Treflexconstant·colorTreflex is operated by Niku Moussavi Biuki, entrepreneur individuel (sole trader), SIREN 130 523 020, 11 chemin du Pont Patry, 53970 Montigné-le-Brillant, France ("we", "us"). Contact for all privacy questions: info@treflex.fr. We have not appointed a data protection officer.
Two roles.
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data: name, work email, role (operator, moderator, admin), company, password (stored only as a salted hash by our authentication provider), acceptance of terms (version and time) | Create and run accounts, sign-in, rights per role | Art. 6(1)(b) contract |
| Customer content: colour measurements, photos, items, batches, reports, CAPA and stability records, notes | Provide the Service to the customer | Processed on the customer's instructions (Art. 28) |
| Audit log: who did what and when (for example corrections, deletions, role changes) | Traceability for the customer's quality system, security | Art. 6(1)(b) and (f) |
| Technical data: IP address, browser, time of access in our hosts' server logs | Operation, security, defence against attacks | Art. 6(1)(f) legitimate interest in a secure service |
| Support requests ("Report a problem" in the app): subject, description, your name and company, and, only if you leave the box ticked, technical details (app version, current screen, role, language, browser, screen size, online status, time, the last app error messages) | Answer and fix problems | Art. 6(1)(b) and (f) |
| Emails (account confirmation, password reset, invitations, service notices) | Operate the Service | Art. 6(1)(b) |
| Billing data of business customers: company name, address, company/VAT number, billing email, invoices | Invoicing, accounting, tax law | Art. 6(1)(b) and (c) |
| Owner dashboard data (only for us as operator): per company the name, status, trial dates, number of users and readings, admin email; no measurements, photos or item names | Customer management, support, billing | Art. 6(1)(b) and (f) |
We do not use advertising, analytics or tracking tools, we do not create profiles, we make no automated decisions with legal effect, and we do not sell data.
We do not set cookies. Fonts and program libraries are loaded from our own servers, not from third parties.
The app uses your browser's local storage for things that are strictly necessary for the function you request: the sign-in session, settings, local copies of data and photos so the app works on your device, the time of your last activity (for the automatic sign-out you or your administrator set), and in offline mode the company name and local user names. No consent banner is needed for this. You can delete this storage in your browser settings; this signs you out and removes the local copies.
We use these providers, each under a data processing agreement:
Our data is stored in the EU. Supabase and Resend are US companies, so access from the USA (for example by their support or operations staff) cannot be ruled out. Such transfers are covered as follows:
You can ask us for a copy of the relevant safeguards at info@treflex.fr.
Encrypted connections (HTTPS with HSTS); encryption at rest at our database provider; strict separation of companies in the database; rights per role enforced by the database itself (not only by the app); append-only audit log; private photo storage with links that expire after one hour; photos re-encoded in the browser, which removes location data (EXIF); minimum password rules; two-factor sign-in for the owner dashboard; automatic sign-out after inactivity (configurable). Details are listed in the technical and organisational measures annexed to the DPA.
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (in particular against processing based on legitimate interest), and you can withdraw consent where processing is based on consent. Under French law you can also give instructions on what happens to your data after your death. Write to info@treflex.fr. We answer within one month.
If your request concerns customer content (for example readings in your employer's account), the customer is the controller: we forward your request to the customer and support it.
You can lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or with the supervisory authority of your country.
Account data (name, email, password) is required to create and use an account. Without it the Service cannot be used. Technical details in support requests are optional.
Treflex is a professional tool for businesses and is not intended for children.
We update this policy when the Service or our providers change. The current version is shown in the app and at https://treflex.fr/privacy.html. When changes are significant, the app asks you to confirm the new version at your next sign-in.
Version 0.3 (draft), 10 October 2026.