Privacy policy

1. Data controller

The controller of your personal data is:

• MFT Andorra LLC
• 111 NE 1st Street, 8th Floor, Suite 89198, Miami, FL 33132, USA
• Email: info@mft-andorra.com

2. Data collected

2.1 Account data

• Email address
• Password (stored as a bcrypt hash on the Supabase server, never in clear)
• Session tokens

2.2 Payment data

Bank details are collected and stored directly by our payment provider Stripe Inc. MFT Andorra LLC never has access to full card numbers. We only keep a Stripe customer identifier, the payment history and the subscription status.

2.3 Backup data (encrypted)

The files, bookmarks, software lists and passwords you choose to back up are encrypted on your computer (AES-256-GCM) with a key derived from your password via Argon2id. Only encrypted blobs are sent to our servers. We cannot under any circumstances decrypt this data.

2.4 Technical data

• IP address (server logs, 30-day retention)
• Browser type, operating system (server logs)
• Date of last automatic backup

3. Purposes and legal bases

4. Retention period

• Account data: for the entire duration of the subscription and up to 3 years after the last connection (then deletion).
• Backup data: for the entire duration of the active subscription. In case of payment cessation, 30 days in read-only mode, then permanent deletion.
• Billing data: 10 years (accounting obligation).
• Technical logs: 30 days.

5. Processors and recipients

To provide our service, we use the following processors, all bound by data processing agreements (DPA) compliant with GDPR:

6. Transfers outside the EU

Since some of our processors are established in the United States or elsewhere, data may be transferred outside the European Economic Area. These transfers are framed by the Standard Contractual Clauses of the European Commission or by other transfer mechanisms provided for by GDPR.

Note: stored files are encrypted with a key that only you possess. Even when transferred outside the EU, their content remains unreadable to anyone but you.

7. Cookies

The migra-pc.com site uses only cookies essential to the operation of the service (user session management, security). No advertising tracking or behavioral analysis cookies are used.

These essential cookies do not require your prior consent, in accordance with article 82 of the French Data Protection Act (Informatique et Libertés).

8. Your rights

In accordance with GDPR and the French Data Protection Act, you have the following rights over your personal data:

• Right of access (to know what data we process about you)
• Right of rectification (correct inaccurate data)
• Right to erasure (request deletion)
• Right to portability (receive your data in a structured format)
• Right to object to processing
• Right to restriction of processing
• Right to withdraw your consent at any time

To exercise these rights, contact us at info@mft-andorra.com specifying the email address of your account. We will respond within a maximum of 30 days.