our public marketing pages we run a consent-gated Google Analytics 4 tag — off until you click Accept, with Reject given equal prominence — and, on cyber.olyteck.com, a cookieless page counter whose visitor identifier changes every day (you can object by email). The full breakdown is in the Cookie Policy.

16. Marketing email

Most emails we send are transactional: trial reminders, account confirmation, plan-state changes, security notifications, sent on the basis of contract performance (Art. 6(1)(b)).

Some products also offer optional product-tips and onboarding email (for Cyber, about ten short messages over the first four weeks of a trial). You receive them only if you tick an unticked-by-default checkbox when you sign in (Art. 6(1)(a)). Every message has a one-click unsubscribe; we record when and where you consented and remove you immediately on withdrawal. These emails are sent through our mailing service (Amazon SES, EU); see the Cookie Policy §3 for open/click measurement.

17. California residents (CCPA / CPRA)

If you are a California resident, the CCPA (as amended by the CPRA) gives you specific rights; this section is your "notice at collection".

• Categories collected. Identifiers (admin work email, Entra OID/TID, and any identifiers in product-derived data), professional information (role), internet/network activity (IP for abuse detection, sign-in timestamps), commercial information (subscription plan), and security signals where the product produces them.
• Sources. Your admin at sign-in; Microsoft Entra on authentication; Microsoft Graph or your uploads for the data the product processes on your behalf.
• Business purposes. Operating, securing and improving the Service; threat detection; billing; transactional email; legal compliance.
• Sale or sharing. We do not "sell" personal information and do not "share" it for cross-context behavioural advertising as defined under the CPRA.
• Sensitive personal information. These are B2B tools; we do not intentionally collect or use sensitive personal information to infer characteristics.
• Your rights. Know, delete, correct, and non-discrimination. Email [email protected]; we respond within 45 days (extendable once by 45 days with notice, as the CPRA permits).

18. Minors

The Olyteck products are B2B tools intended for authorised members of an organisation. They are not directed at children under 16. If you believe a minor has signed up, email us and we will close the account and delete the data.

19. Changes to this policy

When we make a material change we update the "Last updated" date and post an in-app notice where the change affects your rights. Continued use after the change means you accept the updated policy.

20. Contact

Questions about privacy? Email [email protected] — or general support [email protected]. Security incidents: [email protected].

Operator: Olyteck — SIRET 993 174 499 00018.