Privacy & legal notice

This website is published by:

• Company : VERNALYS SOLUTIONS, SAS (société par actions simplifiée), trading under the name “Vernelys”.
• Share capital : 10 000 €
• Registered office : 2 rue Docteur Horand, 69009 Lyon, France
• Registration : Registered with the Lyon Trade and Companies Register under number 108 293 630 (SIRET of the registered office: 108 293 630 00019).
• EU VAT number : FR 63 108293630
• Publication director : Etienne PERNELLE
• Contact : contact@vernelys.com
• Telephone : +33 7 87 37 85 59
• General terms of sale : provided on request at contact@vernelys.com and supplied before any contract is signed.

All content on this site (text, visuals, logos, the “Vernelys” trademark, demonstration mock-ups, documentation) is protected by intellectual property law and remains the exclusive property of VERNALYS SOLUTIONS or its partners. Any reproduction, representation or reuse, in whole or in part, without prior written authorisation is prohibited.

Your data is processed for the following purposes:

• Demonstration request : handling your request, getting back to you and preparing a possible contractual relationship. Lawful basis: pre-contractual steps taken at your request (Art. 6(1)(b)).
• Free audit request : analysing your practices and your tools, then reporting our findings back to you. Same lawful basis as above.
• Job application : considering your application and conducting the recruitment process. Lawful basis: pre-contractual steps taken at your request (Art. 6(1)(b)).
• Providing the service : activating and managing the licence, authentication, running the features of the platform and the add-ins. Lawful basis: performance of the contract (Art. 6(1)(b)) and, for the content of your files, your company's instructions (Art. 28).
• Support and customer relationship : answering your requests and providing technical support. Lawful basis: performance of the contract (Art. 6(1)(b)) and our legitimate interest in providing quality support (Art. 6(1)(f)).
• Website audience measurement : knowing which pages are read, where visitors come from and which journeys lead to a request, in order to improve the site. Lawful basis: your consent (Art. 6(1)(a)), obtained through the banner and revocable at any time. Without consent no measurement takes place: the counter is not loaded.
• Security and proper operation : hosting logs, send rate limiting, abuse prevention, incident detection, service improvement. Lawful basis: our legitimate interest in ensuring the security and availability of the service (Art. 6(1)(f)).
• Legal obligations : complying with our accounting, tax and legal obligations, and responding to lawful requests from authorities. Lawful basis: legal obligation (Art. 6(1)(c)).

The checkbox on the questionnaires is not an additional lawful basis: all three requests rest on the pre-contractual steps you ask us to take. The box and its timestamp record the fact that you were informed before sending. The only processing on this site that rests on your consent is audience measurement, and it is the only one you can withdraw with a single click.

The fields marked as required in the questionnaires genuinely are: without them we would not know who to reply to. The others are optional. We do not use these addresses for unsolicited marketing: there is no marketing sign-up box anywhere on this site.

Your data is never sold, rented or passed on to third parties for advertising purposes. It is accessible only to authorised staff of VERNALYS SOLUTIONS and to the processors listed below, which act solely on our documented instructions and are bound by an agreement compliant with Article 28 of the GDPR:

• Vercel Inc. (United States) : hosting of the website and delivery of the installation files. Processes technical connection logs and, if you have accepted it, the website audience measurement. It is the sole recipient of browsing statistics: they are passed on to no advertising network and to no other analytics tool.
• Brevo (Sendinblue SAS, France) : delivery to our inboxes of the requests sent from the demonstration, audit and job application questionnaires, attached CV included.
• OVHcloud, Google Cloud Platform and Microsoft Azure (France) : hosting and storage of the data of the platform and the Office add-ins. All three providers are configured on regions located in France.
• Mistral AI (France) : text recognition of documents (OCR), transcription of meeting recordings, and processing of your requests when you choose this model in the chat.
• Google (Gemini), OpenAI (ChatGPT) and Anthropic (Claude) : processing of the requests you send to the provider selected in the chat, together with the documents you attach to them. They are called on endpoints confined to European regions.
• xAI (Grok, United States) : the same processing, when you choose this provider. As it offers no European region, your request is then processed in the United States: see Transfers outside the European Union. Your administrator can remove this provider from the list offered to your users.
• Linkup (France) : web search. When you enable the option in the chat, your request is passed on to that engine, which brings back the relevant pages the model then cites in its answer. It receives only that request, never the documents in your workspace.
• Business email service : receiving and following up the requests you send to sales@vernelys.com, recrutement@vernelys.com and contact@vernelys.com.

None of these providers uses your content to train its models. We call them through their business interface, whose terms rule out such reuse, and they act only on the content you explicitly submit to them.

The up-to-date list of our processors, naming each one, the activity entrusted to it and the country where it is established, is provided on request from contact@vernelys.com. Data may also be disclosed to the competent administrative or judicial authorities where the law requires it.

Your data is kept for as long as is strictly necessary for the purposes for which it is processed:

• Demonstration and audit requests : three years from your last contact with us, in line with the CNIL's recommendation.
• Job applications : two years from the last exchange, unless you ask us to delete them.
• Account and licence data : for the whole duration of the contractual relationship, then archived in an intermediate database for the duration of the applicable limitation periods: five years in commercial matters, ten years for accounting records.
• Support requests : up to three years after the last contact.
• Content placed in the platform : for as long as your company keeps it there. It is deleted at the end of the contract, under the conditions and within the time limits set out in it.
• Content submitted for one-off processing : extracting a PDF, querying a model, transcribing a recording: for as long as is strictly necessary for the requested processing, with no retention beyond that by the provider.
• Technical and connection logs : from a few days to twelve months at most.
• Audience measurement statistics : for the period provided for by our hosting plan, and never beyond twelve months. These statistics are aggregated and relate to no identified person.
• Audience measurement consent cookie : six months, in line with the CNIL's recommendation. After that period the question is put to you again, whether you accepted or refused.
• Rate-limiting IP addresses : a few minutes, in the server's memory, never written to disk.
• Questionnaire agreement checkbox : it is attached to the email that delivers your request to us, and so follows the fate of that email: three years for a demonstration or audit request, two years for a job application.
• Consent to audience measurement : for as long as your choice stands, then three years after its withdrawal, as evidence.

Under Articles 15 to 22 of the GDPR and the French “Informatique et Libertés” Act, you have the following rights over your personal data:

• Access : obtaining confirmation that your data is being processed and receiving a copy of it.
• Rectification : having inaccurate or incomplete data corrected.
• Erasure : asking for your data to be deleted, within the limits of our legal retention obligations.
• Restriction and objection : having processing frozen, or objecting to it, in particular to any processing based on our legitimate interest and, without any condition, to direct marketing.
• Portability : receiving the data you provided to us in a structured, commonly used and machine-readable format.
• Withdrawal of consent : at any time, without affecting the lawfulness of processing carried out before that withdrawal. For audience measurement, the “Audience measurement” control in the footer, present on every page of the site, reopens the choice and replaces it in one click.
• Post-mortem directives : setting out what should happen to your data after your death, as provided for by French law.

To exercise these rights, write to us at contact@vernelys.com. We reply within one month of receiving your request, a period that may be extended by two months for complex requests. Proof of identity may be requested in the event of reasonable doubt.

If you use Vernelys through your employer or through a client company, contact them first: they are the controller of the content placed in the platform, and we assist them in meeting your request.

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or with the supervisory authority of the Member State where you live or work (Art. 77 of the GDPR).

We carry out no automated decision-making producing legal effects concerning you or similarly significantly affecting you, within the meaning of Article 22 of the GDPR, and no profiling for advertising purposes.

The artificial intelligence features of our solutions assist the user in their work: they rely on probabilistic models, remain under the user's control, and their output must be reviewed by a human before being used or shared.

VERNALYS SOLUTIONS implements appropriate technical and organisational measures to protect your data against unauthorised access, loss and alteration:

• encryption of exchanges over HTTPS/TLS, enforced by HSTS, and encryption of data at rest;
• a strict content security policy (CSP) and hardened security headers across the whole site;
• control and limitation of access following the principle of least privilege, and logging of technical access;
• separation of spaces by company and by file within the platform;
• digitally signed installers for the Office add-ins, whose authenticity can be verified before installation;
• rate limiting on forms and keeping software components up to date.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we notify the CNIL within 72 hours in accordance with Article 33 of the GDPR and, where the risk is high, the individuals concerned as soon as possible (Article 34). Where we act as a processor, we alert the controlling company without delay.

If you believe you have found a vulnerability on this site or in our solutions, report it responsibly to contact@vernelys.com. We acknowledge receipt and keep you informed of how it is handled.

This policy may be updated to reflect changes to the site, to our solutions or to the applicable regulations. The date of the last update appears at the top of this page; we invite you to consult it regularly. Any substantial change affecting our customers is notified to them under the terms set out in the contract.

For any question about this policy or about your personal data, write to us at contact@vernelys.com or use the Contact page.

Our postal address is that of our registered office: VERNALYS SOLUTIONS, 2 rue Docteur Horand, 69009 Lyon, France.

This policy is published in French, English and Italian. In the event of any discrepancy between the versions, the French version prevails.