Privacy policy

Data controller

Fyher, a limited liability company (SARL) with registered address at 19 rue Saint-Grégoire, 50170 Servon, France (SIREN 802 928 986), publishes tryVidimus and is the controller of the personal data described on this page.

To exercise your rights or ask a question: help@tryvidimus.com.

Data collected

What we collect depends on how you use tryVidimus:

• Demo and contact requests: work e-mail address, company name, expected volume, language of the page.
• Customer account: e-mail address, name and role of each user, company name, sign-in dates. One-time sign-in codes are kept only for a few minutes.
• Billing: company name, address, SIRET, VAT number, deposits and invoices. Card details are handled by Stripe and never reach us.
• API use: calls (route, result, duration, IP address, API key used), capture sessions and proofs with their technical metadata.
• Website statistics: anonymous usage statistics (pages viewed, clicks, scroll depth), collected with PostHog. They never include your e-mail address or what you type in the forms.

Purpose and legal basis

Why we process the data, and on what legal basis:

• Answering demo and contact requests: pre-contractual measures taken at your request, and our legitimate interest in replying.
• Providing the service (accounts, API, capture, proofs, verification, notifications): performance of the contract.
• Invoicing and accounting: legal obligation.
• Security, abuse prevention and call logs: our legitimate interest in protecting the service and its users.
• Anonymous website statistics: our legitimate interest in improving the site.

Retention period

How long we keep the data:

• Demo and contact requests: 3 years after the last contact.
• Customer account and users: for the duration of the contract, then kept for up to 5 years as evidence before deletion.
• Invoices and accounting records: 10 years (legal obligation).
• Production proofs and their files: 24 months, longer while a dispute is open. Test files: deleted after 48 hours.
• API call logs: 90 days.

Recipients and processors

Your data is only accessible to the Fyher team members who need it. We rely on these processors:

• Netlify: website hosting.
• Elestio: hosting of the API and customer area servers.
• Supabase: database (Frankfurt, EU).
• Cloudflare: network protection, anti-abuse verification (Turnstile) and file storage (R2).
• Amazon Web Services (KMS, Paris, EU): signing keys.
• Resend: sending of e-mails.
• Stripe: payments.
• PostHog: anonymous website statistics.
• Certigna: qualified timestamps. It receives only a fingerprint of the proof, never your photos or videos.

Transfers outside the European Union

Some of these providers are located outside the European Union or can access data from there (for example Netlify, Stripe, Resend, Cloudflare and PostHog). These transfers are covered by the European Commission's standard contractual clauses or by the EU-US Data Privacy Framework.

Photos and videos captured for you (processor role)

When your own users take photos or videos through a capture link, you decide why and how they are used: you are the controller and Fyher is your processor. We process these files only to capture, sign, timestamp, store and make them verifiable, on your documented instructions.

Informing the people who are photographed and choosing the legal basis are your responsibilities. A data processing agreement (DPA) is available on request at help@tryvidimus.com; the sub-processors are the ones listed above.

Your rights

You can access, correct or erase your data, object to its use, ask for its restriction and, where it applies, receive it in a portable format. Write to help@tryvidimus.com: we answer within one month.

We may refuse an erasure when the law requires us to keep the data (for example invoices) or while a dispute about a proof is open. If you are not satisfied with our answer, you can lodge a complaint with the CNIL (cnil.fr).

Changes

We update this page when our practices change. The date of the last update is shown at the top.