Privacy Policy
Version dated 2026-09-27
This policy describes how SOMEPASS processes personal data for SomePass at https://www.somepass.com, workspace subdomains and companion applications. We do not sell personal data or use advertising trackers, retargeting or optional analytics cookies. Necessary session and security technologies support access and service protection.
1. Identity and contact
The provider is SOMEPASS, 58 rue Lycette Darsonval, 50000 Saint-Lô, France. Use the privacy contact form for questions or rights requests. Our legal information page contains the company’s registration details.
SOMEPASS · SAS (société par actions simplifiée) · SIREN 837 519 404 · SIRET 837 519 404 00029 · RCS Coutances 837 519 404
2. Controller and processor roles
We act as controller for our public website, direct contacts, account administration, billing, contractual evidence and service security. For workspace data processed on an Owner’s instructions, that Owner is the Controller and we are the Processor. The DPA defines this relationship. Roles depend on the actual processing and authority, not merely on an email address or an administrator label.
Identity services provide sign-in, access management, tenant membership, domain association and OAuth/OIDC application configuration. Administrators are responsible for connected applications, redirect addresses and requested permissions. The provider acts as controller for its own account security and authentication records, and as processor for tenant instructions.
3. Data and sources
Account data includes names, email addresses, usernames, roles, workspace affiliation and identifiers supplied by users, administrators or selected identity providers. Billing data includes subscriber and billing contacts, plan, invoices and payment status; the payment provider handles payment credentials. Support data includes messages and contact details. Technical data includes IP addresses, browser/device information, request timestamps and security logs. Signup contractual evidence includes accepted versions, language, date and the accepting account identifier.
Tenant data includes members, roles, domain verification, identity-provider references, application users, OAuth/OIDC client metadata, permissions, consent records and authorization events.
The service is not intended to collect special categories of personal data. Avoid entering sensitive information unless strictly necessary and lawful. Required fields are indicated in forms; without them we may be unable to create an account, provide a requested feature or respond. Optional fields can be left blank.
4. Purposes and legal bases
For our own processing, providing the subscribed service and handling pre-contract enquiries rely on the contract or steps taken at your request. Security, abuse prevention, reliability and proportionate operational support rely on our legitimate interest in operating a secure service. Accounting and legal duties rely on applicable legal obligations. Where a feature legally requires consent, it is requested separately and can be withdrawn. Workspace processing follows the Controller’s instructions and the legal basis it determines.
5. Sessions, sign-in and mobile applications
We use cookies and similar technologies necessary for sessions, sign-in and security. We do not set optional advertising or analytics cookies. Blocking necessary technologies can prevent sign-in or security features from working. If optional trackers are introduced, their use will be assessed and consent requested where required before activation.
If you choose Apple, Google, Microsoft, LinkedIn, SomePass or an institutional identity provider, we exchange the identifiers, email addresses, profile attributes and security tokens needed for sign-in. That provider also processes data under its own policy. Apple Private Relay is accepted; a separate academic address may be verified when needed to establish an institution relationship.
A companion application stores session credentials in encrypted device storage. Session metadata can include operating system, application version, locale and a device label. Biometric unlocking is performed by the operating system; we do not receive fingerprint or face templates. Access tokens normally last one hour and refresh tokens 30 days, unless revoked sooner.
6. Recipients, optional AI and transfers
Recipients include providers needed for hosting, email delivery and service protection, authorized administrators and members, and optional integration providers you select. For education, authorized inter-institution activities can share necessary data with invited partners. Data may also be disclosed to comply with lawful requirements. Cloudflare provides DNS, CDN and security and processes traffic-related data such as IP addresses, headers and security signals.
Where Stripe is offered at checkout, Stripe receives the billing and payment information needed to process the transaction, manage the subscription and prevent fraud. Its role depends on the processing: it may process data on instructions or for its own regulatory and fraud-prevention duties. Its privacy policy explains these roles and international processing.
Core hosting is in France. Some providers operate globally, including outside the EEA. Where required, transfers use an adequacy decision or Standard Contractual Clauses and additional safeguards. The DPA identifies our workspace subprocessors. You can request information about the applicable destinations, safeguards and a copy of the relevant transfer arrangements through the privacy form.
7. Retention and closure
Account and workspace records remain available for the active service and according to the Controller’s instructions. On closure, data needed for an agreed return is retained during that process, then deleted according to the DPA. Data required by a specific legal duty or a documented dispute is restricted to that purpose until the applicable obligation or limitation period ends. Contractual acceptance records follow those evidence requirements.
Accounting records follow the statutory retention period applicable to the transaction. Support records are retained for the handling of the request and any documented follow-up or dispute; security logs follow the operational rotation settings, with restricted preservation of records needed to investigate an incident or meet a legal duty. For procurement or a rights request, contact us to obtain the schedule applicable to your workspace, including return formats, deletion steps and backup rotation.
Protected backups follow the documented rotation cycle and are isolated from ordinary use. Deletion instructions are reapplied if data is restored. Mobile session and device-cache durations are described above; they do not define server-side workspace retention.
8. Your rights and complaints
Depending on the processing and applicable law, you can request access, rectification, erasure, restriction, portability or object to processing. Consent can be withdrawn without affecting earlier lawful processing. Contact the workspace Controller for processing it determines; we assist it under the DPA. For our own processing, use our privacy form. We may request proportionate identity verification to protect other users.
You may lodge a complaint with the CNIL in France or the competent supervisory authority, including in the EEA country where you live or work. This right does not require you to contact us first.