Privacy policy
Diamontis Informatique, the publisher of Diamontis FX, pays close attention to protecting your personal data. This policy explains what data we process, why, for how long, and what your rights are.
Data controller
Diamontis Informatique acts as data controller for data related to your account and subscription, and as data processor for data appearing on the client company's invoices (for which the client company remains the controller).
Point of contact for any question about your personal data: dpo@diamontis.fr. Diamontis Informatique has not appointed a Data Protection Officer within the meaning of Article 37 GDPR, as such an appointment is not mandatory given its processing activities.
Data collected and purposes
User account
Full name, e-mail, password (hashed), two-factor authentication secret, roles, last login date; for each open session, the browser, the IP address and the country, derived on our own servers without sending anything to a third party, kept for 30 days after the last activity. Purpose: account creation and security, authentication, list of sessions and remote sign-out, support.
Phone number
Your phone number is collected so that we can contact you as part of using the service: operational messages (incidents, sensitive operations), notifications related to your invoices, account information, support and, where relevant, fraud prevention at sign-up. It is never shared with third parties for commercial purposes, nor used for marketing.
Company data
SIREN, company name, address. Purpose: linking the user to the company, compliance with the e-invoicing reform.
SaaS subscription and billing
Plan, billing period, status, due date, Stripe identifiers (customer/subscription). Purpose: managing the subscription lifecycle. No card data is stored by Diamontis FX.
Invoice data (processing)
Company names, SIREN numbers, intra-EU VAT numbers, addresses, amounts, descriptions, any contacts and bank details (IBAN, BIC) appearing on invoices received or issued on the client's behalf. Purpose defined by the client (controller of this processing) and legal e-invoicing obligation.
Designation mandate
Scope of consent, IP address, user agent, timestamp. Purpose: evidence of the mandate granted to the Dematerialisation Operator.
Verification of organisations outside the scope of electronic invoicing
Minutes of appointment or list of officers, and the applicant's identity document. Purpose: to confirm that the person opening the account does run the organisation, before sending e-mails and publishing pages in its name. These organisations are not verified by an accredited platform, as they are not connected to one. Legal basis: legitimate interest (preventing business identity fraud) - this is not an anti-money-laundering due diligence obligation, to which Diamontis Informatique is not subject. The identity document is viewed and then DELETED as soon as the check is decided, favourably or not, and no copy is kept; only the record of its review remains. The minutes, a document of the legal entity, are kept for the duration of the contractual relationship and then five years.
Logging and audit
User identifier and e-mail address, action, timestamp, technical metadata including IP address. Purpose: traceability, security and evidence of binding actions. The owner of a company can review the actions taken in their company on the "Activity" view, without IP addresses.
Legal bases
Depending on the processing: performance of the contract (account creation, subscription, mandate), legal obligation (tax retention, e-invoicing) and legitimate interest (security, evidence, fraud prevention).
Recipients and processors
Your data may be shared with the following recipients, strictly within the scope of their respective missions:
- SuperPDP (Approved Platform): regulatory transport and delegated archiving of invoices - European Union.
- Stripe: subscription payment processing - European Union / United States, governed by standard contractual clauses. When a client company offers its own customers to pay its invoices by card, the payment goes through its own Stripe account, which it opened, connected to Diamontis FX through Stripe Connect and is responsible for: Diamontis FX sends Stripe the invoice number and the amount due, receives from Stripe the status of the payment and of its fee, and never sees card details.
- OVHcloud (OVH SAS): infrastructure hosting - servers, database - France.
- OVHcloud Object Storage (OVH SAS): storage of documents and archived records - France.
- OVHcloud (OVH SAS): relay for transactional e-mails - France.
- Optical character recognition (OCR): reading of scanned invoices. This processing runs on our own servers; no data is transmitted to a third party for this purpose.
- OVHcloud AI Endpoints (OVH SAS, France): artificial intelligence assisted analysis of imported invoices and of supplier invoices received off-network, and suggestion of accounting accounts, described in detail in the next section.
Artificial intelligence: assisted analysis of invoices
When an invoice is imported, or a supplier invoice is dropped off-network (from the application, or by the supplier through a drop-off link), and automated reading has not identified its line items or its recipient, its text is submitted to a language model, that is to say an artificial intelligence system, hosted in France by OVHcloud AI Endpoints. That text is not redacted: it may therefore include the bank details, tax identifiers and e-mail addresses shown on the invoice, precisely because those are what distinguish the issuer from the recipient. No page image is transmitted.
Processing is one-off, performed at import time, and the content is not reused to train any model. The result is a suggestion, presented as uncertain and subject to your validation: no decision is made automatically. Optical character recognition, for its part, runs on our own servers and transmits nothing to a third party.
On the Business plan, the line items of an invoice (description, amount excluding tax, VAT rate) and the name and SIREN of the third party may be submitted to the same provider to suggest an accounting account. Neither the invoice text nor its bank details, addresses or e-mails are sent for this purpose. The suggestion is flagged as such on screen, has no effect until you validate it, and the record of the request is kept for 6 years, the time limit of a tax audit. The same company setting turns off all of these uses.
Retention periods
Invoices and archived records: 10 years (tax obligation), including after termination - this period takes precedence over any erasure request. Invoice lifecycle events follow the same period, as they are part of the record.
Account: until it is deleted, which you can do at any time from the "My data" area of the application once you no longer own an active company; a registration that is never confirmed is deleted after 30 days. An account linked to no active company and not signed into for 3 years is anonymised automatically, after a notice e-mail sent 30 days beforehand: signing in meanwhile cancels it. The invoices and accounting records of companies keep their legal period. Subscription: for the duration of the relationship, then according to the applicable accounting periods.
Mandate evidence: 10 years. It is evidence, and is not purged along with the account.
Audit log: 12 months, extended to 5 years for a defined list of binding actions (signing a mandate, submitting an invoice, payment operations), and to 6 years for the bookkeeping allocation trail (accounts chosen, validated or rejected, AI suggestions), the time limit of a tax audit.
End-customer portal recipients: 3 years of inactivity, or 90 days without any linked access.
Technical and operational data (sessions, login and reset tokens, API call log, directory caches, import logs and history imports, discarded supplier invoices, reminders, failed messages): from 30 days to 24 months depending on their nature. On behalf of client companies, the log of e-mails sent to their customers (quotes, payment reminders) is kept for 5 years, and FEC exports for 10 years after the end of the exported period. The table-by-table detail is kept in our record of processing activities and is provided on request.
Your rights
You have a right of access, rectification, erasure (within the limit of the 10-year tax retention obligation, which takes precedence), restriction, portability and objection over your data.
For data processed as a processor (invoice data), your request is forwarded to the client company acting as controller.
To exercise your rights, contact us at dpo@diamontis.fr or by post at DIAMONTIS INFORMATIQUE, 10 rue Louise Michel, 57300 Hagondange, France. We reply within one month of receiving your request.
Complaint to the CNIL
You have the right to lodge a complaint with the French data protection authority (CNIL), 3 Place de Fontenoy, 75007 Paris - www.cnil.fr, if you consider that the processing of your data constitutes a breach of the GDPR.
Security
Hashed passwords, available two-factor authentication whose secret is encrypted at rest, rate limiting on login and sign-up attempts, encryption in transit (TLS) on all communications, encryption of integration secrets for partner platforms, strict data isolation between client companies, sealing and timestamping of archived records, logging of sensitive actions.
Cookies
Diamontis FX only uses technical cookies strictly necessary for the service to work (application session, cross-site request forgery protection, language choice). No audience measurement or advertising cookie is set at this time.
Transfers outside the European Union
Our payment provider, Stripe, may involve data transfers to the United States, governed by standard contractual clauses. If you turn on browser notifications, they travel through the notification service of your browser vendor (Google, Mozilla, Apple or Microsoft), which may be located in the United States: it only sees your device identifier and encrypted content it cannot read, which never carries an amount or a name. Likewise, a due-date calendar you subscribe to from an online calendar is read by the service you chose. All our other processors are located within the European Union: SuperPDP within the Union, and OVHcloud in France for hosting, document storage, e-mail delivery and assisted analysis of invoices.
Changes to this policy
This policy may change; the version in force is the one published on this page, as of the update date shown at the top of the document.