Privacy policy

BEBRANDED, 34 avenue Chanzy, 93250 Villemomble, France, registered under SIREN 984 530 212, publishes and operates Dashly. For any question about this policy or to exercise your rights, write to legal@usedashly.com.

We have not appointed a Data Protection Officer, which our size and activity do not require. Requests are handled by the publication director.

This distinction governs everything below. Dashly is sold to agencies, and an agency uses it to hold information about its own clients.

• We are the controller for the data of the agencies that subscribe: their members' accounts, billing, support exchanges, and the technical logs of the site and the application. This policy describes that processing.
• We are a processor for everything an agency puts into Dashly about its clients and prospects — contacts, deals, tickets, time entries, documents, messages. The agency decides why and how that data is used; we only process it on the agency's instructions, to run the service. If you are the client of an agency that uses Dashly and want to exercise your rights, contact that agency: they hold the answers, and we will assist them.

We do not sell personal data, we do not rent mailing lists, and we take no automated decision producing legal effects concerning you.

Running the service requires a small set of providers. Each is bound by a data processing agreement, processes data only on our instructions, and appears here so you can see exactly who is involved.

Some services are only involved if an agency chooses to connect them — Google, Slack, WhatsApp, Webflow, Ahrefs, Fathom and the other integrations offered in Dashly. Nothing is sent to them unless that connection is made, and it can be revoked at any time from the application.

An agency can connect a Google account to Dashly. That connection is optional, it is granted account by account, and each feature asks separately for the access it needs — connecting Gmail does not open Drive, and refusing one does not disable the others. Every authorisation below is read-only but one: sending an email. That one is never automatic — a message leaves your address only when someone presses send in Dashly. Nothing else in your Google account is created, modified or deleted.

Dashly's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely:

• The data is used only to provide or improve the features described above — the features you can see in the application.
• It is never sold, and never transferred to anyone other than the providers listed in the previous section, and only so that the service can run — unless you ask us to, or the law compels us.
• It is never used for advertising, and never to build advertising profiles.
• No human reads it, except with your explicit consent, for security purposes such as investigating an abuse, to comply with the law, or once aggregated and anonymised for internal operations.
• It is never used to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models.

A connection is revocable at any time from the integrations settings in Dashly, and from your Google account at myaccount.google.com/permissions. Revoking deletes the stored access tokens and stops any further collection.

Two regimes, and the distinction follows from the two roles described above. What we collect as a controller expires on the schedule below, enforced automatically every night. What an agency stores about its own clients is on no countdown of ours: that data is theirs, we process it on their instructions, and it goes when they delete it or delete their agency.

Two deliberate exceptions. SEO audience measurements kept for an agency are retained without limit: their whole value is the year-over-year comparison, and a rolling window would destroy the only data that gets more valuable with age. And an unsubscribe request is kept indefinitely — letting one expire would mean writing again to someone who asked us not to.

The application and its database run in the European Union. Some of the providers listed above are established in the United States, which means personal data may be transferred there.

Those transfers rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, on the EU–US Data Privacy Framework, together with additional technical measures such as encryption in transit and at rest.

• Traffic is encrypted in transit (HTTPS) and data is encrypted at rest by our host.
• The database is backed up daily by our host, in the same European region as production, and the backups are encrypted at rest.
• Passwords are stored as salted hashes and are never readable by us. Two-factor authentication is available on every account.
• Access tokens for third-party integrations are encrypted before being written to the database.
• Each agency's workspace is isolated: a query carrying one agency's identity cannot reach another's rows.
• Access to production is limited to the people who need it, and administrative actions are logged.

Should a personal data breach be likely to result in a risk to your rights, we will notify the CNIL within 72 hours and inform you where the regulation requires it.

You may ask for access to your data, its rectification, its erasure or the restriction of its processing; you may object to processing based on our legitimate interest; and you may request portability of the data you provided.

Write to legal@usedashly.com. We answer within one month, extendable by two months for complex requests. We may ask for proof of identity where there is reasonable doubt.

If you consider your rights are not respected, you may lodge a complaint with the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

This policy may change as the service evolves. The date at the top of the page always reflects the version in force, and any substantial change is announced to account holders by email before it takes effect.