Privacy Policy

01. Account data

• When we create your account we store your name and email address, and send you an invitation email.
• Your password is never stored in readable form — only a salted, hash-based (PBKDF2) version is kept and verified at sign-in.
• If you enable two-factor authentication we store the generated secret needed to verify your codes. Account settings also let you add a recovery email.

02. Sign-in and security data

• To keep you signed in we set a single essential, HTTP-only session cookie. It contains a random token; the server stores only its hash, so it is useless if intercepted.
• For security auditing we record the IP address and time of each sign-in against the session, visible to you under Settings → Sessions, where you can also sign out remotely.

03. Project data

• Your contact record (name, email, project details) and its pipeline status.
• Documents we share with you — proposals, quotes, invoices, deliverables — stored in private storage and served only to your signed-in session, with a download counter and the date you first viewed each document.
• The approvals, rejections, and feedback you record on documents.
• Internal notes our team writes about your project (visible to Optimo Atelier only).

04. Email

We use your email address for transactional messages only: your invitation, sign-in help, password resets, and notifications when a document is ready for your review. These are sent through our email delivery provider on our behalf; we do not use portal emails for marketing and we do not sell or share your data with advertisers.

05. Your rights

You can view much of this data in your account settings. To request a copy, a correction, or deletion of your data, or to have your account removed, email contact@optimoatelier.com. If you are in the EEA or the UK, you may also complain to your local data-protection authority.