Privacy Policy
This policy describes the personal data CielLogic ("we") processes when you use the service, the purposes and legal bases for that processing, and the rights you have under the EU General Data Protection Regulation (GDPR) and French data-protection law.
1. Data controller
CielLogic is a personal, non-commercial portfolio project designed and run privately by Jeremy Snyder, a natural person. It is not a company or a commercial service: there are no customers, no payments and no advertising. The only real data is that of the author's own account and a public demo account; all other data is fictitious.
Contact for any data-protection question: at ciellogic@jeremysnyder.fr. No Data Protection Officer has been appointed at this stage; requests are handled directly by the controller.
2. Data we process
| Category | Detail | Source |
|---|---|---|
| Account identity | Display name, email address, account id, role (architect / worker), the organization you belong to, preferred language | Google sign-in (OpenID Connect: openid, email,
profile) |
| Calendar availability | The busy/free intervals of your Google Calendar, over roughly a 90-day horizon. Never an event's title, description, location, attachments, or attendees. | Google Calendar API, calendar.freebusy scope (non-sensitive) |
| Coordination events | CielLogic creates its own dedicated calendar ("CielLogic — Missions") in your Google account and creates, updates and deletes the events for your confirmed assignments there. This access is limited to that calendar; we cannot see or change your own calendars or their events. | Google Calendar API, calendar.app.created scope (non-sensitive) |
| Google access tokens | OAuth 2.0 access + refresh tokens for the calls above. Encrypted at rest (AES-256-GCM); the database only ever holds ciphertext. | Google, when you connect your calendar |
| Service usage data | Projects, assignments, computed availability slots, invitations sent to workers (recipient email address), status-change history and cancellation reasons you enter. | Your use of the application |
| Rates (workers) | Hourly and daily rates excl. tax, a free-text price list, a validity date and the "published / unpublished" state of your price list, and your company's default list. The prices of a sole trader are personal data. | Entered by you, or by an admin or manager of your company, in the "Rates" card of the profile |
| Referrals | Your referral code (random, unrelated to your identity) and, when a new business signs up through your share link, or when a worker you invited creates their business by accepting your invitation, the "referrer → referred business" link and how it arrived (link or invitation). You only ever see a count of referred businesses, never which; the owner, admins and managers of your company see the total referred by its current members, never which businesses or by whom; a referred business cannot see who referred it. | Your sharing of the link or your invitation, and the referred business's sign-up |
| Technical and audit logs | Identifiers, timestamps, IP addresses, response codes, counters. Never calendar event contents. | Application servers |
| Browser local storage | Your language choice, kept for the browser session only
(sessionStorage). The session token
is kept in memory only and is not written to disk. No
tracking or advertising cookies. |
Your browser |
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the service: computing availability, coordinating assignments between an organization and its workers | Performance of a contract - Art. 6(1)(b) |
| Connecting your Google Calendar and reading busy intervals | Consent - Art. 6(1)(a). Withdrawable at any time (see §7); withdrawal does not affect the lawfulness of prior processing. |
| Authentication, security, abuse prevention, audit logging | Legitimate interest - Art. 6(1)(f): securing the service and accounts |
| Sending invitations to workers approached for a project | Performance of a contract / legitimate interest in connecting the parties |
| Showing your rates to every architect registered on CielLogic, when you (or your company) choose to publish them | Consent - Art. 6(1)(a), given by ticking "Publish these rates". Withdrawable at any time by unticking it or deleting the list (see §7); an unpublished list is visible only to your company. |
| Attributing a sign-up to the referrer who shared their link or sent the invitation, and showing them the count | Legitimate interest - Art. 6(1)(f): attributing referrals correctly and keeping their count |
| Legal obligations (accounting, responding to authorities) | Legal obligation - Art. 6(1)(c) |
4. Recipients and processors
Your data is not sold or rented. Within the application, your availability is visible only to members of your organization and to organizations that explicitly invite you to a project. The rates you publish are visible to every architect registered on CielLogic, including those who have never worked with you; unpublished, they are visible only to your company. We use the following processors:
| Processor | Role | Location / safeguards |
|---|---|---|
| Google Ireland Ltd / Google LLC | Authentication (OAuth / OpenID) and the Google Calendar API | EU / United States - covered by the EU–US Data Privacy Framework and Standard Contractual Clauses |
| OVHcloud (OVH SAS) | Hosting the application and database (virtual private server) | European Union - Gravelines (France) |
| Brevo (Sendinblue SAS) | Delivering transactional email (invitations, notifications) | European Union - Paris (France) |
We may also disclose data where required by law or to establish, exercise, or defend legal claims.
Limited Use of data received from Google APIs
CielLogic's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. In particular:
- calendar data (busy intervals; events CielLogic creates) is used only to provide and improve the user-facing scheduling and coordination features;
- it is not sold, not transferred to third parties for other purposes, not used for advertising, and not used to train artificial-intelligence models;
- no human reads it, except with your explicit consent, for security purposes (investigating abuse or an incident), to comply with law, or where the data is aggregated and anonymised;
- it is deleted when you disconnect your calendar or delete your account (see "Retention").
5. Transfers outside the EU
The application and its database are hosted in the European Union (France). Calls to the Google APIs may involve a transfer to the United States, covered by the EU–US Data Privacy Framework and, where applicable, Standard Contractual Clauses, within the meaning of Chapter V of the GDPR.
6. Retention
- Active data: records older than 90 days (past availability intervals, invitations in a final state, closed coordination events, logs) are moved to restricted-access archive storage, then purged in line with our legal obligations.
- Disconnecting your calendar: revocation with Google and deletion of the encrypted tokens are immediate.
- Account deletion: sessions and the calendar connection are revoked immediately; a 30-day grace period allows cancellation, after which identifying data is irreversibly anonymised. Records strictly necessary for the consistency of other parties' past assignments (assignment history, audit logs) are kept in anonymised form.
- Rates: kept until you delete them; they are not archived. As soon as you request the deletion of your account, your own list is unpublished, and it is deleted at anonymisation. If you leave your company, your own list is deleted. If the company stops using CielLogic (dissolution, or deletion of a sole trader's account), all its lists are deleted.
- Referrals: the referral link is kept as long as both accounts exist. When the referrer's account is deleted and anonymised, the businesses attributed to them are detached and their referral code is re-issued (previously shared links stop working). When the referred business stops using CielLogic, its referral link is erased.
7. Your rights
Subject to the conditions set by the GDPR, you have the following rights:
- Access and portability: the application provides a full
JSON export of your data (
My account → Export my data, APIGET /api/v1/me/export). - Rectification: through your profile, or on request.
- Erasure:
My account → Delete my account(DELETE /api/v1/me), with the 30-day grace period described in §6. Restoration is possible during that period after signing in again. - Objection and restriction: for processing based on legitimate interest.
- Withdrawing consent: disconnect your Google Calendar at any time from the application, or revoke access from your Google account. For your rates: untick "Publish these rates" or delete the list in the "Rates" card of your profile; withdrawal is immediate.
- Complaint: you may lodge a complaint with the CNIL (www.cnil.fr - 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France).
To exercise these rights: ciellogic@jeremysnyder.fr. We respond within one month.
8. Security
Google tokens are encrypted at the application layer (AES-256-GCM) before storage. Data access is partitioned per organization (row-level security). Sessions are revocable and expire automatically. All traffic is over HTTPS. Administrative access is restricted and logged.
9. Use by minors
CielLogic is a professional tool; it is not intended for people under 16 and we do not knowingly collect their data.
10. Changes
We may update this policy. The applicable version is identified by the date at the top of the page; that date is recorded with your consent when you connect your calendar. We will notify you of any material change by email or in the application.