Privacy policy

1. Data controller

Move2Cloud, 66 avenue des Champs-Élysées, 75008 Paris, France. For any question about your data, or to exercise your rights: contact@move2cloud.fr.

2. Data processed

• User account: e-mail address, first name and last name, and the phone number you may give in the console with what you agree to be called for (support, sales). Sign-in is handled by the identity service of Move2Cloud; the password is only kept there as a hash, with the two-factor authentication secret and the language of your account.
• Sign-in with Google or Microsoft: if you choose to sign in with one of them, it gives the identity service the identifier of your account there, your name and your e-mail address; never your password, nor access to your e-mails or files.
• Exports and generated files: the exports of your conversations you ask for (a zip of PDF or Markdown files) and a copy of each conversation you export from your history, kept 7 days.
• Organisation and team: the name of your organisation, the details its invoices are made out to (legal name, SIRET, VAT number, address), its members with their role, and the e-mail addresses invited to join it.
• Subscription and use: the plan of your organisation and the state of its subscription, and counts of the use of the Service (conversations, messages, plans, tokens consumed, by organisation and by cloud account).
• Invoices and payment: the invoices issued to your organisation and their state. When you register a means of payment, your card or PayPal details are entered on the page of the payment provider and never reach the Service; an IBAN you enter for a SEPA mandate is passed on to that provider without being kept. The Service only keeps the reference of the means of payment and a label to recognise it (for example the last four digits of a card).
• Access to cloud providers: the credentials or authorisations you grant the Service, and the default parameters you set on an account. Credentials are encrypted before being saved and are never shown again.
• Conversations: your messages, the files and images you attach to them, the answers and plans of the Service, and for each answer its response time and the tokens it used.
• Data read from your cloud accounts: to answer a question or prepare a plan, the Service reads what your access allows (names, configuration and state of your resources). What is read is used for the conversation in progress and appears in it; the Service keeps no copy of your accounts outside your conversations.
• Support requests: the requests you write to the support from the console, the messages exchanged, the files and screenshots you attach to them, and their status.
• Contact form: what you enter in the contact form of the public pages (name, company, e-mail address, phone number, cloud providers used, message). It is sent by e-mail to Move2Cloud and is not kept by the Service.
• Demonstration: the e-mail address, and the phone number if you give it, entered to open the demonstration. They are sent by e-mail to Move2Cloud, who may contact you about the product, and are not kept by the Service.
• Logs: sign-ins, requests to the Service, errors and the journal of the e-mails sent (recipient, kind of message, outcome), for security and support.

3. Purposes and legal bases

• Providing the Service (performance of the contract): answering your questions, preparing and running the actions you confirm, keeping your conversations, managing your team, answering your support requests, sending the messages related to your account.
• Securing the Service (legitimate interest): authentication, logging, prevention of abuse.
• Answering a contact request (steps taken at your request before a contract): calling or writing back to the person who filled the contact form.
• Billing (performance of the contract and legal obligation): measuring the use of the Service, issuing and keeping invoices, collecting their payment with the means of payment you registered.

Your data is neither sold nor used for advertising purposes.

4. Automated processing of your requests

The answers of the Service are produced by an artificial intelligence assistant, which relies on specialised technical providers. To answer you, the Service sends them the content of the conversation: your messages and the earlier turns of that conversation, the files and images you attach, the default parameters of the cloud account concerned, and the data it reads from that account for your request (names, configuration and state of resources). This data is sent as it is, without anonymisation: avoid writing or attaching secrets. The credentials that give access to your cloud accounts are never sent to these providers.

The first message of a conversation is also used to give it a name. Support requests and their attachments are read by people, not by the assistant.

The values of your environment variables are only read and shown when you ask for one by name; listing their names does not reveal them.

5. Recipients and processors

Your data is accessible to you, and to the people at Move2Cloud in charge of operating the Service and of answering your support requests. The administration of the platform displays neither your credentials nor the content of your conversations; it shows your organisation, its plan, its use in tokens, its invoices and its support requests. Within your organisation, an administrator sees its members, its cloud accounts, all its support requests and the journal of the changes run on its cloud accounts (who confirmed a change, on which account, when, and the report of the assistant) with how many questions each member asked on each account; the content of your conversations stays yours. The following providers are involved:

• Scalingo (France, osc-fr1 region): hosting of the Service, of its databases and of their backups, and of the identity service.
• Scaleway (France, Paris region): storage of the files and images attached to your conversations and to your support requests, and of your exports, and sending of the e-mails of the Service and of the identity service.
• Google and Microsoft only if you choose to sign in with them: their own privacy policies apply to your account with them.
• Qonto (France): issuing of the invoices. It receives the name of your organisation and the e-mail address of its owner.
• Mollie (Netherlands): online payment of the invoices by card, SEPA direct debit or PayPal. It receives the name of your organisation, the e-mail address of its owner, the means of payment you register and the amounts collected.
• Automated processing providers (European Union or United States, depending on the cloud provider of the conversation): producing the answers of the assistant, within the limits described in section 4.

The cloud providers you connect (AWS, Microsoft Azure, Google Cloud, OVHcloud, Scalingo, Scaleway) are queried with the access you have granted, to read your account and to run the actions you confirm. No client data is kept at AWS: Move2Cloud only holds there the CloudFormation template made available to AWS clients and the technical identity that assumes the role they create in their account.

6. Retention periods

• The data of your account is kept as long as the account exists.
• Removing a cloud account deletes its credentials. Deleting a conversation deletes its messages and the files attached to it.
• Conversations are kept as long as your account, unless you choose in My data to have them deleted after 30 days, 3 months, 6 months or 1 year without a new message.
• Exports and generated files are deleted 7 days after being made, or before when you delete them from My generated files.
• Your phone number is kept until you remove it from the console. Support requests and their attachments are kept as long as your organisation has an account, to keep the history of what was answered; a request you delete from your list is kept by Move2Cloud until it deletes it for good.
• A contact request stays in the mailbox of Move2Cloud for the time needed to answer it, and three years at most after the last exchange.
• Backups of the databases are made regularly by the host: deleted data may remain in them until they expire.
• Invoices are kept for the period required by law (ten years).

7. Security

• Encrypted exchanges (HTTPS); cloud credentials encrypted in the database (AES-256-GCM); passwords kept as hashes.
• Two-factor authentication required for every user.
• Conversations partitioned by user; cloud accounts, support requests and invoices partitioned by organisation, with what each role may see and do. A change to your resources only runs after you confirm its plan.

8. Cookies

The Service only uses cookies necessary for its operation: those of the sign-in session, those that remember the language you chose and one the organisation you work in. A few display preferences (the appearance, the providers you use, the style of code blocks) are kept in your browser. There is no advertising cookie and no audience measurement tool. See the cookie policy.

9. Your rights

You have a right of access, rectification, erasure, restriction, objection and portability over the data that concerns you. From My Account you can download all of it and delete your account yourself; for anything else, write to contact@move2cloud.fr. If the answer does not satisfy you, you can refer the matter to the CNIL (cnil.fr), the French data protection authority.

10. Changes to this policy

This policy changes with the Service. The version in force is the one published at this address, with its date of update.