Privacy Policy

Account Information (Required)

• Email address (for authentication and communication)
• Display name (for personalization)
• Password (encrypted, never stored in plain text)
• Account creation and last login timestamps

Profile Data (Optional)

• Personal information for form autofill (name, address, phone, etc.)
• Additional user profiles (legacy subscription plans)
• Document preferences and saved templates

Usage & Technical Data

• Device information (browser, OS, screen resolution)
• The page on which you arrived for the visit in which you created your account, and the campaign name in its address if there was one (for example an advertising campaign). We keep this on your account, under our legitimate interest, to see which pages and campaigns bring people who sign up. It is a reading of our own address bar — never the site you came from or what you searched for — and it is written to your account only at the moment you create it.
• Your IP address. It necessarily reaches our servers and our CDN with every request. Where we keep a record of it, we keep a salted hash rather than the address itself, together with the country it resolves to — but a hash of your IP is still data about you, and we process it to rate-limit abuse, not to identify you
• A salted hash of your sign-up IP, kept only to prevent sign-up abuse (e.g. fraudulent free-offer farming) under our legitimate interest, and automatically purged after 90 days
• Usage analytics (pages visited, features used, session duration). When you are signed in, your account identifier is sent as the analytics user identifier, so this data is pseudonymous — linked to you through an identifier — and not anonymous
• Step counts on our free calculators. On the home-employment end-of-contract calculator we count how many visits reach each step (page seen, calculation shown, offer seen, a button pressed, payment page opened), per day and per advertising-campaign name. Since 20 September 2026 we count the same way, per day and with no identifier, how many home-employment relationships were started, invitations sent and accepted, and months of hours recorded and confirmed — totals per role (employer or employee), never who did what. Only those daily totals are stored: no cookie, no identifier, nothing that ties a number to you, and nothing sent to an analytics or advertising provider — which is why this count does not wait for your cookie choice
• Error logs and performance metrics

Rental & Tenant Data (Landlord features)

• Property details: address, type, surface, and energy/heating/diagnostic attributes (DPE)
• For each tenant: name, postal address, phone number, email address, and lease start/end dates
• Lease financials: rent, charges, and deposit amounts; optional guarantor name, contact and date of birth (used only to prefill the acte de cautionnement)
• If you use rent tracking, a payment ledger per tenant: the period, the amount due and the amount received, whether it is paid, partly paid, pending or late, the payment date, and any free-text note you write on the row. It records who has and has not paid you, tenant by tenant and month by month.
• This data is entered by you (the landlord). We use it to generate the rental documents you request, to keep your property records consistent across your devices, and — where you have switched them on — to send you reminders that name the tenant and the property concerned, such as the late-rent reminder. When you buy a rental pack, the property identifier and its address are passed to our payment processor as metadata on the checkout session. We never use tenant data for marketing or profiling. See « Information for Tenants » below.

Frontalier Presence Calendar & Employer Data (Cross-Border features)

• Your frontalier profile: Swiss employment start date, canton of work, annual working-days basis and thresholds, and your droit d'option choice (LAMal or CMU) with its date. Also, if you give them: the event that opened your droit d'option — first job in Switzerland, resumption of work after a period of unemployment, move to France, or retirement on Swiss pensions only — and its date (this answer may reveal that you were unemployed or that you are retired); whether your regime was chosen before your current job; the end date of your Swiss contract and whether you have a new job after it; and the statement that your employer withholds Swiss source tax although you work in a canton of the 1983 agreement — stored with the tax year it concerns (ticked or unticked), when you answer it, or when you generate a quasi-residence (TOU) file as such a worker. It can reveal that a condition of the frontalier status is not met (for example telework above 40 %) or that you are a Swiss national paid by a public-law employer. They are used to compute your option window and the key dates that follow from them — for the source-tax statement, the 31 March TOU reminder of that tax year only; after a contract end, the « France Travail within 12 months » date — and to print the leaver attestation.
• On the health-insurance choice form, your nationality answer and whether you receive Swiss pensions only are checked, in your browser and on our server when the form is generated, to tell you whether the form applies to you; they are printed on the form and kept in the form's draft on your device, not stored in our database. The number of nights spent in Switzerland you enter for the leaver attestation is printed on that attestation and not stored.
• Your employer's identity for the attestations, entered by you: company name, IDE number, address, canton, and the signatory's name and e-mail address — used to print the attestation and, when you request the co-signature, to invite that person to sign. That invitation is sent by e-mail through our e-mail provider (Brevo), the signing itself runs at our EU e-signature provider, and once the document is signed the completed PDF is e-mailed back to that signatory as an attachment through the same e-mail provider, carrying your name. So the signatory's address passes through both providers, not only the e-signature one.
• Your presence calendar, one status per day and per year: worked in Switzerland, telework from France, temporary mission, absence, and for a mission day whether it took place in France or in a third State — never the reason for an absence, no address, no health information. Periods your employer has co-signed are stamped as validated.
• An append-only event log (choice recorded, reminder sent) and the document references you add yourself (a label and a reference text, never a file).
• This data is used solely to compute your position against the published telework thresholds and your droit d'option window and key dates, to send the reminders you have enabled and to generate the documents you request (Art. 6(1)(b) GDPR). It is never used for marketing or profiling, and nothing is shared with your employer beyond the attestation you choose to send.

Browser Extension & In-App Government-Site Assistance

• Our browser extension and mobile guide assist you on French government websites (Ameli, CAF, impots.gouv, France Travail, ANTS, OFII and others).
• To provide contextual guidance, the assistance reads the page you are on — its address, its title, its visible text, and the labels of its form fields, never what you type into them — and sends that to our servers and on to our EU AI provider. This happens automatically when the page loads, not only when you ask a question. No field value is ever read, passwords and card numbers included, and the text is truncated to a length limit. In the browser extension the rest of the page's text is sent as it is written: it is not anonymised and it is not redacted. The mobile guide also masks identifiers, such as a social security number, that appear in field labels or error messages. Anything you type into a free-text question is sent exactly as you wrote it.
• The assistance is on by default, and while it is on the page is sent automatically — so turning it off is the only way to stop it. The switch is called « Page assistance (AI) » and is in the extension's popup. If you are on a page showing information you would rather no model processed, turn it off before you open that page. We do not capture your government-site login credentials.

Service Operations

• User authentication and account management
• Form autofill and document generation
• Documents are generated server-side using a headless browser technology. No personal data is transmitted to third parties during document generation.
• Electronic signatures: when you use the e-signature feature, the signer names and email addresses and the PDF to be signed are transmitted to our e-signature provider (Openapi Srl, Italy). It is a simple electronic signature (SES) under the eIDAS Regulation: each signer reads the document, then enters a one-time code sent to their email address. On its side, Openapi keeps an evidence log of the signature (time of each step, authentication method, document fingerprint) for up to 10 years, and the signed document for up to 3 months. Our own copies, on our EU servers: for a request not signed by everyone, the signer names, email addresses, signing status and documents are deleted within about 78 hours (a sweep runs every six hours once 72 hours have passed); a document signed by everyone is kept until 30 days after the last signature, then deleted, unless you save it to your vault, in which case our temporary copy is deleted within 24 hours. When Openapi provides it, a copy of the evidence log (PDF) is stored with the signed document and deleted with it. Those deletions cover our copies only: Openapi's evidence log is the proof the signature took place. We deliberately do not delete it, and deleting your AdminLanding account does not delete it either.
• AI assistant responses and guidance
• Customer support and troubleshooting

Service Improvement

• Analytics and usage patterns — pseudonymous, not anonymous: when you are signed in, your account identifier is sent as the analytics user identifier
• Feature development and optimization
• Security monitoring and fraud prevention
• Performance monitoring and error tracking
• Occasional requests for feedback on how you use the service, such as a short survey or an invitation to review us, sent by e-mail under our legitimate interest in improving it (Art. 6(1)(f) GDPR). They never contain offers. You can object at any time, without giving a reason, through the link in each of these e-mails or by writing to privacy@adminlanding.com.

Retention Periods

• Active accounts: Until account deletion
• Inactive accounts: reviewed after 3 years of inactivity and deleted after prior notice by email
• Usage logs: your AI-usage log and our legal-explanation log are purged at 12 months. A separate security log of AI requests — which feature, which site, timing and risk flags, never the text — is purged at 90 days. One log is deliberately excluded from that schedule — the administrative audit log, which records what an administrator did on an account. We keep it as the accountability record and it is not purged at 12 months
• Support tickets: at most 2 years, counted from the day the ticket was created. Nothing in the product marks a ticket as resolved, so the clock runs from creation rather than from resolution
• Billing and invoice records: deleting your account first cancels an active membership at our payment processor, then deletes our own membership, subscription and pack records, and we ask the processor to delete your customer object with it. The invoices and payments themselves stay in that processor's books and in our accounting records for 10 years, because French commercial law requires us to keep them (Art. L.123-22 Code de commerce) — an erasure request cannot shorten that
• Rental property and tenant records: kept while your account is active and you keep the property; deleted when you delete the property/tenant or close your account
• Generated documents (rental, tax, cross-border, patrimoine, letters, MDPH and other CERFA): ephemeral copies expire 24 hours after they are made and are removed by a sweep that runs every six hours, so in the worst case a copy lives about thirty hours rather than twenty-four. Automatic monthly rent receipts and documents shared to a tenant vault are the exception and are kept up to 30 days so delivery can complete
• E-signature signer data (names, emails, status) and documents: for a request not signed by everyone, our copy is deleted within about 78 hours of the request (a sweep every six hours after the 72-hour mark); a document signed by everyone, with the copy of its evidence log, is kept until 30 days after the last signature, or deleted within 24 hours once saved to your vault. Openapi keeps its evidence log of a completed signature for up to 10 years and the signed document for up to 3 months — it is the evidence of the signature — and neither our deadlines nor account deletion remove it
• Frontalier profile, employer details, presence calendar and event log: kept while your account is active (the calendar year by year, so past years remain available for the attestations); deleted with your account
• Vault documents: retained (encrypted) until you delete them
• Account deletion: if you have an active membership, we first cancel it at Stripe so that nothing more is charged; then, within 24 hours, we delete your account and profile, your membership, subscription and pack records, your rental, tenant and rent-payment data, your cross-border and frontalier records, your courrier, patrimoine, home-employment, Admin-Intelligence and CERFA document records, your AI-usage log, your API keys and download tokens, and the files held for you in storage — including your encrypted vault and the blobs behind your vault share links. We also ask Stripe and Brevo to delete you on their side. Three things survive that purge, and you should know which. First, document-verification records are scrubbed rather than deleted: we remove your identity from the row but keep the row, so that someone holding a reference number can still check that a document we issued is genuine. Second, the e-signature provider's record of a completed signature is deliberately kept and our deletion does not reach it. Third, our database and storage keep point-in-time-recovery and soft-delete copies for 7 days, so for a week after the purge a recoverable copy still exists in the backup layer before it ages out. If any step of the purge fails, that failure is logged as a failure rather than reported as success, and the purge can be re-run

Data Portability

• Export in JSON, from your account settings. The file contains your profile and account settings, your membership, subscription and packs, your cross-border and housing records, your rental properties, tenants, rent-payment ledger and expenses, the metadata of your generated documents, your tasks and procedures, your support tickets, your activity, login and plan history, your signature requests, your vault registry (the list of entries, not the encrypted files) and your consent record
• What the export does not contain: the contents of any file. Your encrypted vault files, your generated PDFs and your uploaded photos are not in it — download them from the app while they are still there. Several record types are absent too, including your courrier, patrimoine, home-employment and Admin-Intelligence DOCUMENT records (the metadata of a generated PDF) and your AI-usage log. Your home-employment relationships themselves are included since 20 September 2026, with their terms, their deadlines, the history of changes and the hours of every month — minus the other party's account identifier, which is not your data. If you need a complete copy, write to privacy@adminlanding.com and we will assemble it by hand
• Download generated documents and forms
• Request data transfer to another service

Data Protection Officer

General Privacy Inquiries