Politique de confidentialité
Dernière mise à jour :
Cette page n’est actuellement disponible qu’en anglais.
The short version
- We collect only what we need to run this website, reply to you and, if you sign up, run your Squario workspace.
- Visitor tracking and partner-referral tracking are used only if you agree. We also count website page requests without identifying visitors; rejecting analytics stops future counts.
- Squario’s workspace data is hosted in Switzerland.
- You can ask us for a copy of your data, or ask us to correct or delete it, at hello@squar.io.
Sur cette page
The Square Enterprises FZ-LLC, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates, Corporate Tax TRN 105393737900001 (“we”, “us”), runs the website squar.io and the Squario app at app.squar.io. We are the controller of the personal data described in this policy, except where section 5 explains that we act on behalf of our customers. For anything in this policy, contact us at hello@squar.io.
This policy explains which personal data we process when you visit squar.io in any language, when you contact us, and when you create and use a Squario account. Our cookie policy lists the cookies and similar technologies we use.
3.1 Delivering the website
Our hosting provider, Vercel, processes technical data such as your IP address, your browser type, the page you request and the time of the request, so that pages can be delivered and the site can be protected against abuse. Legal basis: our legitimate interest in running a secure website (Article 6(1)(f) GDPR).
3.2 Your display preferences
If you switch between light and dark mode, we remember your choice in a sq_theme cookie and in your browser’s local storage, so the website and the Squario app look the same. If you are signed in to the Squario app, the website reads the sq_presence cookie set by the app to show your name and a “Go to app” button. It contains your display name, your initials and the address of your profile picture, never your email address or an account ID. These are needed for features you use, so we don’t ask for consent for them.
3.3 Your cookie choice
Squario asks for your choices directly and remembers them in a sq_consent cookie. We save a consent receipt with a random identifier, decision and expiry times, language, policy version and category choices. Optional services activate only once the receipt is saved. Refusals apply immediately, even if the receipt must be retried when your connection returns. Legal basis: our legal obligation to obtain and document consent (Article 6(1)(c) GDPR).
3.4 Visitor analytics — only with your consent
If you accept statistics cookies, we use PostHog, on its EU cloud, to understand how the website is used: the pages you view, loading performance, responsiveness and visual stability (LCP, INP and CLS), when you leave a page, clicks on our main buttons, the page that referred you, and your browser and device type. Before anything is sent, we remove query parameters from recorded addresses, except campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and referral codes (via, ref). Performance measurements contain numeric LCP, INP and CLS values; detailed resource and element attribution is removed. On this website we don’t record your screen or use heatmaps. Website activity may be associated with your account when you use the app. If your browser sends a Do Not Track signal, analytics stay off. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time with “Cookie settings” in the footer.
3.5 Partner referrals — only with your consent
If you arrive through a partner’s link (for example an address containing ?via=) and accept marketing cookies, we load Rewardful, our partner-referral provider. It stores a rewardful.referral cookie so that, if you later sign up, the partner who referred you is credited and an eligible partner discount can be applied at checkout. When you sign up, the referral is linked to your account and your billing record. If you withdraw your consent, we delete this cookie. Legal basis: your consent (Article 6(1)(a) GDPR).
3.6 Contacting us
When you send the contact form, we receive your first and last name, email address, company, team size, message and the language of the page. The form sends this to our team’s inbox by email through Resend, our email provider, and we reply from our own mailbox. We use a hidden field and a timing check against spam; there is no CAPTCHA. Legal basis: our legitimate interest in answering you, or steps you ask us to take before entering into a contract (Article 6(1)(f) and (b) GDPR). The same applies when you email us directly.
3.7 Page-request statistics without visitor identification
We derive limited statistics from the requests needed to deliver this website, including before you make a cookie choice. Our server sends PostHog’s EU cloud only the public page category or approved page path, page language, broad device class (desktop or other, mobile, tablet), source category (direct or unknown, internal, search, social, external) and UTC day. Blog and partner detail paths are grouped rather than recorded individually. We do not send your IP address, cookies, browser string, full referring address, query parameters, exact visit time, account details or a visitor or session identifier. All requests share one synthetic counter identifier, and person profiles and geolocation are disabled. These counts cannot tell us who visited, recognise returning visitors or reconstruct individual journeys. We use no additional browser request, cookie, storage or fingerprint for this measurement. Rejecting analytics in Cookie settings also objects to future request counts; we honour earlier refusals, including expired ones, and Do Not Track or Global Privacy Control signals. The request that loaded the page before you objected may already have been counted and cannot be linked back to you. Legal basis: our legitimate interest in understanding aggregate demand for public pages and improving the website (Article 6(1)(f) GDPR), with personal information excluded from the measurement sent to PostHog.
4.1 Your account
To create an account we ask for your email address and a password, and we send you a one-time code by email. You can add your name and a profile picture and turn on two-factor authentication. We never store your password in readable form. Legal basis: our contract with you (Article 6(1)(b) GDPR).
4.2 Your workspace
Everything you and your team add to a workspace — for example companies, contacts, deals, scopes, projects, time entries and files — is stored in our database and file storage, hosted by Supabase in the AWS Zurich region, Switzerland. Each workspace is isolated from the others.
4.3 Billing
Payments are handled by Stripe. We receive what we need to manage your subscription, such as your plan, your number of members and your billing contact, but never your full card number. Legal basis: our contract with you and our accounting obligations (Article 6(1)(b) and (c) GDPR).
4.4 AI features
When you use Squaria or AI drafting in Scopify, your request and the workspace content needed to answer it are sent from our servers to OpenAI for processing. Squaria only works with data your role is allowed to see. If you add documents to your workspace’s knowledge base, their text is processed so that Squaria can search it.
4.5 Connections you choose
If you connect a Google or Microsoft calendar, we use Nylas to read your calendar events (read-only). If you connect a bank account, we use Powens, a European open-banking provider, to read your accounts and transactions (read-only). You can revoke a bank connection from the app.
4.6 Email and bot protection
We send account and product emails, such as sign-in codes and notifications, through Resend. We use Cloudflare Turnstile to protect sign-in and public forms against bots.
4.7 Product analytics in the app — only with your consent
If you accept statistics cookies in the app, we use PostHog on its EU cloud to understand how the app is used, including session replays in which all text and form inputs are masked. Legal basis: your consent (Article 6(1)(a) GDPR).
4.8 Links you share
Scopes, forms and public pages you share through share.squar.io can be opened by anyone with the link, within the protections you set, such as an access code or a password. When a client approves a scope, we record the time, IP address, browser and a signature hash as evidence of that approval.
4.9 Addresses and maps
When you enter an address or view a map in the app, we use MapTiler for address suggestions and CARTO for map tiles.
When your workspace contains personal data about other people — for example your clients’ contacts — you decide what goes in and why, and you are responsible for having a legal basis for it. We process that data on your behalf, following your instructions and our terms of use.
We use the following providers. They may only use personal data to provide their service to us.
| Provider | What they do for us | When |
|---|---|---|
| Vercel | Hosting of squar.io and of the app’s web interface | Always |
| Supabase (on AWS, Zurich region) | App database, file storage and consent receipts | When you use the app or save cookie choices |
| PostHog (EU cloud) | Website and app analytics | Only with your consent |
| Rewardful | Partner-referral tracking | Only with your consent |
| Resend | Email delivery (contact form, sign-in codes, notifications) | When you contact us or use the app |
| Stripe | Payments and subscription billing | When you subscribe |
| OpenAI | AI processing for Squaria and Scopify drafts | When you use AI features |
| Nylas | Calendar connections | Only if you connect a calendar |
| Powens | Bank connections | Only if you connect a bank account |
| Cloudflare (Turnstile) | Bot protection | When you sign in or submit a public form |
| MapTiler, CARTO | Address suggestions and map tiles | When you use address or map features |
Vercel
- What they do for us
- Hosting of squar.io and of the app’s web interface
- When
- Always
Supabase (on AWS, Zurich region)
- What they do for us
- App database, file storage and consent receipts
- When
- When you use the app or save cookie choices
PostHog (EU cloud)
- What they do for us
- Website and app analytics
- When
- Only with your consent
Rewardful
- What they do for us
- Partner-referral tracking
- When
- Only with your consent
Resend
- What they do for us
- Email delivery (contact form, sign-in codes, notifications)
- When
- When you contact us or use the app
Stripe
- What they do for us
- Payments and subscription billing
- When
- When you subscribe
OpenAI
- What they do for us
- AI processing for Squaria and Scopify drafts
- When
- When you use AI features
Nylas
- What they do for us
- Calendar connections
- When
- Only if you connect a calendar
Powens
- What they do for us
- Bank connections
- When
- Only if you connect a bank account
Cloudflare (Turnstile)
- What they do for us
- Bot protection
- When
- When you sign in or submit a public form
MapTiler, CARTO
- What they do for us
- Address suggestions and map tiles
- When
- When you use address or map features
Squario’s workspace database is hosted in Switzerland, which the European Commission recognises as providing an adequate level of data protection. Some of our providers are based outside the European Economic Area and Switzerland, or may access data from there. When personal data is transferred outside these areas, we rely on an adequacy decision (such as the EU–US Data Privacy Framework, where the provider is certified) or on the European Commission’s standard contractual clauses.
| Data | How long |
|---|---|
| Website request logs (Vercel) | For a short period set by our hosting provider, longer only if needed to investigate an incident |
Your cookie choice (sq_consent) | Up to 183 days, then we ask again |
| Consent receipts | 183 days after the choice expires, at most 366 days from the decision |
| Website analytics | Up to 24 months |
| Contact-form messages and emails | Up to 24 months after our last exchange, unless they become part of a customer relationship |
| Account and workspace data | As long as your account or workspace exists. When a workspace is deleted, its data and stored files are purged. |
| Billing records | As long as accounting and tax law requires |
Website request logs (Vercel)
- How long
- For a short period set by our hosting provider, longer only if needed to investigate an incident
Your cookie choice (
sq_consent)- How long
- Up to 183 days, then we ask again
Consent receipts
- How long
- 183 days after the choice expires, at most 366 days from the decision
Website analytics
- How long
- Up to 24 months
Contact-form messages and emails
- How long
- Up to 24 months after our last exchange, unless they become part of a customer relationship
Account and workspace data
- How long
- As long as your account or workspace exists. When a workspace is deleted, its data and stored files are purged.
Billing records
- How long
- As long as accounting and tax law requires
You have the right to access your personal data, to have it corrected, erased or restricted, to object to processing based on our legitimate interests, and to receive your data in a portable format. Where we rely on your consent, you can withdraw it at any time; for cookies, use “Cookie settings” in the footer. In the app, you can also export or erase a person’s data, delete your own account and delete a whole workspace. To exercise your rights, email hello@squar.io; we reply within one month.
If you think we haven’t handled your data properly, you can complain to a data protection supervisory authority, in particular in the country where you live or work, or where you think the problem happened.
We protect data with measures such as workspace isolation with row-level security, role- and field-level permissions, two-factor authentication, encryption of stored credentials and a strict content security policy. See Security for details.