OfficeDraft — document under review by a lawyer. It will be updated before online subscription opens; fields marked [à compléter] (to be completed) are still to be filled in.
This translation is provided for information only: the French version of this document is the only legally binding version. Version française
Privacy and cookie policy
Version of 5 October 2026
This policy explains what personal data Omnifloo Office processes, why, for how long, with whom it is shared and how to exercise your rights. Our constant principle: your data is hosted in France, is neither sold nor used for advertising, and the content of your documents is never analysed.
1. Data controller
DYONYSOS SASU, registered office in Mouguerre (France) — identifiers and full address in the legal notice. Contact for any question about your data: contact@omnifloo.com. Data protection contact: [à compléter : nom ou fonction].
2. Processing, purposes, legal bases and retention
User account
Data: email address, name, institution (optional), status (teacher, student, professional…), interface language, password (stored in irreversibly encrypted form, never readable). Purpose: create the account, authenticate you, manage plans and quotas. Legal basis: performance of the contract (terms of use). Retention: for the life of the account, then 30 days after it is closed.
Documents and storage space
Data: the files you create or upload, their versions, comments and shares, as well as the calendar, contacts, tasks and notes in your workspace. Purpose: store, edit, co-edit and share your documents. Legal basis: performance of the contract. Retention: for the life of the account, then 30 days after it is closed. We do not access the content of your documents, except at your request (support) or when legally required by an authority.
Service emails
Data: email address, name, language, sign-up date and sending history. Purposes: welcome email, two getting-started tips (about 3 and 10 days after sign-up), account deletion confirmation and, where a paid plan provides for it, an end-of-trial notice. Legal basis: performance of the contract (welcome, deletion) and legitimate interest in helping you use the service (tips). Each tip includes a one-click unsubscribe link. Retention: 60 days after sign-up for the sending queue; immediate erasure when the account is deleted.
Technical logs and security
Data: IP address, date and time, page or resource requested, browser, result of the request. Purposes: service security, abuse prevention, incident diagnosis, legal obligations to retain connection data. Legal basis: legitimate interest and legal obligation. Retention: [à compléter : durée de conservation des journaux, au plus un an]. For the no-account trial, the IP address is kept only as a truncated fingerprint, erased after one hour; for the writing assistant, the per-IP anti-abuse counter is kept in memory for ten minutes.
No-account trial
The trial document is never saved: the editing server's temporary file is discarded when the editor is closed. A technical cookie links your browser to the trial session for one hour at most.
Writing assistant
When you use the assistant, the selected passage and the API key you entered pass through our server to the artificial intelligence provider you chose (for example OpenAI, Anthropic or Mistral), and the response is sent back to you. We keep neither the text, nor the key, nor the response, and record them in no log; your key is stored only in your browser. The provider processes this data under its own terms, which you accepted when creating your key: it acts under your responsibility and not as a processor of DYONYSOS SASU. Legal basis: performance of your request.
PDF tools and signature
Files sent to the PDF tools are processed for the duration of the request, in temporary files that are deleted automatically, and are not kept. For signatures, a personal certificate is created at your first signature and stored encrypted, together with a fingerprint of each certificate issued so that Omnifloo signatures can be recognised during verification. Legal basis: performance of the contract. Retention: for the life of the account.
Backups
The workspace database and files are backed up every day in encrypted form, on the server and in a second location [à compléter : lieu de la copie distante]. Retention: 7 daily, 4 weekly and 6 monthly backups; erased data therefore disappears from backups no later than six months afterwards. Legal basis: legitimate interest (service continuity, protection against data loss).
Audience measurement
Only if you accept it in the consent banner, the site uses Google Analytics 4 to measure its traffic: pages viewed, visit duration, device type, approximate country or region, with a pseudonymous identifier; the IP address is anonymised. These statistics are used only to improve the site, never for advertising. Legal basis: consent, which can be withdrawn at any time. Retention: 13 months for cookies, 14 months for data in the measurement tool [à compléter : vérifier le réglage de conservation dans GA4].
Invoicing and support
For paid plans: identity and billing details, plan subscribed, invoices and payment history (bank card data is processed only by the payment provider). Legal basis: performance of the contract and legal accounting obligation. Retention: 10 years for accounting records. For support: email exchanges, kept for 3 years after the last exchange.
3. Cookies and trackers
| Name | Purpose | Duration | Consent |
|---|---|---|---|
| omnifloo_lang | Remembers the chosen language | 1 year | Not required (functional) |
| Workspace session cookies | Keep you signed in and secure forms | Session or duration of the sign-in | Not required (functional) |
| omnifloo_essai | Links the browser to a no-account trial session | 1 hour | Not required (functional) |
| omnifloo_mesure | Remembers your choice on audience measurement | 6 months | Not required (functional) |
| _ga, _ga_* | Google Analytics 4 audience measurement | 13 months | Required: set only after “Accept” |
Your browser's local storage also keeps the writing assistant's settings (provider, model, API key): they only leave your device when you send a request to the assistant.
You can also delete cookies at any time from your browser settings.
4. Recipients and processors
Your data is accessible only to authorised staff of DYONYSOS SASU and to the following processors, within the limits of their task:
- OVH SAS (Roubaix, France): server hosting, in France;
- [à compléter : prestataire d'envoi des e-mails]: delivery of service emails;
- [à compléter : prestataire de paiement]: payment for paid plans, once they open;
- Google Ireland Limited: audience measurement, only if you have accepted it.
No data is sold, rented or transferred for commercial purposes.
5. Transfers outside the European Union
Your accounts, documents and backups stay in France. Transfers outside the European Union can occur in only two cases: audience measurement, if you accept it (Google may process data in the United States, under the EU–US Data Privacy Framework and standard contractual clauses); and the writing assistant, to the provider you yourself chose.
6. Security
Encrypted connections (HTTPS); passwords stored in irreversibly encrypted form; encrypted backups, verified regularly; restricted, key-protected administrative access; technical secrets stored outside the source code; signed exchanges with the editing server; regular security updates.
7. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw your consent at any time and to set instructions on what happens to your data after your death. To exercise them, write to contact@omnifloo.com from your account's email address; we reply within one month. You may also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr), or with your local authority.
8. Changes
This policy evolves with the service. Any significant change is notified to you by email or by a notice on the site before it takes effect.