Privacy policy

1. Data controller

The data controller is the publisher of the service: Benjamin Marchand EI, 6 allée Alphonse Daudet, 77600 Conches-sur-Gondoire, France (see the legal notice).

Contact for your personal data: technique@cronhound.eu.

2. Data processed

• Platform announcements: the “Email me about new announcements” preference (off by default) and the date you last read the announcements shown in the app.
• Account: e-mail address, name, password (stored only as an Argon2id hash), interface language, creation date, e-mail verification status and the date you accepted the terms. If you sign in with Google: your Google identifier, and the name and e-mail Google sends us.
• Feedback (suggestions, remarks, bugs): the kind, title and message you type in the “Send feedback” form, with your name, your e-mail address, the application page (without parameters), the current organization, the language, the application version and your browser (user agent).
• Job content: name, schedule, target URL, method, headers, body and authentication credentials of the requests. The request configuration (URL, headers, body, credentials) and the alert channel configuration are encrypted at rest with AES-256-GCM.
• Run history: date, duration, trigger, number of attempts, HTTP status, response excerpt and error message.
• Organizations and invitations: organization and project names, members and roles, invitations (invited e-mail, role, expiry date), alert channels (e-mail address or webhook URL).
• Subscription: plan, status and current period of each organization’s subscription.
• Billing profile: customer type, name or company name, address, country, billing e-mail address, and VAT or company number, entered by the owner or an administrator of the organization. It appears on invoices.
• Sessions and API tokens: identifiers stored only as hashes, token name, creation, expiry and last-use dates.
• Technical logs: only internal errors are logged (date, method, route template and error message), with no IP address, no request URL and no password, token or cookie. Your IP address is also used in memory for rate limiting.
• Audit trail: for each action that changes data or concerns security (successful or failed sign-in, creation, update or deletion, denied access, administration action), the date, the author (identifier and e-mail address), the action, its outcome, the item concerned, the IP address, the browser (user agent) and a request identifier. It holds no password, no token and no request content. The owners and administrators of an organization see its events, without IP address or browser.
• Audience measurement: public page viewed (without parameters), date and time, referring site (without parameters), browser, operating system and device type, language and anonymized IP address. See section 10.
• Cookies and local storage: see section 9.

3. Purposes and legal bases

• Creating and managing your account, running your scheduled jobs, keeping their history, sending alerts and service e-mails (verification, password reset, invitations), managing organizations and the subscription: performance of the contract (GDPR article 6(1)(b)).
• Showing platform announcements in the app and remembering that you read them: performance of the contract (GDPR article 6(1)(b)).
• Handling your feedback, answering you and improving the service: legitimate interest of the publisher (GDPR article 6.1.f). This feedback stays on our servers in France and is read only through the publisher’s technical address, hosted in France, and by the service administrators. Issue tracking receives only an anonymous reference, without your name, address or message.
• Sending announcements by e-mail, only if you turned on “Email me about new announcements”: consent (GDPR article 6(1)(a)). This consent is explicit, off by default, and can be withdrawn at any time (section 6).
• Payment, invoicing and keeping accounting records: legal obligation (GDPR article 6(1)(c)).
• Security of the service and abuse prevention (rate limiting, request-forgery protection, technical logs, suspension of abusive accounts): the publisher’s legitimate interest in protecting the service and its users (GDPR article 6(1)(f)).
• Audit trail: keeping the data that identifies the author of an action, required from hosting providers (article 6 of the French LCEN law and decree no. 2011-219): legal obligation (GDPR article 6(1)(c)); security of the service and proof of actions: legitimate interest (GDPR article 6(1)(f)).
• Anonymous audience measurement of the public pages, to know how often they are visited and improve them: the publisher’s legitimate interest (GDPR article 6(1)(f)), exempt from consent (see section 10).

Your data is not sold, not used for advertising and not used for profiling.

4. Retention periods

• Account and content (jobs, projects, organizations): until you delete them or delete your account. An organization you delete is archived: its data stays stored, out of reach of its members, until the service administrator erases it for good.
• Password account whose e-mail was never verified: deleted after 7 days.
• Feedback: deleted 90 days after it is closed, and at the latest 365 days after it is sent, or with your account if it is deleted earlier.
• Run history: 7 days on the Basic plan, 30 days on Starter and 90 days on Pro, then deleted automatically.
• Sign-in session: 30 days, extended while you use the service; deleted when you log out.
• E-mail verification link: 24 hours. Password reset link: 1 hour.
• Invitation to join an organization: 7 days.
• API token: until you revoke it or delete your account.
• Expired sessions, links and invitations: deleted automatically every hour.
• Error logs: a limited period, as needed for troubleshooting.
• Audit trail: 365 days (one year, decree no. 2011-219), then deleted automatically. It is kept after the account is deleted: your e-mail address is then replaced by a pseudonym, while the IP address, browser and dates are kept until the end of that period.
• Test environment developers.cronhound.eu: access requires a Cronhound account and a sandbox key. The environment keeps only an opaque reference to that account, with no e-mail address and no readable identifier. The test data of that account (organization, project, jobs and history) is deleted automatically 24 hours after creation; the next call starts an empty one. The audit trail of this environment, which holds the IP address and browser, follows the period stated above.
• Audience measurement: raw data kept for 13 months at most, then deleted; only aggregated, anonymous statistics are kept beyond that.
• Invoices: kept for 10 years (article L123-22 of the French Commercial Code), then deleted automatically along with their PDF. Once an invoice is issued, the billing details copied onto it are erased; the register keeps its number, dates, amounts and status. The billing profile is kept as long as the organization exists.

5. Recipients and processors

• Authorized staff of the publisher, to operate and support the service.
• The host: OVH SAS (OVHcloud), on a server located in France.
• The provider that sends service e-mails: Not provided.
• Google, only if you choose “Continue with Google”. This sign-in is optional: you can always use an e-mail address and a password. If you choose it, you do so at your own responsibility, and what Google does with your data falls under its own terms and privacy policy. Google authenticates you and sends us your name, e-mail and Google identifier. Google LLC (United States) is certified under the EU-US Data Privacy Framework, which the European Commission found adequate (decision of 10 July 2023).
• Payment: Mollie B.V. (Netherlands), our payment provider. It receives the e-mail address of your account, your organization identifier and the payment details you enter with it. Cronhound does not store card data.
• Members of your organizations see your name, e-mail and role; members of a project see its jobs, including their headers.
• The servers you target receive the requests you configure.

Your data is hosted in France. If a processor handles data outside the European Union, the transfer is covered by an adequacy decision or by the European Commission’s standard contractual clauses.

6. Your rights

You have the rights of access, rectification, erasure, restriction of processing, portability and objection (GDPR articles 15 to 21), and the right to give instructions on what happens to your data after your death (article 85 of the French “Informatique et Libertés” law).

• On the Account page: “Export my data” (access and portability, JSON file, which includes the audit trail events you performed), “Delete my account” (erasure, subject to the audit trail reservation in section 4), and editing your name and language (rectification).
• Announcement e-mails: withdraw your consent at any time, from the Account page (“Email me about new announcements”) or with the unsubscribe link in each e-mail, without signing in. Withdrawal does not undo the e-mails already sent.
• For any other request: technique@cronhound.eu. We answer within one month (GDPR article 12) and may ask for proof of identity when there is reasonable doubt.

7. Complaint to the CNIL

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL): www.cnil.fr.

8. Security

• Passwords hashed with Argon2id; session tokens, API tokens and invitation links stored only as hashes.
• Request and alert channel configuration encrypted at rest with AES-256-GCM.
• HttpOnly session cookie, cross-site request forgery (CSRF) protection and origin checks.
• Rate limiting and blocking of private or internal network targets.
• Access control by organization, project and role.

9. Cookies and local storage

• ch_session: keeps you signed in (30 days at most).
• ch_csrf: protects your actions against request forgery (same lifetime).
• ch_oauth: only while signing in with Google, to secure the exchange (10 minutes).
• Browser local storage: the language (cronhound-locale) and theme (cronhound-theme) you choose.
• mtm_consent_removed: only if you object to audience measurement (section 10), to remember that choice (13 months).

These cookies and this storage are strictly necessary for the service you ask for or to remember your objection, so they are exempt from consent (article 82 of the French “Informatique et Libertés” law). Cronhound uses no analytics, advertising or tracking cookies. The only third-party resource it loads is the measurement script, Matomo, served from a measurement subdomain dedicated to Cronhound, which sets no measurement cookie. That is why no consent banner is shown.

10. Audience measurement

To know how often the public pages of the site are visited and to improve them, we use Matomo, a free software tool that we host ourselves in France, on a dedicated measurement subdomain of Cronhound, separate from the site and the application. It is configured to be exempt from consent under the CNIL’s guidelines:

• Only the public pages are measured (home, comparison, legal pages, sign-in, sign-up and password pages). The signed-in area, invitations and payment are never measured, and the reported address carries no parameter or token.
• No measurement cookie is set and no identifier is stored in your browser.
• Your IP address is anonymized (the last 2 bytes are masked) before it is stored.
• No tracking across sites, no user identifier, no combination with other data (your account in particular) and no data shared with third parties.
• Raw data is kept for 13 months at most, then deleted; only aggregated, anonymous statistics are kept beyond that.
• Legal basis: the publisher’s legitimate interest in measuring visits to its site (GDPR article 6(1)(f)); this measurement is exempt from consent (article 82 of the French “Informatique et Libertés” law).
• If your browser sends the “Do Not Track” signal, nothing is measured.

You can object at any time with the button below. Your objection is remembered in the mtm_consent_removed cookie for 13 months, in this browser; if you clear your cookies, you will need to make this choice again.

11. Changes to this policy

We may update this policy. The date of the last update is shown at the top of the page; you will be informed of any significant change by e-mail or in the service.