Privacy policy

This policy explains how UltiSuite processes personal data in connection with its services.

UltiSuite is created by Eliott Guillaumin. Copyright Eliott Guillaumin. All rights reserved.

Depending on context, the data controller may be Eliott Guillaumin or the organization that provides UltiSuite to its users. Your organization administrator can clarify this point.

UltiSuite may process account, authentication, preference, email, file, document, event, meeting, contact, administration, AI prompt and technical log data.

Data processed depends on tools used, enabled settings and content voluntarily provided by the user or organization.

UltiSuite does not request more data than necessary for operation, security, administration and reasonable service improvement.

Data is used to provide UltiSuite tools, authenticate users, synchronize content, personalize the experience, secure access, prevent abuse and diagnose incidents.

It may also be used to apply organization policies, maintain audit logs, ensure service continuity and meet legal obligations.

User content is not sold, rented or used for targeted advertising.

UltiSuite is deployed on the organization's infrastructure or that of its host (OVH by default). Suite software components (Authentik, Nextcloud, database, storage, etc.) run on this dedicated infrastructure.

These components are not external subprocessors: they are part of the UltiSuite deployment under the control of the instance operator.

Only third-party services actually configured and enabled on the instance may receive data outside this perimeter. They are listed dynamically below and on the dedicated page.

Depending on the case, processing relies on performance of the requested service, legitimate interest in security and administration, compliance with legal obligations or consent where required.

For accounts provided by an organization, some processing may depend on that organization's own instructions and obligations.

Users may contact the publisher or their administrator to learn the applicable basis for a specific processing activity.

Account and content data are retained as long as the account, workspace or organization maintains them, unless deletion is requested or law requires otherwise.

Technical and security logs are retained for a period proportionate to diagnostic, security, audit and compliance needs.

When an account is deleted, some data may temporarily remain in backups or strictly necessary logs before purge according to applicable technical cycles.

UltiSuite applies technical and organizational measures intended to protect access, limit incidents and reduce the risk of loss, alteration or unauthorized viewing.

However, no method of transmission or storage can be guaranteed as absolutely secure.

The user must keep credentials confidential, enable available protections and report any suspicious access.

Under applicable law, you may request access, rectification, erasure, restriction, objection, portability or withdrawal of consent where processing is based on it.

Some requests may be handled by your organization administrator when your account depends on it.

A request may be refused or limited when a legal obligation, third-party right, security need or need to prove an incident requires retaining certain information.

UltiSuite uses strictly necessary technical cookies: OIDC session (httpOnly), temporary OAuth PKCE tokens, and possibly sidebar state (`sidebar_state`).

Preferences, drafts and local state may be stored in localStorage or IndexedDB (cache, offline queue, encrypted zero-trust keys).

Usage statistics may be measured via self-hosted Matomo in cookieless mode, without a consent banner when this configuration is active.

These mechanisms are not used to sell data or for advertising targeting.

In addition to technical cookies, the client may locally store blocked or trusted addresses, scheduled sends/snoozes, contacts deleted to trash, calendar or video keys, and an API query cache.

You can clear this data from your account privacy settings or by clearing browser storage.

Blocking certain technical storage may degrade or prevent normal service operation.

By default, UltiSuite aims for processing on infrastructure configured by the instance operator.

Enabling external integrations (AI providers, OAuth, payments, etc.) may result in transfers to those providers, listed on the subprocessors page.

The responsible organization must inform its users and, where applicable, implement appropriate safeguards.

For any question or request about personal data, contact the publisher or your UltiSuite organization administrator.

For organization-managed accounts, the administrator may be the primary contact for exercising your rights.