Privacy policy

Last updated: 6 October 2026.

What we collect

• Access request: your email address and, if you entered one, the description of your event.
• Account: name, email address, profile photo, organisation, role.
• Acceptance of the terms: the version accepted, the date, where it was given, and a fingerprint of your email address — never the address itself. It is used to prove the agreement in a dispute.
• Google sign-in, if you choose it: your name, email address, profile photo and Google account identifier, with the sign-in tokens Google hands us — nothing else from that account. Until you upload another one, your photo stays hosted by Google: your browser and your team's load it from Google's servers.
• Business data: what you enter in the application — suppliers, events, budgets, documents. It belongs to your organisation.
• Technical logs: IP address and request timestamps, for security and abuse limitation.

Why, and on what legal basis

• Providing the service and managing your account — performance of the contract.
• Replying to you after an access request — legitimate interest, revocable by simply replying to our email.
• Securing the service (rate limiting, abuse detection) — legitimate interest.

We do not sell any data and we do not use your business data to train any model. The Clara assistant only accesses your organisation's data, at your request.

For how long

• Access request not followed by sign-up: 12 months after the request, then deleted from our mailbox.
• Active account: for the duration of the contractual relationship.
• After account deletion: erased immediately; supplier entries of a workspace emptied by the departure of its last member: 30 days; backups: 90 days at most; invoices: legal retention period for accounting records.
• Proof of your acceptance of the terms (version, date, fingerprint of your address): 5 years after account deletion, so the agreement can be proved in a dispute (GDPR, art. 17(3)(e)).
• Sign-in codes and attempts: 24 hours.
• Technical logs (IP address, timestamp): 30 days at most, erased automatically by our host.

Where the data is hosted

Database and backups in the European Union. Any transfers outside the EU rely on the European Commission's standard contractual clauses.

Processors

Railway (hosting, EU), Mistral AI (France — the Clara assistant: the texts and files you give it, the sentence typed on the home page when you ask it to prepare your event from it, your voice when you dictate to it, and the photos you ask it to read), Resend (email sending), Cloudflare (file storage, and the anti-bot check on sign-up), Stripe (payments), Google (sign-in with your Google account, if you choose it), Google Ireland Limited (audience measurement) and Microsoft Ireland Operations Limited (Clarity, session recording) — for the latter two, transfers to the United States are covered by the EU—US Data Privacy Framework. The up-to-date list is provided on request at contact@squena.com.

Clara's voice dictation goes through Mistral AI: when you tap the microphone, your browser records your voice until you tap it again, then Squena passes that recording to Mistral AI to be transcribed, without keeping it. In Clara's field, only the text comes back, and you choose whether to send it. In a record to fill in (“Dictate”), the transcribed text goes straight back to Mistral AI, which draws the record's fields from it: you review them before saving. Likewise, a photo you drop to fill in a record — a business card, a poster — is passed to Mistral AI to be read, then forgotten: Squena never keeps it, and it does not end up in your documents unless you choose to attach it to your question. Before sending, your browser converts it to JPEG, which removes its GPS location. Mistral AI keeps what it receives for 30 days to monitor abuse, then deletes it. Dictation and photo reading are optional: you can always type instead of dictating, and fill in a record by hand.

Cloudflare Turnstile protects sign-up on squena.app against bots, and sign-in when too many attempts follow one another. To tell a person from a program, it analyses technical signals from your browser: IP address, User-Agent header, TLS connection fingerprint, and the site that shows it. Squena only receives a verdict, human or not. Cloudflare processes these signals on our behalf, and as a controller to improve its bot detection: its Turnstile privacy policy.

Your rights

Access, rectification, erasure, restriction, objection and portability. Write to contact@squena.com: we answer within one month. You may also lodge a complaint with the CNIL, the French data protection authority.

Cookies

The site uses Google Analytics 4 to measure its audience: which pages are viewed, which buttons are clicked, and how many access requests go through. Two cookies are set (_ga and _ga_<ID>), kept for 13 months at most. No data you enter is sent there — neither your email address nor the description of your event: only counters and the name of the button clicked are reported.

The site also uses Microsoft Clarity, which records the anonymous course of visits — mouse movements, clicks, scrolling — to understand where pages get stuck. The content of input fields is never recorded, whatever the setting: neither your email address nor the description of your event. Two cookies are set (_clck, kept for a year, and _clsk, one day), plus a Microsoft identifier.

The application itself sets, without asking, cookies that are strictly necessary and exempt from consent: your sign-in session (thirty days) and what secures it while it opens, your language (one year), your answer to the measurement banner (six months), the example workspace when you open it (seven days), the sentence typed on this site's home page (two hours, time enough to prepare your event from it) and, if you arrive through a referrer's QR code, that code (thirty days, so the free days come with your workspace). A few preferences, such as Clara reading her answers aloud, also stay in your browser without leaving it.

The application also measures its audience with Google Analytics — the same two cookies — but only once you agree: on its own banner, or right here, since your answer goes with you when you move from this site to the application (unless you already gave one there). You can change your choice at any time from “My account” in the application. Microsoft Clarity is never loaded there: it only runs on this site.