Privacy Policy — Cassian

Data controller

Octocube — Olivier Caetano, sole trader, 1A rue des Chaneaux, 63200 Marsat, France. SIREN 451 182 596. Publisher of the Cassian application. Contact: contact@octocube.fr.

Data processed

• Account — email address, account identifier and account creation date. Your password is securely managed by our authentication provider; we do not have access to your password in plain text.
• Content you submit — information relating to real estate properties, figures, text, documents and files that you provide when using the analysis features. Depending on the feature used, some data is processed by our services or stored locally on your device.
• Technical data — error logs, application version, operating system and device type, used to operate the service and resolve technical issues.
• Support communications — the content of messages you send to us and the email address used.

Cassian does not request access to the precise location of your device. Addresses and cities processed by the application are only those you enter or those contained in documents you submit. The application does not collect your contacts, does not use advertising identifiers for profiling or advertising purposes, and does not perform advertising profiling.

Purposes and legal bases

• Create and manage your account and provide analysis features — performance of a contract.
• Ensure security, stability and troubleshooting — legitimate interest.
• Respond to support requests — performance of a contract and legitimate interest.
• Comply with legal, accounting and tax obligations — legal obligation.

Processing by AI models

Cassian analyses use OpenAI API services. Content you submit may be transmitted to OpenAI for processing and then returned in the form of an analysis within the application.

By default, data submitted through the API is not used by OpenAI to train or improve its models unless the publisher voluntarily enables data sharing.

Unless a specific zero-retention configuration applies, OpenAI indicates that certain API inputs and outputs may be retained for up to 30 days to provide the service and detect abuse.

Recipients and service providers

Data is not sold, rented or transferred for advertising purposes. It may be accessed by the publisher and by technical service providers strictly necessary for the operation of the service:

• Hosting, database and backend functions — Supabase
• Authentication — Supabase Auth
• Language models and analysis generation — OpenAI
• Technical logging and storage of reports — Supabase
• Sending emails related to reports and support — Resend

Where certain providers process data outside the European Economic Area, transfers are handled in accordance with applicable regulations, including through appropriate contractual safeguards where required.

Data retention

• Account and associated data: retained for the duration of use of the service and until the account is deleted or deletion is requested by the user, subject to applicable legal retention obligations.
• After a deletion request: processed as soon as reasonably possible and no later than 30 days.
• Technical logs and support communications: retained for as long as necessary to process the request and monitor technical issues, then deleted.

Certain data may be retained for longer where required by law or where necessary for the establishment, exercise or defence of legal claims.

Security

Communications between the application and our services are encrypted in transit using HTTPS/TLS. Administrative access is restricted to the publisher and protected by authentication and access-control mechanisms. Data is hosted by professional service providers that apply their own security measures.

Your rights

You have rights of access, rectification, erasure, restriction, objection and data portability in relation to your personal data. These rights may be exercised from within the application or by email: contact@octocube.fr.

Account and associated data deletion is described step by step on a dedicated page.

You may also lodge a complaint with the French data protection authority, the CNIL (opens in a new tab).

Minors

Cassian is intended for professional or investment-related use and is not intended for persons under the age of 18.

Scope of analyses

Cassian provides automated analyses and recommendations intended to assist users in assessing real estate projects. This information does not replace personalised advice provided by a regulated professional, particularly in financial, legal, tax or banking matters. Users remain solely responsible for their investment decisions.