Privacy policy

Your privacy is important to us. Unless otherwise specified, The Company Land (hereinafter the “Publisher”) is responsible for the processing of personal data in connection with the Services.

We process personal data in accordance with applicable data protection and privacy laws and regulations, including, where applicable, the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable local data protection requirements.

Our Privacy Policy describes our main practices regarding the collection, use, disclosure, retention, protection and processing of personal data in connection with the Services.

Where the Services integrate with third-party services or APIs, the processing of data may also be subject to the applicable terms and privacy requirements of those third parties, including, where relevant, the Google API Services User Data Policy and Google APIs Terms of Service.

The Publisher collects and processes the following categories of data:

• Account data: last name, first name, email address, password (hashed), phone number, business information (company name, SIRET number, etc.).
• Service data: invoices, accounting entries, bank account and transaction data made available through connected banking services, uploaded documents, settings and activity logs.
• Connected bank account data: If you choose to connect a bank account to The Company Land, account and transaction information may be retrieved through our open banking technology provider, Powens, with your authorization. This information may include account identifiers, balances, transaction details and related banking information and is used to provide accounting, reconciliation, financial management and related features. Your bank credentials are handled through the applicable secure bank connection process and are not collected by The Company Land where the authentication process is handled directly by the open banking provider.
• Technical data: IP address, session identifiers, browser type, connection logs.

When the User signs in with “Sign in with Google” or connects a Gmail mailbox to the Service, the Publisher accesses the following data, with the User's explicit consent collected through Google's OAuth screens:

• Basic Google profile (Google ID, name, email address, profile picture) — solely to authenticate and identify the User.
• Gmail messages and attachments, read-only — solely to automatically detect and import invoices, receipts and accounting documents into the Service.
• Message metadata (sender, date, subject, size) — solely to identify emails likely to contain attachments relevant to accounting.

Data is used solely for the following purposes:

• creating and managing the User's Account;
• providing, operating, maintaining and improving the features of the Service;
• ensuring security, preventing fraud and fighting abuse;
• complying with applicable legal obligations (in particular accounting and tax obligations);
• communicating with the User about the operation of the Service and support.

In accordance with the Google API Services User Data Policy, and in particular its “Limited Use” requirements, Google user data obtained through Google APIs is used only to provide or improve user-facing features of the Service (authentication and automatic import of invoices and receipts from Gmail). In particular, the Publisher undertakes:

• not to use this data to serve, target or display advertising;
• not to sell, rent or transfer this data to any third party;
• not to use this data, whether raw, aggregated or anonymized, to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models;
• not to transfer this data to third-party artificial intelligence services that would use it to train their own models;
• not to allow any human to read this data, except (a) with the User's explicit consent, (b) for security purposes (fighting abuse, legal compliance), or (c) where the data is aggregated and anonymized for internal statistical purposes.

The Company Land's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Attachments imported from Gmail are processed by the Publisher's own systems to determine whether they are accounting documents and to extract their content. To provide the artificial intelligence features of the Service (such as structuring invoice data or the in-app assistant), data derived from these documents may be processed by OpenAI (API), acting as a processor, for the sole benefit of the User. Files imported from Gmail are never sent to OpenAI in their original form, and under OpenAI's API terms data sent to OpenAI is not used to train its models.

Certain features of the Services use artificial intelligence to process, analyze, classify or generate information based on data provided by or on behalf of Users.

Where you use features that require personal data to be processed by a third-party artificial intelligence provider, such as OpenAI, we will clearly inform you of such processing and obtain your permission where required before the relevant personal data is shared.

OpenAI acts as a service provider for the relevant processing. Data submitted through the applicable API is processed solely to provide the relevant functionality and is not used to train OpenAI's models, subject to the applicable service terms.

The Publisher does not sell or rent personal data. Data is shared only with the processors strictly necessary to provide the Service, listed below:

• Hosting: Amazon Web Services EMEA SARL (Luxembourg) — data stored in the AWS Paris region (eu-west-3).
• Google authentication: Google LLC — for the “Sign in with Google” feature.
• Email connection: Nylas, Inc. — technical intermediary providing the secure OAuth connection to Gmail accounts and the retrieval of attachments (the Publisher does not use Nylas for any other purpose).
• Bank connection: Powens (France) — open banking technology provider used to connect the User's bank accounts and retrieve, with their authorization, account and transaction information.
• AI processing: OpenAI, L.L.C. (USA) — artificial intelligence features of the Service, without receiving files imported from Gmail in their original form and without use of the data to train its models.
• Payment: Stripe Payments Europe Limited — processing of subscription payments.
• Transactional communications: Novu (in-app notifications) and SMTP providers for sending service emails.

Each processor is bound by a contract compliant with Article 28 of the GDPR and acts only on the Publisher's documented instructions. Data may also be disclosed to administrative or judicial authorities upon lawful request.

Data is hosted within the European Union (AWS, Paris region, eu-west-3). Any transfers outside the EU (in particular to Google and OpenAI) are governed by the European Commission's Standard Contractual Clauses and supplemented by additional security measures.

The Publisher implements the following appropriate technical and organizational measures: TLS encryption in transit, encryption at rest, strict role-based access control following the principle of least privilege, access logging, multi-factor authentication for administrative access, regular audits, a strong password policy and incident response procedures.

Google and Nylas OAuth tokens are stored encrypted and are accessible only to the automated processes strictly necessary to provide the Service.

Account data is retained for as long as the Service is used. Upon termination of the Account, it is deleted within thirty (30) days at most. Certain information may be retained for longer periods where required by applicable law, including for the period required under applicable accounting, tax and regulatory laws in the relevant jurisdiction(s), which may vary depending on the country and the nature of the records concerned.

Google user data (retrieved Gmail emails, OAuth tokens) is deleted immediately when the User disconnects their mailbox in the Service, deletes their Account, or revokes access from https://myaccount.google.com/permissions. Attachments already imported into the Service are kept like any other accounting document, in compliance with the applicable legal retention periods.

The User may request the deletion of their data at any time by deleting their Account directly from the Service settings. The request is processed within thirty (30) days at most.

Depending on the laws applicable to the User, the User may have certain rights in relation to their personal data, including the right to access, correct, update, delete or obtain a copy of their personal data, as well as the right to object to or restrict certain processing activities and, where applicable, to data portability and withdrawal of consent.

Users located in jurisdictions where the GDPR applies may exercise the rights provided under the GDPR, including the rights of access, rectification, erasure, restriction of processing, data portability and objection, as applicable.

Users may exercise their rights by contacting us at tech@thecompanyland.ai. Where applicable, Users also have the right to lodge a complaint with the competent data protection or supervisory authority in their country or jurisdiction.

Users who have connected their Google account to the Services may revoke The Company Land's access to their Google data at any time through their Google Account permissions settings.

The Company Land uses cookies that are strictly necessary for the service to work (authentication, session) and, subject to your consent, audience measurement and customer support cookies. You can change your choices at any time from your browser settings.