Privacy policy
Last updated : 11 November 2026
Data controller
Adrià Lechantre Prats (Resgarda), Avenida Meridiana 336, 4A, 08027 Barcelona (Spain), reachable at contact@resgarda.com. No data protection officer has been appointed. [To be validated by a lawyer.]
Data processed
- Account: name, email address, role, language and notification preferences.
- Location: trading name, company name, registration number, address, activity, insurance details.
- Evidence: uploaded files (photos, invoices, Z reports, contracts…), their fingerprints, dates and, if you agree, the location of photos. These files may contain data about third parties (suppliers, employees).
- Payments: handled by Stripe; Resgarda does not store your card numbers.
- Technical and audit logs: actions performed, dates, IP addresses.
Purposes and legal bases
- Providing the service (keeping evidence, generating files, reminders): performance of the contract.
- Invoicing and accounting: legal obligation.
- Security, abuse prevention, audit log: legitimate interest.
- Service emails: performance of the contract; any marketing email requires your consent.
Your data is never sold, rented or used for any purpose other than your own service.
Automatic reading by AI
To read your invoices and Z reports, only the relevant document is sent to our AI provider, Anthropic, with no other data from your account. [Check and cite the provider's contractual commitments: no training on data, retention period.]
Sub-processors
| Provider | Role | Data location | Safeguards |
|---|---|---|---|
| Supabase | Database, files, authentication | European Union (Frankfurt or Paris) | Data processing agreement (DPA) [to be signed] |
| Vercel | Application hosting | European Union (Paris region); company based in the US | DPA and transfer safeguards [to be checked] |
| Stripe | Payments and invoicing | Ireland, United States | DPA and transfer safeguards [to be checked] |
| Resend | Sending emails and receiving invoices forwarded by email | Ireland (EU) | DPA [to be checked] |
| Anthropic | Automatic document reading (AI) | United States | DPA, transfer safeguards and no training on your data [to be checked] |
Where data is transferred outside the European Union, the transfer is covered by [European Commission standard contractual clauses or certification under the EU–US Data Privacy Framework — to be checked for each provider].
Retention periods
- Account data and evidence: for the duration of the subscription, then 30 days after account deletion (grace period).
- Invoices issued by Resgarda: legal retention period applicable in Spain. [To be validated by a professional.]
- Technical logs: 90 days at most. Audience measurement: anonymous daily counters, with no IP address; the technical fingerprint used to count distinct visitors is erased after 2 days.
Security
Data hosted in the European Union, encrypted in transit and at rest; private files, reachable only through temporary links; strict separation between accounts; tamper-proof audit log; automatic backups.
Your rights
You have the right of access, rectification, erasure, restriction, objection and portability. A full export of your data is available at any time from your space. To exercise your rights: contact@resgarda.com.
You can lodge a complaint with your data protection authority (in France, the CNIL; in Spain, the AEPD).