Privacy policy

20 October 2026. English information for convenience; see the French version, including the French-only matching pilot.

Neatvaro is published by Cameron Lumpini Nge Ntika, sole trader, SIREN 107 805 954. The publisher controls account, security and matching data. Business details: legal notice. Privacy contact: contact@neatvaro.com.

Data and purposes

Accounts use email, contact name, business information, protected password and recovery-code hashes, verification and sessions to provide the requested service under the contract. Passwords and codes are not stored in plain text. Required fields are needed for registration; the demo remains available. Software data includes quotes, clients, sites, jobs, reports, photos, logos and consumer payment and mediation details. Businesses control their own clients’ data; Neatvaro processes it on their behalf under the data processing agreement. Businesses must inform clients and manage their own archives.

Matching requests include name, verified account email, city, service, title and description. Phone, exact address and preferred date are optional. Saving does not transmit a request: the customer separately authorises sharing with the chosen professional to provide the requested service. Other professionals cannot access the case. Public professional profiles include business name, SIREN, description, cities, services, availability and review date, with display permission withdrawable by withdrawing the profile. Reviewer identity and notes stay private. Review does not certify insurance or competence. Dated case history links transmission, handling, quote, job and report. Alert metadata tracks the intended recipient and sending status to avoid duplicates. The selected professional controls their own subsequent records and must have a lawful basis for unrelated reuse. Matching forms are not automatically sent to AI.

Sent quotes use recipient email, frozen document, logo, sending/opening dates and the client’s response. Messages and attachments pass through Brevo. One follow-up after three days is optional and stops after a response. Acceptance evidence includes name, time, document fingerprint and checked statements. New quotes support a simple electronic signature by typed name or static drawing. Its points and evidence fingerprint are stored with acceptance and included in the PDF. No drawing pressure or gesture timing is recorded; identity is not verified. IP and browser information are restricted to authorised people for contract evidence and disputes, never displayed in the public page or PDF. Evidence is deleted with the business account; the business must arrange necessary legal archives. Anyone possessing a valid public quote or report link can view that document. The matching-space report requires the customer’s or assigned professional’s login. Internal costs, margins and productivity rates are excluded from client documents.

Subscription status, dates and Stripe identifiers manage billing and access under the contract; accounting data follows legal obligations. Neatvaro does not receive full card numbers and does not collect cleaning-service payments in this pilot. Hashed email/IP counters prevent abuse (legitimate security interest). Support requests may remain with the account for resolution. Registration does not subscribe you to commercial prospecting.

Recipients and providers

Internal access is limited to authorised support, security and review roles as necessary. Neatvaro does not sell data or build advertising profiles.

Netlify: hosting, API, database and private files. Hosting is not guaranteed to be exclusively European. See its data processing agreement and subprocessors and trust centre.
Sendinblue SAS (Brevo): service emails and attachments, content and delivery metadata under its terms and data processing agreement. Tracking depends on provider configuration. API acceptance does not prove delivery.
Stripe Payments Europe, Limited and providers: subscriptions and invoices under its privacy information.
DeepSeek: optional AI as explained below.

Optional AI and transfers to China

The assistant sends your messages and relevant current-quote context to Neatvaro’s server and DeepSeek. The feedback helper also uses DeepSeek for questions or summaries. Its privacy policy describes processing and storage in China. Neatvaro not storing a server-side conversation does not mean the provider keeps no copies.

Masking replaces recognisable emails, phone numbers, IBANs and SIREN/SIRET numbers. It does not reliably remove names, postal addresses or every personal or confidential detail. This is partial pseudonymisation, not guaranteed anonymity. Use fictional names and technical descriptions without client contact details, health information or access codes. Detailed mode works without AI.

China has no EU adequacy decision. A warning and partial masking alone do not establish lawful transfer safeguards. API contractual safeguards must be checked before processing personal data through it. Neatvaro does not describe this AI as EU-hosted or risk-free. Contact us for available transfer information.

Retention

Account and software: during service provision, then deletion from the active database on account deletion. Professionals must export records they need to retain. Their own archives and Neatvaro invoices follow separate obligations.
Matching cases and history: up to 24 months after the last case action, with daily cleanup when the scheduled task runs; earlier deletion with the customer’s account. Independent professional quotes and reports are preserved.
Session validity: seven days; email confirmation: 48 hours; password reset: one hour. Expired tokens no longer grant access. Temporary security counters are renewed through use.
Report links: up to 30 days, revocable. Quote links: stated validity date or 30 days by default. Acceptance records remain with the business account until deletion, separately from link expiry.
Founders offer: protected email and business-identity fingerprints for 180 days to prevent repeat claims; these remain personal data while a link is possible. Aggregate counters may remain without those fingerprints.
Neatvaro invoices: ten years. Providers apply their own log and backup cycles; active-database deletion does not mean immediate erasure of all backups.

Your rights

You may request access, correction, deletion, restriction and, where applicable, portability or objection. Withdrawal of display permission does not affect earlier lawful use. Write to contact@neatvaro.com. Proportionate identity verification may be needed in case of doubt. We normally respond within one month, explaining any legally justified extension. Data necessary for a legal obligation or an identified legal claim may be retained.

My business provides software export and deletion. “Exporter mes données” in the matching space downloads accessible cases and your profile; customers can delete their account. Contact the professional for independent records; Neatvaro can direct you. You may complain to the CNIL. Matching does not automatically make a legal decision about you: professional choice and quote acceptance remain human.

Security and browser storage

The service uses HTTPS, protected passwords, random sessions, account access checks and private files. Breaches are evaluated and notified when legally required. No system offers absolute security.

The login cookie is necessary (HttpOnly, Secure on HTTPS, SameSite, seven-day validity). Drafts, assistant history, settings and guest data may remain in browser local storage; the application also caches static files. Sign out and clear local data on shared devices. The host may use technical security cookies. The current code includes no external audience measurement or advertising; future nonessential tools would need separate information and consent where applicable.

Usage measurement

Optional counts of demo openings, calculator use and quote starts are disabled until you opt in using the footer control. No client details, IP address or visitor identifier are stored in these counts. The preference lasts six months. Separate operational milestones count successful account creation and the first saved quote, deduplicated per account; internal tests are classified separately. Milestones are removed when the account is deleted. Anonymous daily counts older than 90 days are purged when further actions are counted.

Case messages are visible to the customer and the chosen business. Issue reports and responses are also available to authorised reviewers handling them. They do not trigger automatic arbitration or refunds. Do not include sensitive information or access codes. These records follow case retention (24 months after last activity) and are included in its export. Messages from an assignment are erased when the business declines before taking the job, so another business cannot inherit them. Account deletion erases exchanges for the affected cases from the active database. Profile and support decisions are logged for authorised reviewers only.