Privacy Policy

1. Introduction & Data Controller

This Privacy Policy describes how Cryptaguard BV (hereinafter “the Company,” “we,” “our”) collects, uses, stores, and protects your personal data in connection with the use of the ResiPlan platform (hereinafter “the Service”).

In accordance with the General Data Protection Regulation (GDPR - Regulation EU 2016/679) and applicable national laws, we are committed to protecting your privacy and personal data.

Two distinct roles: the Company is a controller for account, billing and website data (described in this policy), and a processor for the business data that each customer organization enters into the Service (BIA, plans, incidents, contacts, AI conversations): that data is processed on the organization's behalf, under our Data Processing Agreement (DPA) available at /legal/dpa. Data subject requests concerning such business data are forwarded to the relevant organization, which alone is entitled to respond.

Data Controller:

• Company: Cryptaguard BV
• Email: privacy@resiplan.eu
• Website: https://www.resiplan.eu

2. Data We Collect

We collect different categories of data in connection with providing the Service:

2.1 Account Data

• First name, last name, professional email address.
• Organization name and role within it.
• Login credentials (encrypted password).
• Language and notification preferences.

2.2 Usage Data

• IP address, browser type, operating system.
• Pages visited, features used, login times.
• Performance metrics and error logs (stored internally in Convex, EU region).
• Web Vitals indicators (browser performance).

2.3 Business Continuity Data

• Business Impact Analyses (BIA), continuity plans (BCP, DRP, IRP, ERP), risk assessments.
• IT asset information (CMDB): applications, servers, contracts.
• Organizational charts, business processes, critical dependencies.
• Incident and crisis management data.
• AI assistant conversations and generated recommendations.

3. How We Use Your Data

We use your data for the following purposes:

3.1 Service Delivery

• Creating and managing your user account.
• Hosting and processing your business continuity data.
• Real-time data synchronization between users within your organization.
• Generating reports and dashboards.

3.2 AI Features

• Transmitting contextual data to our AI providers (Anthropic by default, OpenAI for some features, Voyage AI for the assistant's document search; Mistral AI, hosted in the European Union, as a per-organization option) to generate continuity plans, risk analyses, and recommendations. An organization can disable every AI feature.
• Cryptaguard does not use customer data to train or fine-tune AI models. AI providers are called through their business API offerings; they are listed, with their location, in the sub-processor list below.
• AI assistant conversations are stored in your data space for future reference.

3.3 Improvement & Analytics

• Analyzing aggregated usage metrics to improve the Service.
• Monitoring errors and technical performance (internal Convex logs, EU region, and Web Vitals).
• Audience measurement (Plausible): aggregated, cookieless traffic statistics. No personal data is collected; no consent required.
• Campaign attribution (first-party audience measurement): when you arrive via a campaign link (UTM parameters), and subject to your consent, we measure the browsing journey (pages visited, time spent) using an anonymous session identifier stored in your browser (sessionStorage). This data is hosted by us (Convex, no third party) and contains no directly identifying information.
• Detailed audience measurement (Google Analytics 4): subject to your consent, we use Google Analytics 4 to understand browsing journeys and traffic sources, across both the website and the application. The tag loads only after you accept the banner. Page paths are anonymized before they are sent (any record identifier is replaced by :id), the IP address is anonymized, and advertising features (ad_storage, ad_user_data, ad_personalization) remain permanently disabled through Google Consent Mode v2.
• Heatmaps and session replay (Microsoft Clarity): subject to your consent, we use Microsoft Clarity to anonymously visualize interactions (clicks, scrolling) and improve usability. Clarity sets cookies and loads only after you accept the consent banner.
• Analytics data is anonymized; it does not allow individual user identification.

3.4 Communications

• Sending transactional emails (registration confirmation, password reset, invitations).
• Notifications regarding account security and Service updates.
• Alerts and reports configured by the user.

4. Legal Basis for Processing (GDPR Article 6)

We process your personal data on the following legal bases:

• Performance of a contract (Art. 6.1.b): processing is necessary for the performance of the subscription agreement to which you are a party (account creation, Service delivery, billing management).
• Legitimate interest (Art. 6.1.f): Service improvement, fraud prevention, system security, aggregated usage analysis.
• Consent (Art. 6.1.a): for marketing communications (if applicable) and non-essential cookies.
• Legal obligation (Art. 6.1.c): retention of billing data in compliance with accounting and tax obligations.

5. Data Sharing & Third Parties

We never sell your personal data. We share your data only with the following sub-processors, necessary for providing the Service:

Note: error monitoring and performance tracking are performed in-house (logs stored in Convex, EU region) — no third-party provider such as Sentry is used for this purpose.

All our sub-processors are bound by Data Processing Agreements (DPA) compliant with the GDPR. We may also disclose data in response to a valid legal request from a competent authority.

6. International Data Transfers

Some of our sub-processors are located outside the European Economic Area (EEA), particularly in the United States. For these transfers, we implement the following safeguards:

• Standard Contractual Clauses (SCCs): we use the SCCs approved by the European Commission (Implementing Decision 2021/914) with each sub-processor located outside the EEA.
• EU-US Data Privacy Framework (DPF): where applicable, our US sub-processors are certified under the Data Privacy Framework.
• Additional measures: data encryption in transit (TLS 1.2 minimum) and at rest, transfer impact assessment, and technical measures to prevent unauthorized access.

7. Data Retention

We retain your data according to the following periods:

• Account and business data: for the duration of the contract, then at least 30 days so that you can retrieve them. They are deleted 30 days after the closure opens, which you can request at any time and which we open no later than 90 days after the end of the contract (section 12 of the Terms of Service).
• Billing data: 10 years, the period set by Belgian tax law (Article 315 of the 1992 Income Tax Code, Article 60 of the VAT Code). After a closure, it is kept outside the Service, in Cryptaguard's accounts and at its payment provider.
• Trace of a closure: name and identifier of the organisation, name and e-mail of the requester, any reason given, dates, counts, hashes and certificate, for 10 years, to prove the deletion and answer a claim.
• Web server access logs: 14 days. Server application logs: rotated by size, with no maximum duration set to date.
• Application audit log (SHA-256 integrity chain): 7 years by default for regulatory traceability (BCMS/DORA), reducible upon the organization's request (minimum 1 year) — see the DPA.
• Backups: daily backups are retained for 30 days, then automatically deleted. After a deletion, they disappear through rotation, no later than 35 days after it.
• Free trial data: in a trial organisation of your own, the same rules from the end of the trial, unless a subscription is activated.
• Accounts of the shared demonstration space: this space must not hold any real data. Your account (name, e-mail, phone) has no automatic deletion date there: it is deleted on request to privacy@resiplan.eu.
• Contact, demo and newsletter requests: 3 years from the form submission, then automatically deleted.

At the end of these periods, data is deleted from our systems, then from our backups through rotation.

8. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Right of access (Art. 15): obtain confirmation that your data is being processed and receive a copy of it.
• Right to rectification (Art. 16): correct inaccurate or incomplete data concerning you.
• Right to erasure (Art. 17): request the deletion of your data under the conditions provided by law.
• Right to data portability (Art. 20): receive your data in a structured, commonly used, and machine-readable format (JSON). The Service provides built-in export tools.
• Right to object (Art. 21): object to the processing of your data based on legitimate interest.
• Right to restriction of processing (Art. 18): request restriction of processing in certain cases.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.
• Right to lodge a complaint: with the Belgian Data Protection Authority or any other competent supervisory authority, in particular that of the Member State where you live or work.

To exercise your rights, contact us at privacy@resiplan.eu. We will respond to your request within 30 days.

9. Cookies & Tracking

The Service uses the following cookies and technologies:

Strictly Necessary Cookies

• Authentication session: manages your login session (secure, HttpOnly cookie).
• Language preferences: stores your language choice (fr/en).
• Theme preferences: stores your light/dark mode selection.

These cookies are necessary for the operation of the Service and do not require consent.

Performance Cookies

• Internal error logs (Convex): error collection and technical metadata to improve the quality of the Service. Stored in-house in Convex (EU region), without recourse to a third-party provider such as Sentry.
• Web Vitals: measurement of browser performance indicators.

Audience-measurement cookies (consent-based)

The following trackers are set only after you accept them via the consent banner, and can be declined at any time:

• Google Analytics 4: a first-party _ga cookie carrying a measurement identifier, used for audience measurement of the website and the application (data hosted by Google Ireland Limited, transfers to the United States covered by SCCs 2021/914). Cookie lifetime: 13 months maximum.
• Microsoft Clarity: session-replay and heatmap cookies used to anonymously analyze site usability (data in the EU, possible intra-group transfers to the United States covered by SCCs 2021/914).
• Campaign attribution (first-party): an anonymous session identifier (sessionStorage) measuring the journey of visitors arriving from our marketing campaigns.

Plausible audience measurement sets no cookies and collects no personal data; in line with CNIL guidance, it does not require consent.

The Service uses no advertising cookies and no retargeting or ad-network tool. Google Analytics is configured for audience measurement only: advertising signals are permanently denied and no data feeds any advertising targeting.

10. Security Measures

We implement appropriate technical and organizational measures to protect your data:

• Encryption: in transit (TLS 1.2 minimum, TLS 1.3 supported); database and files encrypted at rest by the database host (AES-256); encrypted backups (AES-256).
• Authentication: passwords are hashed with secure algorithms; two-factor authentication (2FA) is available.
• Data isolation: multi-tenant architecture with strict data isolation between organizations.
• Access control: two-level role system (platform and organization) with the principle of least privilege.
• Security headers: HSTS, X-Frame-Options, X-Content-Type-Options, Content-Security-Policy.
• API protection: rate limiting, input validation (Zod), webhook signature verification (HMAC SHA-256).
• Backups: automated daily backups with 30-day retention.
• Monitoring: continuous error and anomaly monitoring via internal logs (Convex, EU region).

11. Children's Privacy

The Service is intended for professional use and is not designed for individuals under 16 years of age. We do not knowingly collect personal data from minors. If we discover that a minor's data has been collected, we will delete it promptly.

Checking an AI content mark

The public page /trust/verify-ai-content lets anyone drop a file, without an account, to read its mark. That file may hold personal data, such as the names and contact details of a crisis team. It is processed in memory for this check only, then deleted: it is not stored, logged or passed to anyone.

The IP address is used to limit the number of checks, to protect the service (legitimate interest). This counter stays in memory and is gone within minutes. If the limit is exceeded, the IP address and the browser identification are written to the security log. As for any page of the site, the address also appears in the web server's access logs. Periods are given in the section on data retention.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal developments. In case of substantial changes:

• We will notify you by email and in-app notification at least 30 days before the changes take effect.
• The “last updated” date at the top of this page will be changed accordingly.
• Your continued use of the Service after the effective date constitutes acceptance of the modified policy.

13. Contact & DPO Information

For any questions regarding this Privacy Policy or to exercise your rights, contact us:

• Data Protection Officer: Cryptaguard BV - DPO Service
• Email: privacy@resiplan.eu
• General email: contact@resiplan.eu
• Website: https://www.resiplan.eu

You may also file a complaint with the Belgian Data Protection Authority: www.dataprotectionauthority.be