Personal data (GDPR)

BARCELO'NET, the operator of Mopflow, is the data controller. For any GDPR request, a single point of contact: contact@mopflow.app.

• Account: email, password (hashed), first name, last name.
• Preferences: language, theme, dashboard widgets.
• Business data you enter: customer sites, services, teams, time off, field validations.
• Technical logs: IP address, browser, login dates and times (security).

No sensitive data as defined by the GDPR (ethnicity, health, political opinion, etc.) is collected or requested by Mopflow.

• 1. Right of access — You can request a full copy of your data in a readable format (JSON or CSV) at any time.
• 2. Right to rectification — If any information is inaccurate, you can edit it directly in your account or ask us to do so.
• 3. Right to erasure — You can request permanent deletion of your account and all associated data (subject to legal retention obligations, e.g. invoices = 10 years).
• 4. Right to restriction — You can request that a specific processing be suspended while a question is being clarified.
• 5. Right to portability — You can receive your data in a structured format to transfer it to another service.
• 6. Right to object — You can object to processing of your data on legitimate grounds (unless processing is necessary for contract performance).
• 7. Post-mortem rights — You can set directives on the fate of your data after your death (where applicable).

How? Email us at contact@mopflow.app with:

• the subject of your request (e.g. “Delete my account”),
• your Mopflow account username or email,
• a copy of an ID document (for verification, deleted after processing).

We commit to replying within a maximum of 30 days.

• Active account: as long as you use the service.
• Closed account: 3 years for commercial and statistical purposes, then permanent deletion.
• Invoices and accounting data: 10 years (French tax obligation).
• Connection logs: up to 12 months.

Your data is stored in data centers in the European Union (Frankfurt, Germany), on the infrastructure of our sub-processor Supabase (region eu-central-1).

Web hosting (Vercel) may transit through servers in the United States, governed by the European Commission's standard contractual clauses and the Data Privacy Framework.

• TLS 1.3 encryption on all communications.
• Hashed passwords (bcrypt) — never stored in clear text.
• Daily automatic backups on separate infrastructure.
• Restricted access to authorized staff only, with strong authentication.
• ISO 27001 and SOC 2 Type II certified hosting.

If you believe Mopflow is not respecting your rights, you can file a complaint with a supervisory authority — for French residents, the CNIL:

cnil.fr/en/plaintes

But we hope it doesn't come to that — an email to contact@mopflow.app usually resolves things quickly.