Data protection

Note: This English translation is provided for convenience. In the event of any discrepancy, the French version shall prevail and is legally binding under French law.

Part A · Customer data inside emi

1. Roles and legal framework

emi is a service published by APRESTA (Société à responsabilité limitée (SARL), SIREN 537 518 540, 486 rue Sadi Carnot, 59184 Sainghin-en-Weppes, France), under the aprestIA brand. Processing operations are governed by the EU General Data Protection Regulation (GDPR, EU 2016/679), the French Data Protection Act (Loi Informatique et Libertés) and, where applicable to affected individuals and processing operations, the revised Swiss Federal Act on Data Protection (FADP / nLPD).

• Your organization is the data controller for the data that it and its users entrust to emi (conversations, documents, data retrieved via connectors, user accounts). It determines the purposes and means of processing.
• APRESTA acts as a data processor within the meaning of Article 28 GDPR and Article 9 Swiss FADP: it processes such data on your behalf, strictly on your documented instructions, and solely to provide the service.
• APRESTA acts as an independent data controller for its own customer relationship management operations: contracts, billing and support, as well as for website visitor data (see Part B).

These commitments are formalized in a Data Processing Agreement (DPA) attached to your subscription contract. In the event of any discrepancy, the signed contract prevails over this page.

2. Data processed in emi

• Content: prompts sent to the assistant and generated replies, documents uploaded to the Knowledge Base, and items accessed via connectors enabled by your users.
• User account data: first name, last name, work email address, department, role and access permissions, acceptance of the AI charter.
• Usage and technical data: login and security logs, token and quota consumption, workspace configuration settings.

Data subjects include your employees and, depending on the documents you upload, your clients, suppliers or partners. You freely choose what you store in emi and what the AI is allowed to read (“AI-readable” toggle and folder-level permissions).

Sensitive data. emi is designed for everyday business and document workflows. Special categories of personal data (health, political opinions, biometric data, criminal convictions…) and data subject to heightened statutory secrecy should only be uploaded following your own compliance assessment and, where required, a specific contractual addendum. In France, medical patient records require HDS-certified hosting: please contact us prior to any such use.

3. Our processor commitments

In accordance with Article 28 GDPR, APRESTA undertakes to:

• process your data solely on your documented instructions, including with regard to transfers, and inform you immediately if an instruction appears to infringe applicable data protection law;
• ensure confidentiality: every person authorized to process data is bound by a contractual or statutory duty of confidentiality;
• implement the technical and organizational security measures described in Section 7;
• engage sub-processors solely under the conditions set out in Section 6;
• assist you in fulfilling requests from individuals exercising their data protection rights;
• assist you in ensuring security, notifying personal data breaches, and conducting Data Protection Impact Assessments (DPIAs) and prior consultations, taking into account the information available to us;
• at the end of the contract, return and subsequently delete your data in accordance with your instructions (Section 11);
• make available all information necessary to demonstrate compliance with these obligations and allow for audits (Section 16);
• maintain a record of processing activities carried out on your behalf.

4. Zero training, zero reuse

• Your conversations, documents and data are never used to train, fine-tune or evaluate any AI model — neither ours nor any third party’s.
• The open-source AI models used by emi run directly on our infrastructure in Switzerland: your content is never sent to an external model provider.
• Your data is never sold, rented or shared for marketing or advertising purposes, and is never profiled for our own benefit.
• Only aggregate usage metrics (token volumes, active user counts) are processed for billing, quota management and capacity planning.

5. Location and international transfers

Application data is hosted and processed in Switzerland, in the data centers of Infomaniak Network SA. Switzerland benefits from an adequacy decision by the European Commission (Decision 2000/518/EC, confirmed on January 15, 2024), allowing personal data to flow freely from the European Union without additional transfer mechanisms. No transfer to a non-adequate third country takes place without your prior documented instruction and the safeguards required under Articles 44 et seq. GDPR.

Connectors. When a user links emi to a third-party service (for example an email provider), data exchanges with that service occur at your initiative under your own agreement with its publisher, which is not our sub-processor. Your administrator controls which connectors are available, and each user can revoke their connections at any time.

6. Sub-processors

We notify you at least 30 days in advance before adding or replacing any sub-processor. You may object on legitimate data protection grounds; failing an alternative solution, you may terminate the affected service without penalty. Every sub-processor is bound by data protection obligations at least equivalent to those set out here, and APRESTA remains fully liable to you for their performance (Article 28(4) GDPR).

7. Security measures

We implement technical and organizational measures appropriate to the risk (Article 32 GDPR, Article 8 Swiss FADP), including:

• Encryption in transit for all communications between your devices and emi (HTTPS/TLS).
• Certified data centers: our hosting provider is certified ISO 27001:2022 (information security) and ISO 9001:2015.
• Strict isolation: each customer’s data is logically isolated on its dedicated environment; within your workspace, folder permissions (Manage, Contribute, Read, None) are enforced by the AI, which never cites a document the user is not authorized to read.
• Access control: user authentication, role-based permissions managed by your administrators, and least-privilege access for our operations staff.
• Backups: regular backups stored in Switzerland, retained on a rolling 30 days cycle before being overwritten, and regularly tested for restoration.
• Security maintenance: patching, security updates, infrastructure monitoring and security event logging.
• Governance: staff confidentiality undertakings, incident response procedures and ongoing security awareness.

Detailed security documentation is available upon request under a non-disclosure agreement.

8. Access by our staff

Authorized members of our team access your content only when strictly necessary: at your explicit request for technical support, to investigate and mitigate a security incident, or where required by law. They never view your conversations or documents for any other purpose, including sales or product training.

9. Personal data breaches

In the event of a personal data breach (accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to) affecting your data, APRESTA will:

• notify you within a maximum of 48 hours after becoming aware of the breach, by email to your designated account contact;
• provide the nature of the breach, the categories and approximate number of affected individuals and records, the likely consequences, and the remedial measures taken or proposed, providing follow-up updates as needed;
• act without delay to contain the incident and mitigate its impact;
• assist you with supervisory authority notifications (CNIL within 72 hours; in Switzerland, the FDPIC as soon as possible) and, where applicable, communication to affected individuals;
• log every incident in its internal breach register.

10. Data subject rights

Individuals whose personal data is processed in emi hold rights of access, rectification, erasure, restriction, objection and data portability. As the data controller, your organization responds to such requests; your administrators can handle most actions directly through the Administration console and Knowledge Base. We provide reasonable assistance for requests you cannot fulfill on your own. Should a request reach us directly, we forward it to you promptly and do not reply without your prior instruction.

11. Retention and deletion

• During the contract: your data is kept for as long as you retain it in emi. Deleting a document from the Knowledge Base immediately stops the AI from using it; deleted items age out of encrypted backups at the end of the rolling cycle (30 days).
• Technical logs: retained for a limited duration proportionate to security and billing verification needs.
• At contract end: you have 30 days to export and recover your data (Section 12). Thereafter, all customer data — including backups — is permanently erased no later than 60 days after termination. A written certificate of deletion is issued upon request.
• Only records we are legally required to retain (such as accounting and tax invoices) are archived beyond that period for the statutory duration.

12. Reversibility and portability

You are never locked into emi. At any time during your subscription, and throughout the post-termination recovery window, you can export your data:

• Knowledge Base documents in their original file formats;
• conversations, user directory, role assignments and workspace settings in a structured, open, machine-readable format;
• reasonable technical assistance to facilitate handover to your internal teams or another provider.

Standard data export is included in your subscription. Custom migration engineering may be subject to a prior quote.

13. Service continuity and insolvency

Enterprise AI quickly becomes part of daily operations. Here is how your business is protected if something goes wrong — including worst-case scenarios.

13.1 Technical outage or incident

In the event of an outage or data loss caused by a technical incident, we restore the service and recover data from the latest backups. Affected customers are informed of the incident, its scope and its resolution. Availability targets and any applicable service credits are specified in your contract.

13.2 Sub-processor failure

Should our hosting provider or any other sub-processor default, APRESTA remains solely accountable to you. We would coordinate migration to an alternative provider offering equivalent guarantees in Switzerland or the European Union under the procedure in Section 6, keeping you informed at every step.

13.3 Service discontinuation or insolvency of Apresta

If APRESTA were to discontinue emi, transfer its business, or enter safeguard, reorganization or judicial liquidation proceedings:

• Your data remains your exclusive property. It never forms part of APRESTA’s corporate assets and cannot be sold, monetized or transferred to any third party for purposes other than delivering the service to your organization.
• Advance notice: in the event of a planned service sunset, you receive at least 3 months prior notice to organize a smooth transition.
• Guaranteed recovery: full data export (Section 12) remains available throughout the notice period and during the subsequent 30 days recovery window.
• Assignment to a successor: in the event of a business transfer or acquisition, any successor is bound by the same commitments. You are notified in advance and may object to the transfer, terminate your contract, export your data and require its deletion.
• Insolvency proceedings: we undertake to bring these obligations to the attention of any court-appointed administrator, receiver or liquidator so that restitution and subsequent erasure of your data are upheld within the limits of applicable law.
• Final deletion: once restitution is complete, all data is permanently erased by APRESTA and its sub-processors, including backups.

13.4 Limitations of generative AI

Like any generative AI system, emi can produce inaccurate or incomplete outputs. emi cites document sources to make verification straightforward; generated content must be reviewed by a qualified human before any binding use. emi makes no automated decisions producing legal or similarly significant effects concerning individuals (Article 22 GDPR, Article 21 Swiss FADP): all decisions remain with your staff.

14. Government and authority requests

If a public or judicial authority requests access to your data, we review the lawfulness and scope of the order, challenge it if it appears unlawful or overbroad, disclose only the strict minimum legally required, and notify you beforehand unless prohibited by law.

15. Your responsibilities

As data controller, your organization undertakes in particular to:

• ensure a valid legal basis for the data entrusted to emi and inform its staff about the use of the tool;
• upload only necessary documents and configure folder permissions and the “AI-readable” toggle appropriately;
• establish an internal AI acceptable-use charter, secure administrator accounts and promptly revoke access when employees leave;
• assess third-party connectors prior to enabling them;
• fulfill its own obligations as a deployer under the European AI Act (Regulation EU 2024/1689), notably AI literacy for staff — which the built-in emi Academy helps support.

16. Documentation and audits

Upon request, we provide our Data Processing Agreement, the up-to-date list of sub-processors, our security overview and our hosting provider’s ISO certificates, and assist with your security questionnaires. You may conduct — or commission an independent auditor bound by confidentiality to conduct — a compliance audit upon reasonable advance notice in accordance with your contract.

Part B · Website visitors and prospects

17. Website visitors and demo requests

Data controller: APRESTA, 486 rue Sadi Carnot, 59184 Sainghin-en-Weppes, France — contact@apresta.fr.

Data collected. The demo request form collects your first name, last name, work email, company name, team size, industry and message. Our website hosting provider records standard technical logs (server logs, IP address, browser user-agent) strictly for security and operational reliability.

Purposes and legal bases. Scheduling the live demonstration and answering your inquiry (pre-contractual steps taken at your request); following up on your business project (legitimate interest); protecting the website and preventing abuse (legitimate interest).

Recipients and location. Authorized staff at APRESTA and strictly necessary technical providers for web hosting and transactional email delivery. This website is hosted in Switzerland by Infomaniak Network SA. Your personal data is never sold or shared with third parties.

Retention period. Up to 3 years after our last interaction unless you become a customer; technical server logs are kept for a short rolling period.

Cookies. Zero analytics cookies, zero advertising trackers and zero third-party tracking scripts. A single strictly necessary session cookie is set on the demo request page (CSRF form security token) and deleted when you close your browser; exempt from consent, it serves no other purpose.

18. Contact and supervisory authorities

For any question regarding this page or to exercise your privacy rights: contact@apresta.fr, or by post to APRESTA, 486 rue Sadi Carnot, 59184 Sainghin-en-Weppes, France. We reply within one month.

You also have the right to lodge a complaint with the French supervisory authority, CNIL (cnil.fr), or in Switzerland with the Federal Data Protection and Information Commissioner, FDPIC (edoeb.admin.ch).

See also: Legal notice · Terms & Conditions · GDPR explained · Hosting · Privacy.

Last updated: November 2026.