Translation provided for information. In case of discrepancy, the French version prevails.

Applications privacy policy

Last updated: 18/10/2026

This policy applies to the InSighter applications, opened from app.insighter.tech: FidSighter, FinSighter, BizSighter, BookSighter, ProSighter, RiskSighter, WinSighter and IntSighter. For the showcase website, see the website privacy policy.

1. Who processes your data, and in what capacity

The publisher is Leonis Consult SASU, 7 rue Vivienne, 75002 Paris, France, SIREN 105 681 126 — contact@insighter.tech. It acts in two capacities:

• Controller for your account: identity, sign-in, security, orders and billing, service emails (section 3).
• Processor for the content of the files: we process it on behalf of the firm or company that subscribed, only on its instructions, under Annex A of the terms and conditions (section 4).

Are you a director or beneficial owner of a company followed by a firm, or a correspondent of a user? The controller of your data is that firm or company: please address your requests to it. If you write to us, we forward your request to it within five working days, without disclosing anything from its file to you.

No data protection officer has been appointed to date; write to contact@insighter.tech.

2. In short: the confidentiality of your files

• Your data belongs to you. We use it for no purpose other than running the applications. It is never sold, transferred or used for advertising.
• No AI training, no aggregation. Your data is not used to train any artificial intelligence model, and we compile no statistics mixing the data of several clients.
• Where your data is. The content of your files is stored on our servers in the European Union, in France (Paris region), so that you find it from one device to another and the people you authorise can access it. Your browser keeps a working copy, deleted when you clear its data.
• Segregation. A firm never sees another firm's files; a client sees only its own file and the tools its firm has opened to it; a staff member sees only the files assigned to them. These rules are enforced on our servers, not just on screen.
• Access by our team. Limited to support and maintenance, under a duty of confidentiality.
• No tracking. No advertising cookies, no audience measurement, no profiling (section 12).

3. Data for which we are the controller

3.1 Your account and your organisation

• Data: name, email address and its verification; password hash (never the password itself); two-factor authentication secret and backup codes; role; for the organisation: name, company number, VAT number, billing address and email; for an invitation: the invited address and who sent it; your display preferences.
• Purpose: creating and managing your access, your organisation, your colleagues and their rights.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Retention: as long as the account exists; it is deleted when closed. An unaccepted invitation expires after 7 days.

When you create a password, we check that it does not appear in a known breach with the Have I Been Pwned service: only the first five characters of a hash of the password are sent, never the password or your address.

3.2 Orders, payments and billing

• Data: subject and amount of the order, terms accepted and their version, payment status, credits and their movements, billing details, reason for cancellation if you give one.
• Purpose: collecting payment, invoicing, keeping our accounts.
• Legal basis: performance of the contract (Art. 6(1)(b)) and legal accounting obligation (Art. 6(1)(c)).
• Retention: 10 years from the end of the financial year for accounting records (French Commercial Code, Art. L123-22). Technical notifications received from payment providers are emptied of their content after 3 months; only their identifier and status remain.

No card data passes through our servers: payment is entered with the provider you choose (Stripe or Revolut), under its own terms.

3.3 Sign-ins, audit log and security

• Data: IP address, browser, date and time, action performed.
• Purpose: keeping you signed in, tracing sensitive actions, detecting abuse, investigating incidents.
• Legal basis: legitimate interest in securing the service and the data entrusted to us (Art. 6(1)(f)), security obligation (Art. 32).
• Retention: a session closes after 12 hours of inactivity and lasts 30 days at most; the trace of a closed session is deleted after 31 days; in the audit log, the IP address and browser are erased after one year, leaving only the record of the operation (who, what, when) as its proof.

3.4 Service emails

Address verification, invitations, subscription deadlines, alerts you have turned on. Legal basis: performance of the contract. We send no marketing from the applications.

3.5 Measuring the use of AI agents

For each question asked to an agent, we keep who asked it, when, with which tool and how many tokens it used, to apply limits and show you your consumption. Legal basis: performance of the contract. This record contains neither the question nor the answer (section 5).

4. The data in your files (we are the processor)

On behalf of the firm or company, we store and process what users enter, upload or connect in the applications, in particular:

• the company's identity, accounts, trial balances, budgets, plans and invoices, including electronic invoices exchanged on the Peppol network;
• uploaded documents and the firm's notes;
• for anti-money laundering (FidSighter): the identity of directors and beneficial owners, their shareholding and the results of the checks;
• for running the firm: staff assignments, hours and internal notes, never shown to the firm's client;
• internal messaging, the calendar and, if you connect it, your Outlook mailbox (section 6).

Retention. For as long as the subscription runs. When the relationship ends, the client may request in writing the return and then the deletion of its data: it is deleted within 30 days of the request, backups included within the following 30 days. Without a request, it is kept so that a subscription can be resumed, and its deletion can be requested at any time. We keep the data the law requires us to keep (orders, invoices, log of operations) and data the client asks us to keep longer for its own legal obligations, such as anti-money laundering (terms and conditions, Art. 11.5).

Return. Each user can download their account data at any time (Account › Your data). File data is returned on request, in a machine-readable format.

5. Artificial intelligence agents

• Your provider, your key. Agents use the model of the provider chosen by your organisation (for example Anthropic, Mistral AI, OpenAI or Google), with the API key it provided itself. That provider acts under your organisation's contract and on its instructions. The key is encrypted on our servers and never displayed.
• What is sent to the provider: the question and the file elements needed to answer it, nothing more.
• The agent acts with your rights. It sees only what you are allowed to see.
• You know when you are talking to an AI: answers are labelled as such and point to their sources.
• Retention: the question and the answer are deleted from our servers after 30 days; only the record described in section 3.5 remains.

6. Connected Microsoft Outlook mailbox

If you connect your Outlook mailbox, we receive from Microsoft, with your authorisation, your Microsoft identity, your received and sent messages and their attachments, your calendar and your contacts. We never receive your password; the access authorisation is encrypted on our servers.

• Use: synchronising your mailbox and calendar, filing each message in the relevant client file, sending from your mailbox what you have prepared, creating the appointments you ask for. Nothing is sent without your action, and nothing is ever deleted in your Outlook mailbox.
• Access: you alone, even for a message filed in a client file. The only exception is the deactivation of your account (for example when you leave): your filed messages and appointments are then transferred to your organisation's licence manager or the person they designate, with no access to the mailbox itself.
• Retention: unfiled messages, 30 days; a message deleted in the applications, deleted at once; filed messages, as long as the file; after disconnecting Outlook, 30 days; after account deactivation, 12 months at most with the recovery user; the access authorisation is deleted on disconnection.

Use the connected mailbox for business purposes only. Details are on the Outlook connection page.

7. Other services you connect

Your accounting software (Odoo, Horus), your phone system (3CX) or your AI provider are your providers: you connect them yourself, and they act on your instructions under their own contract and privacy policy. We send them only what the feature you use requires, and your connection credentials are encrypted on our servers.

8. Recipients and processors

Your data is accessible to the Leonis Consult team, strictly for support and maintenance, and to our processors, each bound by a contract compliant with Article 28 GDPR:

• Supabase: database, authentication and files — European Union, Paris region;
• Vercel: hosting of the applications — France, Paris region;
• Resend: sending of service emails — European Union, Ireland;
• Dokapi: Peppol access point for electronic invoices — Belgium;
• Odoo SA: our own invoicing — European Union.

Payment providers (Stripe, Revolut) receive the data of the payment you make with them. The up-to-date list is published on the Subprocessors page; any addition is announced there at least 30 days before it goes live.

9. Transfers outside the European Union

The applications' data is hosted in France. Supabase, Vercel and Resend are companies established in the United States; we chose processing in the European Union with them. Any access from the United States (support, operations) is governed by the European Commission's standard contractual clauses and, for Vercel, by the EU–US Data Privacy Framework.

10. Security

• Hosting in France, encrypted exchanges.
• Segregation by organisation and by file, enforced on our servers and in the database.
• Two-factor authentication mandatory for owners and administrators, offered to everyone.
• Passwords of at least 12 characters, checked against known breaches; limited number of attempts.
• Encrypted API keys and access authorisations for connected services.
• Audit log of sensitive actions; daily backups; documents served through temporary links.

In the event of a data breach: for your account, we notify the supervisory authority within 72 hours and warn you if the risk is high; for your files, we warn your firm or company no later than 48 hours after becoming aware of it.

11. Your rights

For the data we control (section 3), you can access, rectify or erase it, restrict its processing, object to its use and request its portability. Write to contact@insighter.tech, preferably from your account's address. We reply within one month, which may be extended by two months for a complex request; we will tell you so within the first month. Invoices remain kept for 10 years, and the record of operations in the audit log, as their proof.

For file data (sections 4 to 6), contact the firm or company concerned; we help them answer you.

You can lodge a complaint with the CNIL (www.cnil.fr), Leonis Consult being established in France, or with the authority of your country — in Belgium, the Data Protection Authority (www.dataprotectionauthority.be).

12. Cookies and browser storage

The applications set only one cookie that identifies you: the session cookie. Its sole purpose is to know which user is signed in, and therefore which applications they can open and use. It is protected (HttpOnly, Secure, SameSite=Lax) and disappears at the end of the session.

In addition, only while you connect Outlook or Horus, two small technical cookies protect that operation and are deleted after 10 minutes.

Your browser also keeps, in its local storage, your display preferences (language, theme, menu layout, shortcuts) and a working copy of the open applications (section 2). None of it is read by a third party.

No advertising cookies, no audience measurement, no third-party trackers. All of these are strictly necessary for the service you request: they do not require your consent, which is why no banner is shown.

13. Changes

We inform you by email and in the applications of any significant change at least 30 days before it takes effect.