Privacy Policy

1. What We Collect

Rochemère only holds the data you and your organization put into it, plus the minimum needed to run and support the product:

• Account data: your name, email address, profile photo, and, if you sign in with Google, the basic profile Google returns. Passwords are hashed by our authentication provider and are never visible to us.
• Business data: everything you record in the product: organizations, projects, budgets, DQE line items, situations de travaux, cost entries, purchase orders, subcontracts, clients, suppliers, team members and their roles, conversations, and activity history.
• Files: documents, photos, and voice messages you upload. Voice messages are sent to a speech-to-text provider to produce a transcript.
• Technical data: pages visited, features used, browser and device type, and error reports including a stack trace and the URL where the error happened. This is collected in production only, never in development.

2. Why We Use It

We use that data to run the service and nothing else:

• To provide the product: display your projects, compute budgets and costs, enforce role permissions, and apply your plan's organization, project, and member limits.
• To transcribe the voice messages you choose to record, so your team can read and search them.
• To keep the service working: detect and fix errors, prevent abuse, and understand which features are used so we can improve them.
• To contact you about your account, billing, and material changes to the service.

We do not sell your data, we do not share it with advertisers, and we do not use your projects, costs, or documents to train AI models.

3. How Long We Keep It, and Your Rights

We keep your organization's data for as long as the account is active, because that history is the product: a cost entry from two years ago still has to reconcile against today's budget. If you close your account, we delete or anonymize your data within 90 days, except where Algerian accounting or tax rules require us to keep invoicing records longer.

You can view and correct most of your data directly in the app. To export everything, request deletion, or object to how we process it, write to contact@rochemere.co and we will respond within 30 days. If you are in the European Union, the GDPR rights of access, rectification, erasure, restriction, and portability apply to you.

4. Cookies, Security, and Changes

We set a small number of cookies: a required session cookie so you stay signed in, a cookie remembering your language, and, in production only, analytics cookies from PostHog and Google Analytics. Blocking the session cookie will stop you from signing in.

All traffic is encrypted in transit, access to an organization's data is restricted at the database level to that organization's members, and file links are short-lived signed URLs. No system is perfectly secure, so please use a strong, unique password. If we change this policy in a way that matters, we will update the date above and notify account owners by email.