This policy describes how Ethan Morisset collects and uses personal data when you use the Device Agent Service, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act.
1. Controller and processor
- Ethan Morisset, 107 rue Ambroise Croizat, 94800 Villejuif, France
- SIREN: 105 136 501, SIRET: 105 136 501 00019
- Contact: contact@maestrodeck.cloud
For your account, billing and security data, Ethan Morisset is the controller.
For the content that goes through your Phones (messages received and sent, your correspondents' numbers, the content of apps), you determine the purposes, through your agent: you are the controller and Ethan Morisset acts as processor, on your documented instructions (the Terms of sale, the Phone policy and your actions in the console), in accordance with article 28 of the GDPR. A data processing agreement can be provided on request.
2. Data collected, purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Account creation and management | Email, name (Google sign-in), Firebase identifier, authentication method | Performance of the contract |
| Subscription, free trial and payment | Email, customer and card identifiers at Stancer, card brand and last four digits, subscription state, payment history, date and version of the accepted terms. Full card details are processed directly by Stancer and do not go through our servers | Performance of the contract / legal obligation (accounting) |
| Providing the Phones | Number and model of the Phone assigned to you, device state, API keys (stored as an irreversible hash, never in clear), activity log | Performance of the contract |
| Content processed through your Phones | Messages (SMS) received and sent, your correspondents' numbers, content of the apps your agent uses. You are the controller, see section 1 | Customer instructions (processing on behalf) |
| Security, abuse and fraud prevention | IP address, access logs, sending volumes, failure rates, reports from operators and recipients, abnormal usage signals; the content of a message only in case of a report or serious suspicion of abuse | Legitimate interest / legal obligation |
| Answering support requests | Email and content of the exchanges | Legitimate interest |
3. Retention
- Account data: until the account is deleted, then any legal archiving;
- Billing and payment data: 10 years (accounting obligation, article L123-22 of the French Commercial Code);
- Content of messages and apps processed through your Phones: 30 days at most, then deleted; the Phone is fully wiped when you return it or your subscription ends;
- API keys: until revoked;
- Technical and security logs: 12 months at most;
- Support exchanges: 3 years after they are closed.
4. Processors and recipients
Data is processed by the following processors, bound by a contract compliant with article 28 of the GDPR:
Google Ireland Limited (GCP contracting entity for the EU): hosting of the application infrastructure, database and authentication (Firebase Authentication). Data is physically stored in the europe-west1 region (St. Ghislain, Belgium). Some technical transfers to the United States may occur (platform administration, support), covered by the European Commission's standard contractual clauses and the Data Privacy Framework.
Stancer (ILIAD 78, SAS): payment processing. Payment institution approved by the ACPR (CIB code 11758), registered with the Paris Trade and Companies Register under number 834 315 673, registered office 16 rue de la Ville l'Évêque, 75008 Paris. Card data is processed directly by Stancer (PCI-DSS compliant) and does not go through our servers. Stancer acts as an independent controller for its regulatory obligations. See stancer.com.
Mobile operator(s) providing the SIM cards: messages and their metadata (numbers, timestamps) go through their network, as with any SMS.
Data may also be disclosed to the competent authorities on legal request.
5. Transfers outside the EU
Ethan Morisset does not transfer data outside the EU directly. Technical transfers may occur through Google (see section 4), covered by appropriate safeguards (standard contractual clauses, Data Privacy Framework).
6. Your rights
Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability of your data, as well as the right to set directives on what happens to it after your death. You can exercise these rights by writing to contact@maestrodeck.cloud. You also have the right to lodge a complaint with the CNIL (cnil.fr).
If you are not our customer but received a message from a Device Agent number, you can write to the same address: we will pass it on to the responsible customer and can act on the number concerned.
7. Security
Ethan Morisset implements reasonable technical and organizational measures to protect data: encryption in transit (TLS), encryption at rest on Google Cloud infrastructure, access control through authentication, API keys stored as an irreversible hash, separation of Phones between customers and a complete wipe between two customers.
8. Cookies and local storage
The website uses no analytics or advertising cookies and no third-party trackers. The console uses your browser's local storage to keep you signed in (Firebase authentication tokens). This storage is strictly necessary for the service you request and is exempt from consent. Stancer's payment page may set session cookies needed for payment security.
9. Changes
This policy may be updated. The date of the last update is shown at the top of the page. Material changes are announced in advance.