This text is a working draft. Some details are still to be filled in, and the whole document must be reviewed by a qualified lawyer before it carries any weight. It is not a contractual commitment as it stands.
Privacy Policy
01Important notice
This document is a working draft intended as a structural template. It must be reviewed and validated by a qualified legal professional before it is made publicly available. No legal advice is provided herein.
02Data controller and processor roles
RingSync acts as a data controller for personal data relating to back-office administrator accounts (name, email address, billing information, usage logs).
RingSync acts as a data processor on behalf of its customers (the controllers) for data flowing through the directory synchronisation service. Crucially, RingSync does not store directory contacts on its servers. Contact records (names, email addresses, phone numbers, job titles) exist only in the customer's directory provider (Microsoft Entra ID or Google Workspace) and on employees' devices after synchronisation. RingSync's servers only handle synchronisation metadata in transit.
The customer organisation is the data controller for all personal data present in its directory and for its employees' devices.
03Categories of personal data processed
Administrator account data: email address, display name, hashed password or OAuth identity, organisation membership, role (owner / admin / member), invitation history, billing contact details.
Mobile user data: Microsoft account email address and display name (obtained via OAuth), push notification token (iOS or Android), tenant access list, last sync timestamp. No passwords are stored — authentication is delegated entirely to Microsoft.
Synchronisation metadata: sync job records (start time, end time, status, counts of contacts added / updated / removed), sync logs per contact (Entra Object ID, action, reason, timestamp). No contact field values (names, phone numbers, email addresses) are stored in these logs.
Billing and payment data: billing contact information (company name, address, VAT number) stored on the Stripe customer object and reflected locally. Payment method details are held exclusively by Stripe and are never stored by RingSync.
Technical and security data: server-access logs, error logs, IP addresses for rate limiting and fraud prevention.
What RingSync does NOT store: the content of directory contacts (names, phone numbers, email addresses, photos, job titles). These data points pass through our proxy in transit and are written directly to the employee's device. They are never persisted in the RingSync database.
04Purposes and legal bases
Service delivery (contract performance, Art. 6(1)(b) GDPR): creating and managing administrator accounts; operating the directory synchronisation proxy; managing tenant configuration and access grants; delivering push notifications for wipe commands.
Billing and payment management (contract performance, Art. 6(1)(b) GDPR): processing subscription payments via Stripe, issuing invoices, managing trial periods and suspensions.
Security and fraud prevention (legitimate interest, Art. 6(1)(f) GDPR): server-access logging, rate limiting, abuse detection, encrypted storage of OAuth tokens in Vault.
Legal obligations (Art. 6(1)(c) GDPR): retaining accounting records for the legally required period {{À VALIDER : 10 ans en droit français}}; responding to valid law-enforcement requests.
For processing carried out as a data processor on behalf of customers: the legal basis is the performance of the Data Processing Agreement (DPA) concluded with the customer, acting on the customer's documented instructions.
05No server-side contact storage — key product principle
The core architectural commitment of RingSync is that directory contact records are never stored on RingSync servers.
During a synchronisation, RingSync's proxy reads user records from Microsoft Graph (or Google Directory API) using application-level credentials, and streams each page of results directly to the requesting mobile device. Individual contact field values (given name, surname, email, phone, job title, photo) are held in memory only for the duration of the proxied API call and are never written to any database, log file, cache, or message queue operated by RingSync.
The only data retained by RingSync in relation to a synchronisation event are: the sync job record (counts, status, timestamps) and per-contact action logs identifying the contact solely by its Entra Object ID (an internal Microsoft identifier containing no personal data visible to end users).
This architecture means that a data erasure request targeting contact records must be directed to the directory provider (Microsoft Entra ID or Google Workspace) and/or to the employee's device — RingSync has no copy to delete.
06Data retention
Administrator account data: retained for the duration of the subscription. Deleted with the account, or with the organisation when the administrator belongs to no other organisation.
Data about employees holding a seat (email address and name from the directory, mobile app account): retained while the person holds at least one seat. 90 days after they leave the directory, their seat, address, name and sync history are deleted, then their mobile account once they have neither a seat nor a device left.
Devices (installation identifier, notification token): deleted after 90 days without use.
Sync logs: retained for 30 days from creation, then deleted automatically. Sync job records (timestamp, counters, status) are kept 12 months as the directory's history.
Incremental sync cursors (delta links) stay on the device and are not kept by RingSync.
Record of RingSync support interventions: retained; the staff member's IP address and browser are erased after 6 months.
Proof of an organisation's deletion: retained; its administrators' email addresses are erased from it after 12 months.
Internal technical logs (scheduled task runs, payment events received): 90 days.
Organisation data on trial expiry without payment: suspended at day 14; permanently deleted at day 44 (30 days after suspension).
Organisation data on non-payment of invoice: suspended at day 30 after invoice issuance; permanently deleted at day 120 (90 days after suspension).
Billing records: retained for {{À VALIDER : durée légale de conservation des pièces comptables — 10 ans en droit français}} from the date of the invoice.
Server access and error logs: retained for {{À VALIDER : durée}} then deleted.
07Sub-processors and data recipients
RingSync uses the following sub-processors. The complete and up-to-date list is available on request via the privacy contact channel at /contact.
- Supabase ({{À VALIDER : entité légale, adresse}}) — database and authentication infrastructure. Data hosted in the EU ({{À VALIDER : région spécifique}}).
- Stripe, Inc. — payment processing and invoicing. Data transfers to the US are covered by {{À VALIDER : SCCs ou autre mécanisme de transfert}}.
- Microsoft Corporation — directory data source (Microsoft Graph API, Entra ID). RingSync reads data from Microsoft as an authorised application; no personal data is sent to Microsoft by RingSync beyond what is required for the OAuth authentication flow.
- {{À VALIDER : hébergeur infrastructure / CDN / email transactionnel / monitoring}}.
RingSync does not sell personal data to third parties. RingSync does not use personal data for advertising purposes.
08International transfers
RingSync's primary infrastructure is hosted in the European Union. Where personal data is transferred to a sub-processor outside the EU/EEA (currently Stripe in the US), the transfer is based on {{À VALIDER : mécanisme — Clauses contractuelles types (SCCs) de la Commission européenne, décision d'adéquation, ou autre}}.
A list of applicable transfer mechanisms is available on request.
09Security measures
OAuth tokens (Microsoft application credentials) are encrypted at rest using Supabase Vault (AES-256). They are decrypted in memory only during the synchronisation proxy call and are never logged.
All communications between the mobile application, the back office, and RingSync servers use TLS 1.2 or higher.
Mobile session JWTs are signed with HS256 and stored in the device's secure enclave (iOS Keychain / Android Keystore via Expo SecureStore).
Access to production databases is restricted to service-role credentials used exclusively by API routes; no direct database access is exposed to client-side code.
{{À VALIDER : certifications de sécurité — SOC 2 Type II en cours}}.
10Your rights under GDPR
If you are located in the European Union or European Economic Area, you have the following rights regarding your personal data: right of access (Art. 15), right to rectification (Art. 16), right to erasure (Art. 17), right to restriction of processing (Art. 18), right to data portability (Art. 20), right to object (Art. 21), and rights related to automated decision-making (Art. 22).
To exercise any of these rights, please use the Privacy & data requests channel at /contact. We will respond within 30 days. We may ask you to verify your identity before processing the request.
If you believe that RingSync has processed your personal data unlawfully, you have the right to lodge a complaint with the supervisory authority in your country of residence. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.
Note on contact data: as described above, RingSync does not store the content of directory contacts. Erasure requests for contact data must be submitted to your organisation's directory administrator (Microsoft Entra ID or Google Workspace) and to the employee device holder.
11Data protection officer
{{À VALIDER : RingSync a-t-il l'obligation de désigner un DPO ? (Art. 37 RGPD — traitement à grande échelle de données sensibles ou activité principale impliquant un suivi régulier et systématique)}}.
Data protection enquiries may be directed to /contact using the Privacy & data requests subject.
DPO contact: {{À VALIDER : nom, fonction, adresse postale ou renvoi vers /contact}}.
13Changes to this policy
RingSync may update this Privacy Policy from time to time. The updated date at the top of this page reflects the most recent revision. Material changes will be communicated to administrator account holders by email at least 30 days before they take effect.