Privatumo politika

This Privacy Policy explains how NEXT BP processes personal data when you visit blast-audit.com or use Blast Audit: the Excel add-in, the web dashboard, the connectors to cloud storage, the MCP server, the engagement agent, the financial statement review, the PBC request lists, analysis projects and the Blast Audit Academy (the "Software"). It is the information required by Articles 13 and 14 of the General Data Protection Regulation (GDPR).

---

1. Who We Are

The controller is NEXT BP, a French simplified joint-stock company (SAS) with a share capital of €100, registered with the Paris Trade and Companies Register under number 920 753 233, whose registered office is at 127 rue de la Tour, 75016 Paris, France.

For any question about your personal data or to exercise your rights, write to privacy [at] blast-audit.com. NEXT BP has not appointed a data protection officer; this address reaches the person in charge of data protection at NEXT BP.

The Software is intended for professionals. It is not intended for children.

---

2. Controller or Processor

NEXT BP processes personal data in two capacities.

• As controller, for the data it needs to run its own business: visitors to the website, accounts and authentication of users, billing, support, security, product analytics, prospecting and sales relations. This Policy describes these processing operations.
• As processor, for the documents and content that audit and accounting firms submit to the Software (for example bank statements, invoices, contracts or payroll records) and the personal data they contain. The firm that uses Blast Audit is the controller of these data and decides what it submits. NEXT BP processes them only on that firm's instructions, under the Data Processing Agreement (DPA).
• As processor, also, for the consultation of usage per member when your organisation turns on the setting described in Section 12. Your organisation is the controller of that consultation. NEXT BP presents and exports the indicators on that instruction (Section 2.5 of the DPA). That consultation is not the product analytics for which NEXT BP is controller.

If your data appear in a document that a firm has submitted to Blast Audit, or in a file sent to a firm through a PBC request list, contact that firm to exercise your rights. If you write to us, we forward your request to the firm concerned.

If a firm has sent you requests for documents through a PBC request list, that firm is the controller of the requests, your e-mail address, your language, your messages, the reasons you give, your files, the results of the AI checks on them and the record of your actions on the list. Contact it to exercise your rights. If you write to us, we forward your request to it. NEXT BP is the controller of the record that NEXT BP itself keeps to limit abuse of the link, and of its technical logs (Section 4).

---

3. Data We Collect and Where It Comes From

• Identity and account data: name, e-mail address, organisation, role, language, identifiers from your identity provider when your organisation uses single sign-on, sign-in dates.
• Billing data: name of the billing contact, company details, address, VAT number, subscription, invoices and payment status. Card details are entered on Stripe's pages; we never receive the full card number.
• Usage data: features used, number of pages processed, AI credits consumed, technical identifiers, browser and device data, IP address, pages viewed. Per-member detail (name, e-mail address, role, indicators of the view) is described in Section 12. It is not sent to the analytics tool.
• Support and communications: messages, e-mails and attachments you send us, and the e-mails we send you.
• Prospecting data: what you enter in our contact and demo forms (name, professional e-mail address, phone number, company, job title, team size, message).
• Connector data: when you connect Google Drive or Microsoft 365, the access tokens and the account identifier that the provider returns.
• Content submitted to the Software: documents, extracted values, instructions, voice input. NEXT BP processes this content as processor (Section 2).

Most of these data come from you. Some come from other sources:

• your organisation's administrator, who invites you and assigns your role;
• your organisation's identity provider, through WorkOS, when single sign-on is used;
• Stripe, for the status of payments;
• Google or Microsoft, when you connect a connector.

---

4. Purposes, Legal Bases and Retention

Where we rely on our legitimate interest, you can object at any time (Section 8).

---

5. Recipients

Personal data are accessible only to the NEXT BP personnel who need them. We share them with the following service providers, which act on our instructions:

• Microsoft (Microsoft Ireland Operations Limited): hosting on Microsoft Azure in France; Azure OpenAI (EU Data Zone, resource in Sweden) and Azure AI Content Understanding for document analysis and the advanced reading of scanned pages (some scanned pages may be read by NEXT BP's reader, which we operate ourselves within our Microsoft Azure hosting; except when your organisation uses its own Azure key, Azure reads each scanned page for which the result you receive does not come from this reader, including pages re-read automatically or on request, all pages of an organisation that is not in the rollout of this reader, all pages in a region where it is not available and all pages sent by an add-in version that does not support it, and may also read pages that this reader reads, in particular while it is being evaluated); the Azure AI service in the EU Data Zone (resource in Sweden), which checks the engagement agent's and the Excel agent's results tables; Azure AI Speech for voice input; Azure Communication Services for transactional e-mail, including our support replies;
• Cloudflare: hosting of the website and the dashboard, receipt of support e-mail sent to reply.blast-audit.com;
• Google (Google Workspace): NEXT BP's e-mail, including e-mail sent to support [at] blast-audit.com, which it forwards to reply.blast-audit.com;
• WorkOS: authentication and single sign-on;
• Stripe: payment and invoicing;
• PostHog: product analytics and audience measurement. It does not receive per-member detail. It receives, depending on the surface, the events in Section 4: billing, attempts to use AI chat without access and trial limits reached, metadata of each call to an AI model, operated by Microsoft (Azure OpenAI service) or by a provider chosen by your organisation (technical identifiers, tokens, duration, status, cost), e-mail metrics (including spam reports, subscriptions and unsubscriptions), OCR metrics and document-agent metrics (including model names and the number of model calls), feature-flag evaluations, usage events from the Excel add-in (actions in the product, ratings of the assistant's answers with the session and message identifiers, credits and response time, tool failures with the tool name and the cause, language, add-in version, Excel host and platform and, for the detection and import of DataSnipper workbooks, error code, operation, missing technical requirement, numbers of files and snips, with no file name or content) and from the administration console (pages viewed, access refusals with the identifier of the account that tried to sign in, whether the account is an administrator, calls to the API with method, status and duration, navigation performance), survey responses, and session recording of visitors who are not signed in and who have consented;
• Sentry: error monitoring;
• Customer.io: service e-mails linked to the account and the subscription;
• Exa: web search proposed by the Excel agent, only when you approve the search query.

When your organisation uses its own Azure key, every scanned page is read by the advanced reading, with that key. For those reads, Microsoft acts under your organisation's Azure contract and on its instructions, not ours (Section 5.7 of the DPA).

The location of each provider and the safeguards for transfers are listed in Annex 3 of the Data Processing Agreement, which is our dated sub-processor list.

We may also disclose data to public authorities when the law requires it, to our professional advisers (lawyers, auditors) bound by confidentiality, and to an acquirer in the event of a merger or sale of the business, after informing you.

We do not sell personal data.

---

6. Transfers Outside the European Economic Area

We host our databases and files in the European Union. Some providers are established in the United States or may access data from there: Cloudflare, Google, Stripe, WorkOS, Sentry, Customer.io, PostHog and Exa. These transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework when the recipient is certified (Cloudflare, Google, Stripe, PostHog, Sentry, Customer.io), and on the Standard Contractual Clauses adopted by the Commission (Decision (EU) 2021/914) in the other cases or in addition. Microsoft providers (Azure hosting, Azure OpenAI, the Azure AI service in the EU Data Zone that checks the engagement agent's and the Excel agent's results tables, Azure AI Content Understanding, Azure AI Speech and Azure Communication Services) process data in the European Union. Microsoft personnel located outside the EU Data Boundary may access that data remotely, as necessary to operate, troubleshoot, support and secure the services: this transfer relies on the Standard Contractual Clauses adopted by the Commission (Decision (EU) 2021/914, Module 3, processor to processor) between Microsoft Ireland Operations Limited and Microsoft Corporation, and on the EU-U.S. Data Privacy Framework, under which Microsoft Corporation is certified. You can obtain a copy of these safeguards by writing to privacy [at] blast-audit.com.

---

7. Data Retention

The retention period of each category of data is given in the table in Section 4. At the end of the period, data are deleted or anonymised. Database backups are kept 7 days, so a deleted item disappears from backups within 7 days. Raw usage events and daily aggregates per user are kept for 13 months, plus one day of technical margin, then deleted. Records of AI credits and of OCR pages are billing records: they keep the user's identifier for billing, refunds and tracking of the credit period. The per-member view reads them only for the period consulted (28 days to 13 months). Records of the execution of the artificial-intelligence features (date, feature, status, consumption, technical identifiers, storage paths, progress and error messages, technical metadata) also keep the user's identifier, with no 13-month limit; the per-member view reads them only for the period consulted. Organisation totals without a personal identifier are kept. The detail is in Section 4 and in Section 2.5 of the DPA.

For document content that NEXT BP processes as processor, the periods are set in Annex 1 of the Data Processing Agreement. In short:

• content submitted for OCR or document analysis is deleted from NEXT BP's systems at most 24 hours after upload; the copies that Microsoft temporarily stores for abuse monitoring are not covered (Section 10);
• the Excel agent works on the documents saved in your workbook: of those documents, only their names, the pages the agent reads and the page numbers its checks look up reach our servers; the content of an Excel agent conversation is deleted from NEXT BP's systems at most 24 hours after it reaches them, and database backups keep it up to 7 more days; the copies that Microsoft temporarily stores for abuse monitoring are not covered (Section 10);
• the content of an engagement of the engagement agent is kept while the engagement is open and deleted from NEXT BP's systems between 29 and 30 days after it is closed, by a daily job, or shortly after if processing still under way holds the deletion back; an engagement with no human activity for 6 months triggers a warning by e-mail, then is closed 30 days later if it has had no human activity since; the copies that Microsoft temporarily stores for abuse monitoring are not covered (Section 10);
• the content of a financial statement review is kept while the review is open and deleted between 29 and 30 days after it is closed, by a daily job; if processing still under way holds the deletion back, a later run completes it, shortly after 30 days; a review with no human activity for 6 months triggers a warning by e-mail and is closed if no human activity occurs in the following 30 days; the copies that Microsoft temporarily stores for abuse monitoring are not covered (Section 10);
• the content of a PBC request list (the requests, the recipients' e-mail addresses and languages, the record of their actions, their messages, the reasons they give when they have nothing to send, their files and the results of the AI checks) is kept while the list is open and deleted between 29 and 30 days after it is closed; a list with no human activity for 6 months triggers a warning by e-mail and is closed if no human activity occurs in the following 30 days; files copied into an engagement, with the note of their origin (reference and title of the request), follow that engagement's retention; files imported into a workbook stay in that workbook;
• the content of an analysis project is kept while the project is open and deleted from NEXT BP's systems between 29 and 30 days after it is closed; the copies that Microsoft temporarily stores for abuse monitoring are not covered (Section 10); a project without human activity for 12 months triggers a warning by e-mail, then is closed 30 days later if it has had no human activity since;
• operational logs, which contain no document content, are kept 30 days.

---

8. Your Rights

You have the right of access, rectification and erasure, the right to restrict processing, the right to data portability, and the right to object to processing based on our legitimate interest, including prospecting, which you can stop at any time without giving a reason. Where processing is based on your consent, you can withdraw it at any time; for cookies, use the Cookie settings link at the bottom of every page. Under French law, you can also give instructions on what happens to your data after your death.

To exercise these rights, write to privacy [at] blast-audit.com. We answer within one month; this period may be extended by two months for complex requests, in which case we tell you. We may ask for information to confirm your identity.

You can lodge a complaint with the French data protection authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr), or with the authority of the Member State where you live or work.

---

9. Mandatory and Optional Data

Your name, e-mail address and organisation are required to create an account; without them, we cannot give you access to the Software. Billing data are required to take out a paid subscription. In our forms, required fields are marked; the other fields are optional. Accepting audience measurement cookies is optional and has no effect on access to the website. The cookieless audience measurement of the website and the dashboard, described in Section 4, takes place before that choice and if you refuse; it is not linked to your account.

---

10. Artificial Intelligence and Automated Decisions

• We do not use your data or the content you submit to train, fine-tune or improve artificial intelligence models. Under its contract, our AI provider, Microsoft, does not use that content to train generative AI foundation models without our documented instructions, and we give no such instructions.
• If your organisation saves its own API key for another AI or OCR provider, the requests concerned are sent to that provider under the contract your organisation has with it; that provider is not our processor (Section 5.7 of the DPA).
• Requests to Azure OpenAI are sent with the store:false parameter: the service does not keep them for later retrieval, subject only to the abuse monitoring described below.
• Microsoft temporarily stores all requests sent to Azure OpenAI and all responses, to monitor for and prevent abusive or harmful uses or outputs of the service (abuse monitoring). Microsoft's contract sets no duration for this storage. Only data that has triggered its automated systems may be reviewed by authorised Microsoft employees; for EU Data Boundary deployments, those employees are located in the European Economic Area. Microsoft's terms (Privacy & Security Terms) also allow its personnel located outside the EU Data Boundary to access data processing systems inside it remotely, as necessary to operate, troubleshoot, support and secure its services. On 2 October 2026, NEXT BP applied to Microsoft for modified abuse monitoring, which removes this storage; Microsoft refused it on 4 October 2026. This storage therefore takes place. Microsoft may also temporarily store, for abuse monitoring, the requests sent to the Azure AI service in the EU Data Zone that checks results tables and that service's responses; Microsoft has given NEXT BP no commitment on how long it keeps them. For this service too, only data that triggered Microsoft's automated systems may be reviewed by authorized Microsoft employees, located in the European Economic Area for a deployment within the EU Data Boundary, and Microsoft does not use this content to train generative AI foundation models without our documented instructions, which we do not give. This service runs on a model version that Microsoft offers as a preview: Microsoft's terms for Azure previews apply to it, and Microsoft may apply to previews privacy and security measures that are lesser than or different from those described here, including other abuse-monitoring practices. Microsoft makes no EU Data Boundary commitment for previews: the Microsoft employees who review this service's data are therefore not necessarily located in the European Economic Area. For either service, Microsoft's contract only sets a latest deletion: after our Azure subscription ends, Microsoft keeps this data for ninety (90) days in a limited-function account, then deletes it within the following ninety (90) days. That subscription is ours: the end of your organisation's contract does not end it.
• The Software makes no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. Its results are suggestions that the user checks.

---

11. Cookies

The cookies and browser storage used by the website and the dashboard, their purpose, duration and how to change your choice are described in our Cookie Notice.

---

12. Specific Features

Voice input. When voice input is enabled, the add-in records your voice while you dictate and sends the audio to our servers, which have it transcribed by Azure AI Speech fast transcription in the Sweden Central region. Microsoft does not retain or store the audio (Microsoft documentation). NEXT BP does not keep the audio after transmitting it for transcription; the transcript is returned to you. This processing is carried out on behalf of your organisation, under the DPA.

Cloud storage connections (Google Drive, Microsoft 365). If you connect a Google Drive or Microsoft 365 account, Blast Audit reads your files so that you can choose and import documents from Excel. For Microsoft 365, we request the right to read your files (Files.Read.All) and, for a work account, the list of SharePoint sites you have access to (Sites.Read.All). We never create, modify, share or delete files in your cloud storage. The access tokens are encrypted and stored for your account, and deleted when you disconnect the account from the Blast Audit dashboard. Disconnecting does not withdraw the authorisation on the provider's side: you can also revoke it from the permissions page of your Google or Microsoft account. Imported files are passed to your browser without being stored on our servers; if you submit them for processing, the retention rules in Section 7 apply.

SharePoint search (Microsoft 365 Copilot). An administrator who has connected their work Microsoft 365 account can search their organisation's SharePoint from the dashboard. Their query is sent, with their connection, to the Microsoft 365 Copilot retrieval service (Microsoft Graph), which Microsoft operates under your organisation's Microsoft 365 contract. The dashboard displays at most 10 extracts, with their title and author. Our servers keep neither the query nor the extracts; our logs keep only the number of results.

Google user data. Blast Audit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We request the scope https://www.googleapis.com/auth/drive.file, which gives Blast Audit access only to the files you choose in the Google Drive picker. We use it only to download the file you select so that it can be displayed and linked to cells inside your own Excel workbook. We do not use Google user data for advertising, we do not sell it, we do not use it to train artificial intelligence or machine learning models, and we do not transfer it to third parties except as necessary to provide the feature (our hosting provider Microsoft Azure) or as required by law.

MCP server. If you connect an AI assistant of your choice (for example Claude or ChatGPT) to Blast Audit through the MCP server, you authorise it with your Blast Audit account through WorkOS. The assistant's requests and the results returned by your add-in pass through our servers: their content is masked 10 minutes after the request and the record is deleted after 30 days. So that the assistant can find your workbooks, the add-in reports to our servers the name and identifier of the workbooks that are open; this report is replaced each time the workbook is opened and deleted 90 days after the last report. The assistant you connect is operated by its own provider, under that provider's terms; it is not a NEXT BP sub-processor. We keep the list of connected assistants (name, date of last use) so that you can see and disconnect them.

Engagement agent. If your organisation uses the engagement agent, the documents imported into an engagement, the task log and the workpapers are kept on our servers while the engagement is open, so that the agent can work without Excel open, and deleted 30 days after the engagement is closed.

Financial statement review. If your organisation uses the financial statement review, our servers keep the content of each review while it is open, so that all its members find the same work: the documents imported and the text that OCR reads from them, the annotations, the comments and their replies, the checklists, the AI's answers with the passages they cite, the reviewers' verdicts and their notes, the analysis settings (including the dictionary and the ignore list of the language check) and the findings sent to Excel. For those findings, only the last 10 sets of findings and the last 10 checklist sheets are kept. When the AI answers a checklist, our servers send the checklist's questions and the text of the statements' pages to Azure OpenAI; the copies that Microsoft keeps for abuse monitoring (Section 10) are not deleted with the review. The review keeps the list of its members, their access (read or full) and the member who added them. It also keeps, with the date, the member behind each act: the one who creates the review; the one who closes it; the one who adds or removes a document, or runs its reading again; the one who creates an annotation and the one who last modifies it; the one who creates a comment and the one who last modifies it; the author of each reply; the one who imports a checklist; the one who runs the AI on it; the one whose session records an answer of the AI; the author of each verdict; the last one who modifies the analysis settings; the one who sends findings to Excel or requests an export. Each comment and each reply shows the name or e-mail address of its author, and each verdict the name or e-mail address of the reviewer. The checklist sheets sent to Excel repeat these names or e-mail addresses, the reviewers' notes and the cited passages. A review with no human activity for 6 months triggers a warning by e-mail, sent to its creator if still a member and to the owners and administrators of your organisation; it is closed if no human activity occurs in the following 30 days. A closed review, with everything it keeps, is deleted from the live service between 29 and 30 days after it is closed, by a daily job; if processing still under way holds the deletion back, a later run completes it, so it may occur shortly after 30 days. Database backups are kept 7 days and deleted files stay recoverable for 7 days, so the last copies disappear within 7 days after the deletion. Until the deletion starts, a member with full access can click Reopen, which cancels the deletion. That member can also export the closed review: the export contains the documents' files and their prepared PDFs that are still kept, and a manifest that lists every document; the export contains neither the annotations, nor the comments, nor the checklists with their answers and verdicts, nor the analysis settings, nor the findings sent to Excel. A new export is refused when the deletion is due less than one day later; an export that is already ready can still be downloaded until the deletion.

PBC request lists. If your organisation uses PBC request lists, its members send requests for documents by e-mail to people at their clients or elsewhere. Each recipient opens a personal link, without an account. They can send files, withdraw a file they sent, write messages, say that they have nothing to send and why, choose their language, and hand a request to a colleague, who then becomes a recipient. The requests, the recipients' e-mail addresses and languages, the record of their actions (link opened, recorded at most once a day; file sent or withdrawn; message; request handed to a colleague; each with the date), their messages, the reasons they give, their files, the results of the AI checks where the organisation has set questions, and the member who sent each request are kept on our servers while the list is open. Closing a list ends every recipient's access, and the list is deleted between 29 and 30 days after it is closed. A list with no human activity for 6 months triggers a warning by e-mail, sent to its creator if still a member of the organisation and to the owners and administrators of the organisation; it is closed if no human activity occurs in the following 30 days. Files copied into an engagement, with the note of their origin (reference and title of the request), follow that engagement's retention. Files imported into a workbook follow the workbook. The firm is the controller of these data (Section 2). The page a recipient opens through the link has no audience measurement and no product analytics. To limit abuse, NEXT BP keeps, as controller, a keyed hash of the IP address, of the link token or of the recipient, depending on the action, with a request counter, and deletes it after 2 days (Section 4).

Analysis projects. If your organisation uses analysis projects, the data sources imported into a project, the datasets built from them, the cell ranges sent from Excel (workbook snapshots), the analysis journal and the scripts that ran, the results and the conversations with the project's assistant are kept on our servers, in the European Union, at the locations listed in Annex 2 of the DPA, while the project is open, and deleted between 29 and 30 days after it is closed. If nobody works in the project for 12 months, its creator, if still a member of your organisation, and the owners and administrators of your organisation receive a warning by e-mail; the project is closed 30 days later if it stayed idle. The analysis journal names the member who ran each step or approved a run proposed by the assistant. At each read, the assistant receives from the project only the names and columns of sources and datasets, row counts, totals and at most 20 sample rows; it also receives the members' messages and the history of its conversation, which may repeat those extracts. Nothing it proposes runs without the approval of a member with full access to the project; a member with read-only access cannot give it. A closed project can be exported while its deletion is due more than one day later; an export that is already ready can still be downloaded until the deletion.

Procedures and conventions of the agent. The procedures that your organisation writes for the engagement agent, their versions and the conversations used to write them are kept until the procedure is withdrawn; a version cited by an engagement task is kept until the last engagement that cites it is deleted. Where your organisation turns on conventions, the agent can retain, at your request, a way of working; a convention is kept until you or an administrator delete it, or until you leave the organisation, which deletes it.

Blast Audit Academy. If you follow the Blast Audit Academy, we record the lessons and paths you complete, with their date, and your answers to exercises and quizzes, with their score. The owners and administrators of your organisation see your progress. These data are processed on behalf of your organisation and deleted after you leave the organisation.

Usage per member. For each user, the Software records the date (the day, without the time) of the last activity over the last 13 months, whatever the period consulted, the number of active days, documents imported, snips, matching runs, OCR pages, runs of the artificial-intelligence features and credits consumed, in euros and as a share of the credits consumed by the organisation over the period. Last activity is the day of the last usage event: an action reported by the Excel add-in or a document import. Runs of the artificial-intelligence features and credits do not count towards it. Together with the name, e-mail address, technical account identifier, role, active-member status and whether the member holds a licence for the Excel add-in (yes or no), these indicators can be shown to the owners and administrators of your organisation if one of them turns the setting on. The setting is hidden by default. While it is hidden, the detail is refused. Turning it on records who did so and when. Only the last change to the setting is kept: each change replaces the previous one. This record is not deleted automatically when the account is closed. That person ticks that they have informed the members and consulted the CSE or the Betriebsrat where required. The usage of people who have left the organisation, and usage that is not linked to any member, is added up on a single "former members" line, with no name. That line is not anonymous: when only one person has left the organisation, it shows that person's totals. The period runs from 28 days to 13 months. A sheet for each member breaks the totals down by feature: number of events, runs, credits. The CSV export is produced in the browser. The per-user export on the Exports page follows the same rules and gives the same totals, with no row per day; it is produced on NEXT BP's servers and can be downloaded by owners and administrators for 30 days, then deleted. If the setting is turned off, files already produced can still be downloaded until they expire, 30 days after they were produced, and are then deleted.

The view does not contain the content or the name of documents. It contains no timeline, no score, no ranking and no measurement of working time.

For this consultation, your organisation is the controller. NEXT BP is its processor (Section 2.5 of the DPA). Raw usage events and daily aggregates per user are kept for 13 months, plus one day of technical margin; deletion takes place each day. Records of credits and of OCR pages are billing records (Section 2.3 of the DPA). They keep the user's identifier for billing, refunds and tracking of the credit period. The per-member view reads them only for the period consulted (28 days to 13 months). The credits shown per member are an indicator of the view. Records of the execution of the artificial-intelligence features (date, feature, status, consumption, technical identifiers, storage paths, progress and error messages, technical metadata) also keep the user's identifier, with no 13-month limit; the per-member view reads them only for the period consulted. Organisation totals, without a personal identifier, are kept. File names are removed from usage events. Backups disappear within 7 days.

This Policy is not the information your organisation must give you before turning the view on, and it is not the consultation of your representatives. To exercise your rights in relation to this consultation, contact your organisation. If you write to us, we forward your request to it. Per-member detail is not sent to the analytics tool.

Support. You can contact us through the support chat or by e-mail. Conversations and their attachments are stored on our servers, on Microsoft Azure in the European Union. When you have not read a reply from our team, we send it to you by e-mail through Azure Communication Services. Your replies to our support e-mails, and e-mails sent to reply.blast-audit.com, are received by Cloudflare's e-mail service and passed to our servers. E-mails sent to support [at] blast-audit.com first reach Google Workspace, our e-mail provider, which forwards them to reply.blast-audit.com.

---

13. Security

We protect personal data with technical and organisational measures appropriate to the risk: hosting in the European Union, encryption in transit (TLS) and at rest, separation of each organisation's data, restricted access and automatic deletion of document content. These measures are described in Annex 2 of the Data Processing Agreement. To report a vulnerability, see our security page.

---

14. Changes to this Policy

We may update this Policy to reflect a change in our processing or in the law. The date at the top shows the version in force. A version takes effect on publication; we inform users of any material change by e-mail or in the Software no later than that date.

---

15. Contact

privacy [at] blast-audit.com
NEXT BP, 127 rue de la Tour, 75016 Paris, France