Privacy policy

BARCELO'NET — operator of Mopflow — is the controller of personal data collected through mopflow.app and the Mopflow application.

For any privacy-related question: contact@mopflow.app

2.1 Data you provide directly

• Manager account: email, password (hashed), company name.
• Employee accounts: username, password (hashed), first name, last name, personal color, role, contract hours, weekly availability.
• Business data: customer sites, services (zone, duration, frequency), time off, absences, field validations.

2.2 Data collected automatically

• Technical logs: IP address, browser type, login dates and times (for security and diagnostics).
• Session cookies: authentication token, display preferences (theme, density). No advertising or third-party tracking cookies.

• Provide, operate, and improve the Mopflow service (auto-scheduling, field validation, customer billing).
• Manage user accounts, authentication, and security.
• Respond to support requests and user questions.
• Build anonymized usage statistics to improve the product.
• Comply with legal and regulatory obligations.

Personal data processing is based on:

• Contract performance between Mopflow and its business customer (GDPR Article 6.1.b).
• Legitimate interest of BARCELO'NET in securing and improving the service (GDPR Article 6.1.f).
• User consent where required (newsletter, optional features — GDPR Article 6.1.a).
• Legal obligations applicable to BARCELO'NET (GDPR Article 6.1.c).

Personal data is never sold, rented, or shared with third parties for commercial purposes.

Data may be shared with the following recipients, strictly in the scope of their mission:

• Technical sub-processors: Vercel (hosting), Supabase (database and authentication). Both are bound by GDPR-compliant Data Processing Agreements (DPAs).
• Authorized BARCELO'NET staff for support and maintenance.
• Legal authorities upon valid judicial request.

Data is retained for the following periods:

• Active account: for the duration of the contractual relationship.
• Closed account: 3 years for commercial and statistical purposes, then deletion.
• Invoices and accounting data: 10 years (French tax obligation).
• Connection logs: up to 12 months.

BARCELO'NET implements appropriate technical and organizational measures to protect your data:

• TLS 1.3 encryption for all communications.
• Passwords stored hashed (bcrypt) — never in clear text.
• Hosting in ISO 27001 and SOC 2 Type II certified data centers (Vercel, Supabase).
• Daily automatic backups on separate infrastructure.
• Restricted data access for authorized staff only.

Under the GDPR, you have the following rights over your personal data:

• Right of access: obtain a copy of your data.
• Right to rectification: correct inaccurate data.
• Right to erasure (“right to be forgotten”): request deletion of your data.
• Right to restrict processing.
• Right to data portability: receive your data in a structured format (JSON or CSV).
• Right to object to processing.
• Right to set directives on the fate of your data after death (where applicable).

To exercise these rights, contact us at contact@mopflow.app. We will reply within a maximum of 30 days.

If you disagree, you may file a complaint with the French data protection authority CNIL or your local supervisory authority.

Data is stored within the European Union (Frankfurt, Germany). Some sub-processors (Vercel in particular) are headquartered in the United States. These transfers are governed by the European Commission's standard contractual clauses and the EU-US Data Privacy Framework.

This policy may be updated to reflect changes to the service or applicable regulations. The last update date is shown at the top of this page. Material changes will be notified to users by email.