Privacy and data retention principles

Data controller

Alexandre MASELLI

Personal data contact: rgpd@pro-solutions.fr

Processing roles

Alexandre MASELLI is the controller for the platform’s own processing, including accounts, security and the community. For operator data, Runs and photos collected by a workspace for its activities, the customer organization generally determines the purposes and Waylantern acts as a technical processor.

Runs and operator information

Anonymous operators are not required to create an account or provide an email address. An operator name is optional. Runs remain private to authorized workspace members and always reference the exact procedure version executed.

Photos and evidence

Execution photos are stored privately and are never copied into the community library. Access requires workspace authorization. Retention follows the workspace policy and any applicable legal obligations; deletion must be deferred and audited when historical evidence must be preserved.

Community and author profiles

Only approved template content, public attribution and profile information explicitly made public are exposed. Account email, workspace members, Runs, Issues and private files are never part of a community publication.

Acquisition measurement

Waylantern counts selected public page loads and bounded campaign parameters without storing a visitor identifier, raw IP address or user agent. Attribution is attached to a workspace only when registration succeeds. Anonymous QR operator activity is never used for acquisition measurement. Aggregate events are eligible for deletion after 397 days.

Retention and deletion

The retention policy provides for: inactive accounts after 24 months with a 30-day recovery period; Runs for 24 months; photos for 12 months; abandoned Runs for 90 days; resolved Issues for 24 months; notifications for 12 months; AuditLogs for 24 months; security logs for 6 months; failed jobs for 30 days; community reports for 24 months; and encrypted backups for no more than 30 days. A legal obligation or dispute may suspend deletion. Automated pruning remains limited to operational data; business evidence requires controlled, audited deletion.

Contact and rights requests

Privacy, access, correction, portability or deletion requests can be sent to the contact address above. A response is provided within no more than 30 days, unless a legally permitted extension is announced. Identity and workspace authority may be verified before action is taken.