Privacy Policy
Last updated:
This policy explains how QuotaRail handles personal data when you use our website and services or contact us.
Who is responsible
Auxicodex, at 75 Boulevard de Charonne, 75011 Paris, France, operates QuotaRail and is responsible for the personal data described here.
Information we collect
App data includes account and workspace details, budgets, and usage history that you provide or ask us to manage.
When you email us, we receive your email address, message, and any name or attachments you include. Your name and attachments are optional; we need an email address to reply.
When you visit, we and our hosting provider receive your IP address and the pages or resources you request. These are needed to load the requested page. Your browser may also send browser and device information. Technical logs record requests and errors.
We store display preferences in cookies. Some application environments also set a session cookie containing an automatic-session identifier. Where request limits are enabled, we count requests by IP address to limit excessive traffic.
How we use information
We use app data to provide budgeting and usage features. Where you are our customer, we process the app data needed to provide the service under our contract with you. When an organisation provides personal data for us to process on its behalf, we follow its instructions.
We use request data to serve pages, diagnose faults, and prevent abuse. We use display preferences to remember your choices. Our legal basis is our legitimate interest in operating a secure, usable website.
We use your contact details and messages to answer you. General enquiries are handled on the basis of our legitimate interest in responding to questions. If you ask us to take steps towards a contract, or to carry out an existing contract, we rely on the contract basis for the information needed to do that.
We rely on legal obligations when processing information to meet a legal duty, such as answering a data protection request. Records needed for legal claims are processed on the basis of our legitimate interest in protecting our legal rights.
Sharing and transfers
Hosting providers store app data and process technical data to run the service. Where server observability is enabled, PostHog receives the technical request and error information described above to monitor the service. Email providers handle messages and contact details to deliver correspondence. We may disclose relevant records to professional advisers or public authorities when required by law or necessary for legal claims.
We host the app and its main database in the European Union. Our hosting provider also processes personal data in the United States to operate its services. Where server observability is enabled, we use PostHog's configured European Union or United States service region. Transfers outside the European Union use applicable safeguards under its data processing terms. You can request a copy of the transfer safeguards by contacting us.
Cookies and preferences
We use cookies to remember your preferences. You can delete or block cookies in your browser settings.
Optional analytics
With your permission, we use analytics cookies to collect page views, clicks, scrolling, and page content. We hide form inputs. We save your choice for six months. To change it, click Cookies at the bottom of the page, then Accept or Refuse.
Analytics records browser and device details, language, time zone, referring site, approved campaign channels, and approximate location. PostHog removes IP addresses from stored events. Session replay records masked page activity. Text and inputs are hidden, and the waitlist form is excluded. We also collect masked errors and page speed measurements.
A browser identifier can link repeat visits and supported visits between our website and Demonstration. It does not identify a unique person or link different devices. Refusal, blockers, connection failures, and free limits can prevent collection. Withdrawal stops new collection and clears the browser identifier; it does not delete data already received. Our free plan includes one year of analytics retention and 30 days of replay retention.
Data retention
We keep your personal account details while your account is open. We keep each workspace’s data, including budgets and usage history, while that workspace exists. We delete personal account details within 30 days after account deletion, and workspace data within 30 days after workspace deletion, except where the law requires us to keep it longer.
We keep technical data under our control, including logs and request-limit records, for up to 30 days, unless a specific security investigation or legal obligation requires longer retention.
We determine how long to keep correspondence based on whether your request or service is ongoing, or whether a legal obligation or claim requires it.
Your rights and contacts
You can request access to your personal data, a copy, correction, or deletion. You can ask us to restrict processing where the law allows. For automated processing based on consent or a contract, you can request the data you provided in a portable format, subject to the legal conditions.
You can object to processing based on legitimate interests for reasons related to your situation. You can object to direct marketing at any time. If we rely on your consent, you can withdraw it by contacting us, without affecting earlier lawful processing.
Send privacy questions or requests to [email protected]. We handle requests free of charge, except where the law permits a fee. We respond without undue delay and within one month, or sooner if the law requires it. For complex or numerous requests, we may extend this by up to two further months and will explain why within the first month. We ask for additional identity information only where there are reasonable doubts about who is making the request.
You have the right to complain to a data protection authority.
Changes to this policy
We update this policy when our data practices change and notify you when the law requires it.