Introduction
This privacy policy describes how InterVizio ("we", "our" or "the Company") collects, uses, stores and protects your personal data when you use our technical intervention management platform. This policy applies to all users of our services, whether technicians, coordinators, clients or subcontractors.
1. Data Controller
The data controller is:
DELTINFO
Société par Actions Simplifiée (SAS) au capital de 2 000 €
51 Avenue de la Côte de Nacre, 14000 CAEN
RCS Caen 914 555 636
Représentée par M. Christopher Gernigon, Président
Email : [email protected]
2. Personal Data Collected
We collect different categories of personal data depending on your use of our services:
Identification data
- First and last name
- Email address
- Phone number
- Profile photo (optional)
Professional data
- Company name
- Position/role
- Professional address
- Company registration (for subcontractors)
- Professional qualifications and certifications
Geolocation data
- Home address (for technicians, with consent)
- GPS coordinates of intervention locations
Usage data
- Intervention history
- Intervention reports and photos
- Electronic signatures
- Internal platform communications
3. Processing Purposes
Your personal data is processed for the following purposes:
- •User account management and authentication
- •Technical intervention planning and tracking
- •Route optimization for technicians
- •Generation of intervention reports and billing
- •Communication between stakeholders (technicians, clients, coordinators)
- •Synchronization with external calendars (Google Calendar)
- •Artificial intelligence assistance: Odin technical assistant, analysis of documents, photos and CVs, writing help and translation
- •Detection and correction of technical errors (masked session recording only with your consent)
- •Legal and regulatory compliance
- •Continuous improvement of our services
4. Legal Basis for Processing
The processing of your data is based on the following legal bases:
Contract performance
To provide our intervention management services
Consent
For geolocation, third-party service integration and session recording (Sentry)
Legitimate interest
To improve our services and ensure security
Legal obligation
To comply with accounting and tax obligations
5. Retention Period
Your data is retained for the following periods:
| Data type | Retention period |
|---|---|
| Account data | Duration of contractual relationship + 3 years |
| Intervention data | 10 years (legal obligations) |
| Invoices and accounting documents | 10 years |
| Geolocation data | Home address: until the account is deleted; intervention locations: kept with the intervention |
| CVs and applications (talent pool) | 2 years after the record was last updated, then deleted automatically |
| Connection and activity logs | Sessions: 6 months; IP address and browser in the activity log: erased after 12 months; activity log: 2 years |
6. Data Security
We implement appropriate technical and organizational measures to protect your data:
- Encryption of data in transit (HTTPS/TLS) and at rest
- Secure authentication with multi-factor authentication option
- Role-based access control (RBAC)
- Data isolation by organization (multi-tenant)
- Regular encrypted backups
- Access monitoring and logging
- Staff training on data protection
8. Sharing Data with Third Parties
To run the service, we rely on the following technical providers. Each one only receives the data it needs for its task. When data is processed outside the European Union, the transfer is covered by the safeguards provided for by the GDPR (European Commission standard contractual clauses or the EU–US Data Privacy Framework).
Supabase (data hosting and authentication)
Purpose : Database, accounts and authentication, file storage, server functions
Data transmitted : All platform data (profiles, interventions, documents, logs)
Location : European Union (Ireland); US company
o2switch (website and web application hosting)
Purpose : Serving the application and the intervizio.fr website, relaying public API calls
Data transmitted : IP address and technical connection information (web server logs)
Location : France
Resend (email delivery)
Purpose : Sending transactional emails (invitations, notifications, reports, reminders)
Data transmitted : Recipient name and email address, email content
Location : United States
Mistral AI (artificial intelligence)
Purpose : AI features: Odin technical assistant, analysis of documents, photos and CVs, writing and proofreading, email translation, knowledge base search
Data transmitted : Text, documents and photos submitted to these features: intervention descriptions and reports, candidates' CVs (name, contact details, career), questions asked to the assistant
Location : France / European Union (Mistral AI, La Plateforme); the provider keeps no data beyond processing the request
Brave Search (Odin assistant web search)
Purpose : Searching public technical documentation when the internal knowledge base has no answer
Data transmitted : Technical search terms (brand, model, symptom), without names or contact details
Location : United States
Stripe (subscription payments)
Purpose : Subscription payment and management, subscription invoices
Data transmitted : Organization name, email and billing address; the payment method is entered directly with Stripe and never stored by InterVizio
Location : European Union (Ireland) and United States
Qonto (bank reconciliation, optional)
Purpose : For organizations that connect their Qonto account: retrieving subcontractor invoices and matching them with payments
Data transmitted : Supplier invoices, subcontractors' names and bank details, amounts
Location : France
Expo, Google Firebase Cloud Messaging and Apple (push notifications)
Purpose : Delivering notifications to phones (mobile app) and browsers
Data transmitted : Technical device identifier, notification title and text
Location : United States
hCaptcha (bot protection)
Purpose : Checking that a person, not a bot, fills in the sign-in, sign-up and invitation forms
Data transmitted : IP address, browser information and interaction with the challenge
Location : United States
Sentry (error monitoring)
Purpose : Detecting and fixing technical errors; session recording only if you accept it in the banner, with text, inputs and images masked
Data transmitted : Error message and technical context (page, browser, system, technical identifier); with your consent, masked replay of the screen
Location : European Union (Germany); US company
Google (Google Calendar API)
Purpose : Synchronization of planned interventions with the technician's Google Calendar
Data transmitted : Intervention title, scheduled date/time, site address, request reference
Location : Google infrastructure (GDPR compliant)
OpenRouteService (route calculation)
Purpose : Calculating distances and routes for interventions
Data transmitted : Geocoded addresses (no personally identifiable data)
Location : Germany
Base Adresse Nationale (adresse.data.gouv.fr)
Purpose : Address autocomplete and geocoding
Data transmitted : Entered addresses, without names or contact details
Location : France
OpenStreetMap (maps and Nominatim geocoding)
Purpose : Displaying base maps and converting addresses to geographic coordinates
Data transmitted : IP address (map loading); text addresses without names
Location : OpenStreetMap Foundation servers and their delivery network
17TRACK (parcel tracking)
Purpose : Tracking equipment shipped for an intervention
Data transmitted : Tracking number and carrier, without name or address
Location : Outside the European Union
flagcdn, unpkg and cdnjs (icons)
Purpose : Displaying country flags and map markers
Data transmitted : No account data (static image loading, technical IP address)
Location : Global delivery networks
Have I Been Pwned (compromised passwords)
Purpose : Rejecting a password that already appeared in a public data breach
Data transmitted : The first 5 characters of the password hash; the password itself is never sent
Location : Global network (Cloudflare)
ipwho.is (IP address location)
Purpose : Only for the demo account provided to Apple and Google review teams: approximate location of their sign-ins
Data transmitted : IP address of sign-ins to that single account
Location : Not specified by the provider
We never sell, rent or disclose your personal data for commercial or advertising purposes. Data is only shared with the providers listed above, strictly within the scope of the service operation.
9. Google API Data Usage
InterVizio uses the Google Calendar API to allow technicians to synchronize their planned interventions with their Google Calendar. This section describes precisely how we access, use and protect data obtained through Google APIs.
Google data we access
- •Your Google Calendar events (read and write) to create, update and delete events related to planned interventions
- •Basic information from your Google profile (name, email) to associate your Google account with your InterVizio profile
How we use this data
- •Automatically create events in your Google Calendar when an intervention is scheduled
- •Update or delete these events when the intervention is modified or cancelled
- •Display synchronization status in your InterVizio planning interface
- •No other use is made of your Google Calendar data
Sharing of Google data with third parties
Data obtained through Google APIs is exclusively transmitted to Supabase Inc., our database hosting sub-processor located in the European Union (Ireland), for the sole purpose of synchronizing your calendar events with InterVizio. Apart from this technical sub-processor, no Google data is shared, sold, rented, or disclosed to any other third party. No Google data is used for advertising, profiling, creditworthiness assessment, or resold. No data obtained through Google APIs is transferred to any third-party artificial intelligence or machine-learning service, nor used to create, train, or improve AI/ML models; InterVizio's AI features process internal operational data only and never your Google data.
Google API Services User Data Policy Compliance
InterVizio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We only use Google data to provide and improve user-facing features in InterVizio.
Revoking access
You can revoke InterVizio's access to your Google Calendar at any time from your Google account settings (https://myaccount.google.com/permissions) or from the Planning page in the application. Revoking access will delete stored access tokens but will not remove events already created in your calendar.
Intervizio connector for Claude (MCP)
The connector lets the Claude assistant (Anthropic) read and, if your organization has allowed it, change Intervizio data at your request, using your account. This section states what it processes; the rest of this policy also applies. Connector documentation
What the connector reads and writes
- It acts only with the rights of the signed-in Intervizio account: same roles and same per-organization isolation as in the application. It sees nothing more than you do.
- Read, depending on your roles: requests, interventions, planning and absences, clients and sites, reports, notifications, indicators, expenses, overtime, pre-invoicing and invoices, parcels.
- Write: only the actions your organization's administrator has enabled one by one (for example creating a request or scheduling an intervention), with the same checks as in the application.
- Never exposed: users and roles, settings, API keys, subscription, permanent deletion, GDPR export, encrypted messaging.
What is logged, and for how long
- For each tool call: date, organization, account (or API key), OAuth application, tool name, outcome (succeeded, refused, limited, error), HTTP code, duration, and whether it is a write.
- Never the arguments sent by Claude nor the data returned. Data created or changed by an action is stored like any other Intervizio data, in the application.
- The IP address is not written to this log: it only feeds the rate limit (300 calls per minute per address), in a counter whose entries older than one day are purged. Each account is also limited to 120 calls per minute, including 20 writes.
- Duration: the log is kept as long as the organization exists and deleted with it; there is no automatic purge. The link to the user or key is erased if that account or key is deleted. The organization can ask for its lines to be deleted at [email protected]. Its administrators view the latest calls in Settings › API.
No conversation is received or stored
The server does not receive your conversations with Claude: it only receives the tool calls Claude sends it (tool name and parameters), without logging them. It neither requests nor keeps your history, messages, files or Claude profile.
Access tokens and revocation
- Sign-in uses OAuth: you identify yourself on Intervizio (with two-factor authentication if enabled) and authorize Claude on a consent page. Claude never sees your password.
- Tokens are managed by Intervizio's authentication service. The connector server does not store them: it verifies their signature on every call.
- To revoke: disconnect Intervizio in Claude's connector settings; the organization administrator can turn the connector off (Settings › API › MCP connector), which blocks all calls at once; you can also ask [email protected] to revoke the authorization.
Sharing with third parties
The results of the tools you call are passed to Claude, hence to Anthropic, so that the assistant can answer you; Anthropic processes them under its own terms and privacy policy. Only call a tool for data you are entitled to share with Claude. Intervizio sends nothing to Anthropic on its own initiative.
Contact
Questions, exercising your rights or a revocation request: [email protected] (DELTINFO, 51 Avenue de la Côte de Nacre, 14000 CAEN, France).
7. Your Rights
Under GDPR, you have the following rights over your personal data:
Right of access
Obtain a copy of your personal data
Right to rectification
Correct inaccurate or incomplete data
Right to erasure
Request deletion of your data
Right to restriction
Limit the processing of your data
Right to portability
Receive your data in a structured format
Right to object
Object to the processing of your data
Right to withdraw consent
Withdraw your consent at any time
To exercise your rights, contact us at: [email protected]
You also have the right to lodge a complaint with the supervisory authority.
10. Cookies
Our platform uses cookies and trackers strictly necessary for the operation of the service and, only if you accept, a masked session recording:
- •Authentication cookies : to maintain your logged-in session
- •Preference cookies : to remember your display settings
- •Session recording (Sentry) : only after you click “Accept” in the banner: when something goes wrong, it lets us replay the screen to fix the error, with text, inputs and images masked. Without your consent, nothing is recorded.
We do not use any advertising cookies. You can change your choice at any time:
11. Contact
For any questions regarding this privacy policy or the processing of your personal data, you can contact us:
Email : [email protected]
Adresse : 51 Avenue de la Côte de Nacre, 14000 CAEN, France