Privacy policy

Data controller

Victor Marion, sole proprietor, 15 rue Louis Postel, appartement 204, 35000 Rennes, France — SIRET 993 212 323 00022. Contact: contact@prospenso.com.

Two distinct roles

This distinction governs the rest of this document:

• For the data of Prospenso users (our customers), we are the controller.
• For the contacts our customers import into the platform, we are a processor within the meaning of article 28 of the GDPR: our customer remains the controller and alone decides on the purposes.

Data collected and purposes

• Account (name, email, company) — creating and managing the account. Legal basis: performance of the contract.
• Billing (identity, payment history) — accounting requirements. Legal basis: legal obligation.
• Imported contacts (name, business email, company, job title) — processed on behalf of the customer, solely on their instructions.
• Mailbox credentials — encrypted in the database (AES-256-GCM) and used only to send the customer's campaigns.
• Platform usage (technical logs, sending statistics) — security and service improvement. Legal basis: legitimate interest.

B2B prospecting and legitimate interest

Under French law, business-to-business (B2B) email prospecting relies on legitimate interest, provided that the subject of the message is related to the recipient's professional role, that the sender is clearly identifiable and that every message includes a simple means of objecting.

Every email sent via the platform necessarily contains an unsubscribe link and the corresponding technical header. An unsubscription is permanent and prevents any further sending to the contact concerned, including from another campaign in the same workspace.

Retention periods

• Active account: for the entire duration of the subscription.
• After cancellation or the end of the trial: 30 days, then deletion of the account data and associated contacts.
• Accounting records: 10 years, in accordance with the French Commercial Code.
• Unsubscribe list: kept without time limit, to ensure that an objection continues to be respected.

Your rights

You have the rights of access, rectification, erasure, objection, restriction and portability. To exercise them, write to contact@prospenso.com; you will receive a reply within one month.

If you received a prospecting email sent via the platform, please contact the sender of the message first, as they are the controller for this processing. We will forward your request if you contact us directly.

You may lodge a complaint with the CNIL, the French data protection authority (cnil.fr), or with the supervisory authority of your country of residence.

Service providers (processors)

We use the following providers, each bound by a data processing agreement:

• Supabase — database and authentication (European Union)
• Vercel — application hosting and website audience measurement (United States)
• Stripe — payment processing (European Union / United States)
• Resend — transactional emails (European Union)
• Anthropic — writing and scoring assistance (United States)

Transfers outside the European Union are governed by the European Commission's standard contractual clauses.

Security

Access is isolated per workspace at database level. Customers' mailbox credentials and API keys are encrypted before storage. Communications are encrypted in transit (HTTPS).

Cookies

The site only uses cookies that are strictly necessary for the service to work (authentication session, active workspace, display language). No advertising cookies or third-party trackers are set, so no prior consent is required.

To find out how many people visit the site and which pages interest them, we use Vercel's audience measurement. It sets no cookies and stores neither your IP address nor any identifier that could recognise you from one visit to the next: it only produces aggregate statistics (number of visits, pages viewed, referring site, device type and country).