Privacy Policy

1. Data controller

DyaPi is operated by AYTECHNET, a French SARL, registered office Le Cayla, 15600 Leynhac (France), RCS Aurillac 502 088 792, VAT FR45502088792. Contact: contact@aytechnet.fr. Aytechnet has not appointed a DPO, as the nature and scale of its processing do not make it mandatory (Art. 37 GDPR).

2. Two distinct roles

• For your account and usage data, Aytechnet is the controller (this policy applies).
• For the business data you route through DyaPi (orders, invoices, third parties), Aytechnet is a processor on your behalf (Art. 28 GDPR), governed by the Data Processing Agreement (DPA — Schedule B of the Terms).

3. Data we process (as controller)

• Account: name, email, password (hashed), or identity provided by Google / GitHub (OAuth).
• Sign-in and usage: session identifiers, technical logs, IP address, service consumption.
• Newsletter (if you subscribe): email, language, chosen topics and proof of consent.
• E-invoicing (on behalf of your company, see the DPA): references and dates of your invoices, identity and SIREN of your customers and suppliers, statuses, fingerprints of the transmitted documents — the audit journal.
• Aytechnet does not store card data (payments handled by a specialised provider, e.g. Stripe).

4. Purposes and legal bases

• Create and manage your account, provide the service — performance of the contract.
• Security, abuse prevention, improvement — legitimate interest.
• Billing, accounting, e-invoicing — legal obligation.
• Newsletter, non-essential cookies — consent.

5. Recipients and sub-processors

Aytechnet may use sub-processors for hosting, payment (e.g. Stripe), e-invoice transmission (PDP — SuperPDP) and authentication (Google, GitHub). They access data only for the relevant purpose.

6. Transfers outside the EEA

Where a sub-processor is located outside the European Economic Area, Aytechnet ensures appropriate safeguards: adequacy decision, EU-US Data Privacy Framework, or standard contractual clauses (Art. 46 ff. GDPR).

7. Retention

• Account: for the duration of the relationship, then deletion or anonymisation.
• Aytechnet's accounting records: 10 years (French Commercial Code).
• E-invoices you route: DyaPi acts as a dematerialisation operator in pass-through mode; the official original is kept by the accredited platform (SuperPDP) DyaPi connects you to, under that platform's own obligations. DyaPi does not durably store your invoices; a 10-year probative archival may be offered as an option.
• E-invoicing audit journal and index of issued and received invoices: for the duration of the relationship, returnable on exit, then deleted.
• Sign-in logs: limited, proportionate to security.
• Newsletter: until you unsubscribe.

8. Your rights

You have rights of access, rectification, erasure, objection, restriction and portability, and to withdraw consent. To exercise them: contact@aytechnet.fr. You may lodge a complaint with the CNIL (www.cnil.fr). For data processed on a Client's behalf (DPA), requests should be addressed to the Client as controller; Aytechnet assists (Schedule B of the Terms).

9. Cookies and audience measurement

No cookie is set when you merely browse the site. A strictly necessary session cookie is set only when you sign in to your account. Any non-essential cookie would require your prior consent. Audience measurement is performed without any cookie or tracker: the server and a technical call from the site's script count aggregated, anonymous statistics (page views, unique visitors derived from a non-reversible daily technical fingerprint discarded every day, share of human visits), with no persistent identifier — a mechanism exempt from consent under the CNIL guidelines. Public forms are protected against robots by a technical token and a check of the email address domain, with no third-party service.

10. Changes

Aytechnet may update this policy; the applicable version is the one published at the date of your visit.