General Terms of Use and Sale, and Personal Data Protection

Version of 10 October 2026. These terms apply to anyone who creates a Prophetix account, takes out a subscription or uses an application in the catalogue.

1. Official language and scope

These terms are published in French, English, German, Italian and Spanish. French is the official language: only the French version is authoritative. The other versions are translations provided for ease of reading; in the event of any difference or doubt, the French text prevails.

The chapters on personal data protection (section 13) and the data processing agreement (section 14) form part of the general terms. For any question about these texts, write to dpo@prophetix.com.

2. Publisher and contact

The service is published and operated by Prophetix, whose identity, hosting provider and contact details are set out below.

Data protection (DPO)

dpo@prophetix.com

3. The service

Prophetix offers, by subscription, a single account that opens a catalogue of applications: web applications used in the browser, applications to be installed on Windows or Linux, and Android applications. The account, organisations, seats, plans and access rights are managed by the account platform (account.prophetix.com).

The catalogue changes over time: applications are added, modified or withdrawn. Each application is presented on the showcase site (apps.prophetix.com) with its status (available or in preparation), its features, its known limitations and, where one exists, its version for your system.

4. Account and access

To create an account, you provide a valid email address, a name and a password, and you accept these terms. You warrant that this information is accurate and you keep it up to date.

Your credentials are personal. You do not share them; each person who uses the service has their own access. The number of sessions open at the same time is limited. You may enable two-factor authentication, and you are responsible for the security of your devices and credentials.

An organisation (company, family, group) has a manager. The manager invites members, assigns seats, chooses the authorised applications and may withdraw access at any time. An invitation is accepted with a confirmed email address.

5. Subscription, prices and payment

The subscription is monthly and carries no minimum term. The price is the one displayed in the portal at the time of subscription, per seat and per month; it may change for the future, with prior notice before the renewal concerned.

Payment is made online through the payment service provider Stripe. Prophetix does not retain bank card numbers.

You may cancel at any time from the portal. Cancellation takes effect at the end of the period already paid, during which access is maintained. Sums paid for a period already begun are not refunded, except where required by law.

If you act as a consumer, you have the right of withdrawal provided for by law. Where the digital service is made available to you at your request before the end of the withdrawal period, the law provides that you pay for the part of the service already supplied or, depending on the case, that you waive that right; the details are reiterated to you when you subscribe.

6. The applications

Each showcase page states the status of the application. An application "in preparation" is not yet open to everyone; it is announced with its target date. The pages also state what has not yet been done or has not been proven in real-world conditions: these limitations form part of the description of the service.

Prophetix does not claim that any application complies with any law, standard or regulation (accounting, tax, payroll, employment law, data protection, etc.). The document templates and rule sets provided are aids: they must be reviewed and validated by your own advisers before use.

7. Use of the service and obligations

You use the service in accordance with the law and these terms. In particular, it is prohibited: to store or distribute unlawful content in it; to attempt to access the data of another organisation; to disrupt the service or circumvent its limits; to resell or share an individual access.

You are responsible for the content you enter and, where you enter data concerning other persons (employees, tenants, customers, children, contacts, etc.), for its lawfulness, its accuracy and for informing those persons (see section 13).

Prophetix may suspend access in the event of a serious breach or a security incident, after notice where possible.

8. Ownership and customer data

Prophetix retains all rights in the service, the applications, the texts and the trademarks. You have a personal, non-exclusive and non-transferable right of use for the duration of your subscription.

The data you enter belongs to your organisation, not to the person who leaves the organisation. Prophetix uses it only to provide the service and in accordance with your instructions (see sections 13 and 14). Prophetix does not use its customers' data to train artificial intelligence models.

9. Availability, support and liability

Prophetix uses reasonable endeavours to ensure the availability and security of the service, but does not guarantee uninterrupted or error-free operation. Technical backups are made; they do not replace your own exports, which the applications allow where they offer that function.

To the extent permitted by law, Prophetix's liability is limited to direct and foreseeable damage, and does not exceed the sums paid in respect of the twelve months preceding the event giving rise to liability. It is not excluded in the event of gross negligence or wilful misconduct, of personal injury, or for anything that the law does not permit to be excluded, in particular as regards consumers.

10. End of the contract, return and deletion of data

At the end of the subscription or on the closure of an organisation:

• access to the applications is cut off; the organisation's data is kept for a return period of 30 days, during which the organisation's manager may request its export by writing to dpo@prophetix.com;
• Prophetix deletes the organisation's data, including attachments, no later than 90 days after closure;
• deleted data also disappears from the technical backups when their retention period expires, at most 30 days;
• billing data (invoices, billing identity) is kept for 10 years, as required by accounting law; the other personal data of the account is erased or anonymised.

You may also delete your personal account from your space, provided you are not the sole manager of an active organisation.

11. Changes to the terms

Prophetix may amend these terms, in particular to reflect a change in the service or in the law. The applicable version is the one published on this page, with its date. Significant changes are notified to you by email or in the portal before they take effect; if you refuse them, you may cancel.

12. Governing law, language and competent court

These terms are governed by French law. They are drafted in French, which is the official language of the contract and of all contractual communications.

Failing an amicable settlement, any dispute relating to their formation, interpretation or performance falls within the jurisdiction of the court of Metz (France). This clause does not deprive consumers of the mandatory jurisdiction rules applicable to them, nor of the possibility of having recourse to consumer mediation where the publisher designates a mediator (see section 2).

13. Personal data protection (GDPR)

This part describes how Prophetix processes personal data, in accordance with Regulation (EU) 2016/679 (GDPR). It is supplemented by section 14, which is the data processing agreement.

13.1 Who is responsible for what

Prophetix acts in two different capacities:

• as data controller for the data it uses for its own purposes: your account, billing, platform security, platform logs and the showcase site;
• as data processor for the data that your organisation enters in the applications (contacts, tenants, employees, documents, messages, etc.): the customer organisation is then the data controller and determines the purposes; Prophetix processes this data on its instructions (section 14).

13.2 Data protection contact (DPO)

For any question or request relating to personal data, write to the data protection contact (DPO): dpo@prophetix.com.

13.3 Data for which Prophetix is the data controller

• Account and authentication: name, email address, password (stored only in hashed form), two-factor authentication, sessions, membership of organisations and roles, acceptance of the terms. Basis: performance of the contract.
• Devices and licences: workstation name, system, technical fingerprint of the workstation and IP address upon activation of an installed application. Basis: performance of the contract and the legitimate interest in protecting the service against abuse.
• Platform usage log: login and usage events, IP address and country. Basis: legitimate interest (security, detection of abuse, evidence).
• Billing and payment: billing identity, subscription, invoices; payment data is processed by Stripe. Basis: performance of the contract and the legal obligation to retain accounting records.
• Service emails: address confirmation, invitation, password reset, notices relating to your subscription. Basis: performance of the contract.
• Showcase site (apps.prophetix.com): no trackers and no third-party resources, only technical cookies (protection against request forgery, load balancing between servers); the server's technical logs may contain visitors' IP addresses.

This data is provided by you or generated by your use of the service. It is necessary for the provision of the service; without it, the account cannot be created.

13.4 Data processed on behalf of the organisation

The data that your organisation enters in the web applications, or synchronises from an installed application to Prophetix's servers, is processed by Prophetix as data processor. It is partitioned by organisation: a user can access only the data of their organisation and according to their role. The organisation is responsible for the lawfulness of this data, for informing the data subjects and for responding to their requests; Prophetix assists it in doing so (section 14).

Some applications process data that requires particular attention (for example employee or health data, recordings of meetings or calls, the monitoring of workstations or of children). Before using them, the organisation checks its legal basis and carries out, where the law requires it, an impact assessment. Applications that run solely on your device do not transmit their data to Prophetix; their page states this.

13.5 Sub-processors and recipients

Prophetix does not sell personal data. It uses service providers, which receive data to the extent necessary for their task:

• the server hosting provider, identified in section 2;
• Stripe, for payment of subscriptions;
• OVHcloud, for sending service emails;
• Google (Firebase Cloud Messaging) and Apple (push notifications), only where the operator enables login approval notifications on a phone;
• providers of artificial intelligence, text recognition or translation, only where you or your organisation enable the function concerned and provide, where applicable, your own key: for example Mistral, Anthropic, OpenAI, Microsoft Azure for image recognition, or the online translation services MyMemory and LibreTranslate. The page of each application concerned states this, and the application warns you before sending where this is provided for.

Where an artificial intelligence assistant is connected to an application through the MCP protocol, it receives the responses of the tools that the person authorises it to use, with that person's rights. The organisation's manager may prohibit this use in the portal.

The up-to-date list of sub-processors is the one in this section. Organisation owners are informed by email at least 30 days before the addition of a new sub-processor that would process their data.

13.6 Transfers outside the European Union

Prophetix hosts its servers with the hosting provider and in the country stated in section 2. Some of the providers listed in section 13.5 (payment, notifications, artificial intelligence, translation) may process data outside the European Union. Such a transfer takes place only within the framework provided for by Chapter V of the GDPR: adequacy decision, standard contractual clauses or other appropriate safeguard. For the functions that you enable yourself, you choose the provider.

13.7 Retention periods

• Account: for the duration of the subscription, then until it is deleted; an account that has never been confirmed is deleted after 30 days.
• Invitations: deleted 30 days after their expiry or refusal.
• Deactivated devices and activations: deleted 365 days after their last activity.
• Abuse signals: 365 days.
• Platform usage log (IP address, country): 730 days.
• Billing: 10 years, as required by accounting law.
• Data of an organisation that cancels: return period of 30 days, then deletion at the latest 90 days after closure (section 10).
• Technical backups: at most 30 days.
• The retention periods for data entered in the applications are set by the organisation acting as data controller; the applications offer purges and retention periods where their page so states.

13.8 Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent where processing is based on it, and, where the applicable law so provides, to set directives concerning the fate of your data after your death.

• For data for which Prophetix is responsible (section 13.3): exercise your rights from your personal space (download of your data, deletion of your account) or by writing to dpo@prophetix.com. A response is given to you within one month, which may be extended in the cases provided for by law. Supporting documentation may be requested if there is doubt about your identity.
• For data entered by an organisation (section 13.4): contact the organisation first, which is the data controller. If you write to Prophetix, your request is forwarded to the organisation and Prophetix assists it in responding.
• You may lodge a complaint with the data protection supervisory authority of your country; in France, the CNIL.

13.9 Security

Prophetix implements appropriate technical and organisational measures: communications with the services are encrypted (HTTPS); passwords are stored in hashed form using a proven algorithm; authentication secrets are encrypted; two-factor authentication is available; access to data is partitioned by organisation and by role; administrative access is restricted. No measure guarantees absolute security: if you have any doubt about an access, change your password and write to dpo@prophetix.com.

13.10 Cookies and trackers

The showcase site places no trackers: only technical cookies may be placed on it (protection against request forgery, load balancing between servers). The portal and the web applications place only strictly necessary technical cookies (maintaining the session, protection against request forgery, load balancing between servers), which do not require consent. Prophetix uses neither advertising nor audience measurement by third parties.

13.11 Personal data breach

In the event of a personal data breach, Prophetix informs the organisation concerned without undue delay after becoming aware of it where it acts as data processor, and notifies the supervisory authority and the data subjects concerned under the conditions provided for by law where it acts as data controller.

13.12 Minors

Accounts are intended for adults. Where an adult enters data concerning children (for example in a family application), that adult is the data controller for it and acts in the best interests of the child.

13.13 Changes to this part

This part may change, in particular when an application or a sub-processor is added. The date of the version appears at the top of the document; significant changes are notified as set out in section 11.

14. Annex — Data Processing Agreement (Article 28 GDPR)

This agreement applies where Prophetix processes personal data on behalf of a customer organisation (the data controller); it forms part of the general terms and takes effect on the creation of the organisation.

• Subject matter and nature: to host and process the data that the data controller enters in the applications or synchronises to Prophetix's servers, to enable it to use the service.
• Duration: that of the subscription, then the return and deletion period of section 10.
• Purposes: solely the provision of the service to the data controller.
• Categories of data subjects and of data: determined by the data controller according to the applications it uses (for example employees, customers, contacts, tenants, family members; identity, contact details, professional data, documents, messages); the data controller enters special categories of data only in the applications and under the conditions where the law permits it.
• Instructions: Prophetix processes the data only on the documented instructions of the data controller, which result from these terms and from the use of the functions of the service; it informs the data controller if it considers that an instruction infringes the regulations.
• Confidentiality: the persons authorised to process the data are bound by confidentiality.
• Security: the measures in section 13.9; Prophetix adapts them to the state of the art and to the risks.
• Sub-processors: the data controller gives a general authorisation for those in section 13.5. Prophetix imposes the same data protection obligations on them; it informs the organisation owners at least 30 days before any addition or replacement; the latter may object on reasonable grounds, by cancelling without penalty.
• Assistance: Prophetix assists the data controller in responding to requests from data subjects (access, rectification, erasure, portability, objection) through the functions of the applications and on written request to dpo@prophetix.com, as well as with regard to security, personal data breaches and impact assessments.
• Breach: Prophetix notifies the data controller of any personal data breach without undue delay after becoming aware of it, with the information available to it.
• End of the contract: return then deletion in accordance with section 10, unless there is a legal obligation to retain.
• Audit: Prophetix makes available the information necessary to demonstrate compliance with Article 28 and allows reasonable audits, on written request and 30 days' notice, once a year unless there is an incident, at the data controller's expense, without access to other customers' data.
• Transfers: see section 13.6.