CONTENTS
1. Our commitment
Awoui is built around a simple principle: your data belongs to you. We sell no personal data, we do not profile for advertising purposes, and we apply the principle of minimization — we collect only what the services need in order to work. This policy explains, in accordance with the GDPR, which data is processed and how.
2. Data controller
The data controller is Antoine DRIGET, sole trader ("LeGuideInfo", SIREN 879 845 675), whose registered office is at 66 avenue des Champs-Élysées, 75008 Paris, France. For any question about your data: contact@awoui.com.
3. Data we process
- Account & identity (via id.awoui.com): email address, username, and the information you enter yourself.
- Your service content: files (Cloud), messages (Messaging), secrets (Vault), conversations with the AI assistant. This content stays under your control and, for the vault, is encrypted end to end.
- Technical data: connection and event logs, kept to the strict minimum required for security and correct operation.
4. Purposes & legal bases
- Providing and securing the services — performance of the contract and legitimate interest (security).
- Managing your account and single sign-on — performance of the contract.
- Informing you of significant changes to the service — legitimate interest.
5. Retention periods
Account data is kept for as long as the account is active, then deleted or anonymized after closure. Logs and connection data allowing identification are kept for 12 months, in accordance with French decree no. 2021-1362 of 20 October 2021 issued under article L. 34-1 of the French postal and electronic communications code.
6. Recipients & processors
Awoui is designed as a sovereign ecosystem: your data is neither sold nor passed to advertising networks. It never leaves the European continent: the European Union and Switzerland — a country recognised by the European Commission as providing an adequate level of protection. Each provider acts as a processor under a GDPR-compliant agreement. Here is who is involved, where, and what each of them sees.
- Mistral AI (France) — the AI assistant. Sees: your exchanges with the assistant, which are not used to train its models.
- OVH SAS (French company) — the French entry point, server located in Strasbourg, same role. Sees: traffic in transit and access logs (IP address, requested page, browser), kept 14 days. Nothing else is stored there.
- Proton AG (Switzerland) — e-mail. Sees: the e-mails you send us.
- Hetzner Online GmbH — the platform's cores (identity, spaces, services) and the Finnish entry point, same role as the other two entry points. Data centres in Helsinki (Finland), ISO/IEC 27001:2022 certified.
- CrowdSec SAS (France) — attack protection. Sees: only the IP addresses of detected attackers, shared as attack signals. Never those of ordinary visitors.
If you choose to sign in through a third-party identity provider (LinkedIn, Google, GitHub, Discord, Microsoft), that provider passes us your name and e-mail address; the choice is yours and can be changed.
7. Cookies
The site uses only strictly necessary cookies (session, authentication, preferences). No advertising cookie or third-party tracker is set, and no external audience measurement is used.
8. Security
Communications are encrypted in transit (TLS 1.3) and storage is encrypted at rest (AES-256). Access is protected by centralized authentication, and activity is logged to the strict minimum. We apply defence in depth, but since no system is infallible, we encourage you to protect your credentials and to enable two-factor authentication wherever it is offered.
Resilience and sovereignty. Since September 2026 there is no third-party content delivery network between you and our servers: two entry points that we operate ourselves — France (Strasbourg), Finland (Helsinki) — answer visitors in turn. They store nothing: your account data and spaces live in the cores only. Switzerland is a deliberate choice: a second jurisdiction, outside the European Union yet recognised as adequate, so that access to Awoui depends neither on a single country nor on a single operator. The name servers are run by a German non-profit association, and the zone is signed (DNSSEC).
9. Your rights
Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability regarding your data. To exercise them, write to contact@awoui.com. You may also lodge a complaint with the French data protection authority, the CNIL.
10. Changes & contact
This policy may change; the applicable version is the one published on this page. For any question about your data: contact@awoui.com.