Data Collection and Processing Policy
This policy describes the data collected and processed on the TOONAH platform (app.toonah.io, api.toonah.io, Bernard assistant): who processes the data, for what purpose, with which providers — including for artificial intelligence —, where, for how long, and how to exercise rights. It forms part of the Platform Usage Contract. For processing relating to the website, prospects and the commercial relationship, see the Privacy Policy.
1. Who does what
- The Customer (the organisation that opens a space) is the controller of the data it records in its space. It decides what it puts there, who has access and for what purpose.
- TOONAH SAS acts on its behalf, as a processor (Article 28 GDPR), on the terms of the Data Processing Agreement ("DPA").
- TOONAH is the controller for: the security of the platform and its technical logs, invoicing, evidence of acceptance of contractual documents, support, and aggregated and anonymised usage statistics.
2. Data collected on the platform
| Category | Examples | Source |
|---|---|---|
| Accounts and access | Surname, first name, business e-mail, language, roles, account status, last login, failed logins, activation of two-factor authentication (the secret is encrypted), recovery codes (hashed) | Customer's Administrator; the user themselves |
| Organisation | Name, country, sector, profile type, plan, company identification information (name, registration, tax number, address, contact) | Customer's Administrator |
| Governance, risk and compliance content | Risks, controls and tests, audit engagements, findings, recommendations, action plans, incidents, policies, evidence, documents, maps, indicators; may mention individuals (owners, auditors, auditees, third parties) | Customer's Users |
| Data imported by integrations activated by the Customer | Directory, two-factor authentication enrolment and sign-in logs (Microsoft 365 / Entra ID, Google Workspace); logs and statuses transmitted by the Customer's monitoring tools | Customer's systems, via connectors that it activates and for which it provides the access credentials (encrypted secrets) |
| Interactions with AI | Bernard's questions and answers, documents submitted for analysis, document studio drafts, feedback ("helpful / not helpful", corrections) | Customer's Users |
| Learning memory (if enabled) | Preferences, terminology, corrections and formats retained for the space or the user | Customer's Users, with their consent |
| Technical and security logs | Sensitive actions (login, role change, AI settings, support access) with date, IP address and browser; metadata of calls to AI models (provider, model, region, volume), without the content | Platform |
| Invoicing | Plan, currency, billing e-mail, customer and subscription identifiers at Stripe, payment status (no card data) | Customer's Administrator; Stripe |
| Evidence of acceptance | Versions and fingerprints of the documents accepted, date, method, language, HMAC fingerprints of the IP address and browser | Platform, at the time of acceptance |
The Customer undertakes not to introduce special categories of data (health, opinions, biometric data, etc.) or data relating to offences without necessity and a legal basis (Article 8 of the Contract).
3. Purposes and legal bases
| Purpose | TOONAH's role | Legal basis |
|---|---|---|
| Providing the platform's features to the Customer (storage, calculations, dashboards, reports, workflows, integrations) | Processor | Legal basis determined by the Customer; for TOONAH, performance of the Contract |
| AI features (Bernard, document analysis, assisted drafting) | Processor | Same |
| Space learning memory | Processor | Activation by the Customer and consent of the user for their own signals |
| Authentication, abuse prevention, security, audit log | Controller | Legitimate interest (security); security obligation (Article 32 GDPR) |
| Invoicing | Controller | Performance of the Contract; legal obligation |
| Evidence of acceptance of contractual documents | Controller | Legitimate interest (evidence); legal obligation |
| Support and support access | Processor (within the space) | Customer's instruction (support request) |
| Aggregated and anonymised usage statistics | Controller | Legitimate interest (service improvement) |
4. Artificial intelligence
4.1. What the AI does
Bernard answers questions, analyses documents, drafts proposals and may propose actions in the space. It relies on the reference texts in the knowledge base and on the data in the space to which the user has access. The content produced is AI-generated and identified as such. It consists of proposals to be checked. Any action proposed by Bernard that modifies the space awaits explicit confirmation by an authorised user. Bernard does not provide legal advice.
4.2. Data transmitted to model providers
To produce an answer, the platform transmits to the model: the question, the relevant conversation history, extracts from the reference texts and relevant data from the space, and, for a document analysis, the content of the document (PDF up to 32 MB, or text extracted from a Word file). Only the data necessary for the task is transmitted.
4.3. Providers and regions
| Use | Provider | Place of processing | Activation |
|---|---|---|---|
| Conversation, planning, drafting; computation of vector embeddings (search) | Mistral AI | European Union [TO BE COMPLETED: to be confirmed under the Mistral contract] | By default |
| In-depth document analysis, structuring of procedures, in-depth review in the studio | Anthropic (Claude) via Google Cloud Vertex AI | Google Cloud European Union region | Only if an Administrator activates it in the AI settings of the space ("Claude via Vertex AI EU") |
| Same uses | Anthropic (Claude), direct API | United States | Only if an Administrator explicitly chooses this mode; refused for spaces in the European Union / EEA zone |
| Audio transcription; legacy vector embedding model | OpenAI | [TO BE COMPLETED: location] | [TO BE COMPLETED: to be confirmed — disabled or enabled in production] |
| toonah.io public assistant | Mistral AI | European Union | Always Mistral, never Claude |
For spaces in the European Union zone in strict mode, Claude is used only via Vertex AI in the European Union region and only if advanced document analysis is enabled; otherwise, Mistral is used. The AI settings of the space can be viewed by its users and modified by its Administrators; each modification is logged.
4.4. Use of data by providers
[TO BE COMPLETED: for each provider, commitment not to reuse the data for model training and retention period of requests at the provider, according to the signed contracts (Mistral AI, Google Cloud, Anthropic, OpenAI where applicable).]
TOONAH does not transmit technical identifiers of the space to providers beyond what the service requires. TOONAH's logs of calls to the models do not contain the content of the exchanges (only provider, model, region, volumes, and a fingerprint for traced decisions).
4.5. Bernard's learning
Bernard is not "retrained" with customer data. It may memorise, for the space, preferences, terminology or corrections, in order to answer better. This memory:
- is fed only upon activation by the organisation and with the user's consent for their own signals; without consent, only statistics are kept;
- goes through a moderation queue in the space (approve, edit, reject, revoke);
- remains specific to the space: a lesson may join the common knowledge base only after anonymisation and double human validation;
- can be disabled; each user can erase their learning data.
4.6. Transparency (European AI regulation)
Users are informed that they are interacting with an AI system; generated content is identified; actions remain subject to a human decision. A Customer using Bernard in a process falling within a high-risk category within the meaning of Regulation (EU) 2024/1689 (AI Act) informs TOONAH and checks its own obligations as a deployer.
5. Transfers outside the European Union
The platform and its databases are hosted in France (OVH). A transfer outside the European Economic Area takes place only:
- if an Administrator activates Anthropic's direct API (United States);
- for providers established, or having affiliated companies, outside the EEA (Google Cloud, Stripe, OpenAI where applicable), even where the processing is carried out in a European region;
- where the Customer or its users access the space from a third country or connect their own services to it.
These transfers are governed by an adequacy decision (including the EU–US Data Privacy Framework for certified entities) or by the European Commission's standard contractual clauses (Module 3, processor to processor), supplemented where necessary by additional measures. [TO BE COMPLETED: mechanism adopted and transfer impact assessment for each provider.] The up-to-date list is set out in Annex 2 of the DPA.
Customers established outside the European Union check the rules of their country (in particular CEMAC, WAEMU (UEMOA), Democratic Republic of the Congo) relating to data transfers and localisation. [TO BE COMPLETED: country-by-country analysis.]
6. Retention periods
Default values configured in the platform, to be validated; the Customer may delete items in its space at any time.
| Data | Default period | Mechanism |
|---|---|---|
| Space content (Customer data) | Term of the Contract, then [TO BE COMPLETED: return period] before deletion | Deletion upon closure of the space |
| Backups | 14 days (daily local copies); [TO BE COMPLETED: retention period of off-site copies] | Automatic rotation |
| Conversations with Bernard | 365 days | Automatic daily purge (configurable) |
| Conversation history in the browser | Last 40 messages, erased on logout | Browser local storage |
| Feedback on answers | 365 days | Automatic daily purge |
| Learning signals and memory | 365 days | Configurable |
| Validated knowledge and examples of the space | 730 days | Configurable |
| Samples of logs transmitted by monitoring | Last 50 submissions per space | Automatic replacement |
| Session tokens (renewal) | 14 rolling days, 30 days maximum | Automatic expiry |
| Metadata of calls to AI models (without content) | [TO BE COMPLETED: no automatic purge to date] | To be defined |
| Audit log | [TO BE COMPLETED: no automatic purge to date] | To be defined |
| Evidence of acceptance of contractual documents | Term of the Contract, then [TO BE COMPLETED: limitation period adopted] | Kept even after deletion of the account |
| Invoicing data | 10 years (accounting records) | Legal obligation |
7. Security
The measures are described in Annex 3 of the DPA: hosting in France, isolation of spaces, HTTPS, two-factor authentication, encryption of secrets at rest, role-based access control, audit log, backups and restoration procedure, request rate limiting.
Support access. To handle a support request, a TOONAH platform administrator may open a temporary session (30 minutes) in a space. Each access is logged (person intervening, date, space). [TO BE COMPLETED: conditions for the Customer's prior consent and information of Administrators.]
8. Data subject rights
- Space data (GRC content, user accounts, conversations): contact the organisation that gave you access; it is the controller. TOONAH helps it respond (Article 28 GDPR and DPA) and forwards to it without delay any request received directly.
- Data for which TOONAH is the controller: see the Privacy Policy; contact: [TO BE COMPLETED: data contact address].
- Learning: each user can, in "Bernard learns", view their preferences and erase their learning data.
9. Cookies and local storage
No cookies are set by the toonah.io website or by the platform, and no audience measurement or advertising trackers are used. The website and the platform use only the browser storage strictly necessary for the service requested, which is exempt from consent (Article 82 of the French Data Protection Act (loi Informatique et Libertés), CNIL guidelines):
| Surface | Item | Storage | Purpose | Duration |
|---|---|---|---|---|
| toonah.io | toonah_assistant_v1 | Tab session | Ongoing conversation with the public assistant | Closing the tab or "Clear the conversation" |
| app.toonah.io | toonah_token | Tab session | Authentication token | Closing the tab or logout |
| app.toonah.io | tnh_flash, tnh_cockpit_state, toonah_chart_tab | Tab session | Message after redirection, dashboard display state | Closing the tab |
| app.toonah.io | toonah_lang | Local | Interface language | Until changed |
| app.toonah.io | toonah_banner_dismissed | Local | Information banner hidden | 24 hours |
| app.toonah.io | bernard_chat_history_v1:… | Local | Last 40 messages with Bernard, specific to the user | Erased on logout |
| app.toonah.io | Module display preferences (filters, columns) | Local | Ease of use | Until changed |
Should an audience measurement tool or another tracker subject to consent be added, this policy would be updated and a consent mechanism put in place beforehand.
10. Changes
Any change gives rise to a new numbered version. A substantial change follows the procedure in Article 20 of the Contract (prior notice and new acceptance).