Privacy policy
Version in force: 2026-08-24
Data controller
The data controller is Simon Dupont EI, 21 rue Ambroise Paré, appartement 3, 64200 Biarritz, France, SIREN 822 418 026. No data protection officer is appointed: this structure is not required to appoint one. Your requests are handled directly by the publisher, at the address given under “Your rights”.
Data processed
Identity and account (email address, display name, job title, time zone, profile picture), organisation memberships and permissions, spec contributions, signatures, and the journal of your actions. A counted breakdown is available at any time from your privacy space, and that is exactly what the export returns.
Purposes
Providing the service, maintaining traceability of specs and approvals, and preserving evidence of binding acts (signature, freezing, merge, export, permission change).
Retention
Non-binding journal entries are purged automatically after a rolling 24 months. Binding acts are kept for the legal period: they are evidence, and rewriting them would strip them of value.
Your rights
You can export your data at any time and request deletion of your account. Deletion is deferred by 30 days and can be cancelled during that period. It proceeds by anonymisation, never by rewriting traces: your approvals and journal entries remain, detached from your identity.
To exercise these rights or ask a question about your personal data, write to dpo@spegit.com.
Processors
Supabase (authentication, database, storage) and the code hosting provider your organisation authorised (GitHub or GitLab), which receives your spec content since it is the repository.
Publisher access
To operate and support the service, the publisher has restricted access to your organisation's administrative data: its identity, its members and their roles, its projects, its repository connections, its subscription and its audit log. This access never reaches the content of your specs, your drafts, your comments or your attachments. Every consultation is recorded in your organisation's audit log, where your administrators can review it. The publisher always acts under their own name: no feature lets them act under the identity of one of your members.
Contact requests
A request sent from the website or from the product keeps the name, email address and message you entered, the date, and, if you were signed in, the account and organisation you wrote from. No browsing data is attached: no IP address, no browser fingerprint. These requests are kept for 24 months, then deleted.
Trackers
No non-essential tracker is set: no analytics, no advertising, no sharing with third parties for those purposes. The only cookies used are necessary for operation (session, language, display preferences). There is therefore no consent to collect.
Contact
Any question about this service is sent through the contact form. It keeps a record of your request on the publisher’s side, which a message sent from a mail client does not.