Legal
Privacy policy
What personal data NeverWiped processes, where it lives (backups in France, account data on a platform hosted in the EU), for how long, and your rights.
Draft for review by a lawyer, not legal advice. Fields marked TODO_LEGAL are not known yet and are filled in before launch.
This English text is a translation of the French version, which is the reference until the lawyer decides otherwise. Version française
15 fields still to complete: DATE_VERSION, FORME_JURIDIQUE, SIREN, ADRESSE, EMAIL_RGPD, EMAIL_CONTACT, PAYS_HEBERGEUR_PLATEFORME, PAYS_SAUVEGARDE_PLATEFORME, possible transfers by Mollie’s own sub-processors, not checked, PRESTATAIRE_EMAIL, email provider location and safeguards, from its DPA, HEBERGEUR_PLATEFORME, HEBERGEUR_STOCKAGE, SITE_SAUVEGARDE_PLATEFORME, possible transfers by the email and payment sub-processors, and their safeguards
Version of TODO_LEGAL(DATE_VERSION), YOOBOOST SAS
This policy explains which personal data NeverWiped processes, why, where it lives, for how long, and how to exercise your rights. It covers the website https://neverwiped.com, the documentation, the customer dashboard and the backup agent.
1. Controller
YOOBOOST SAS, TODO_LEGAL(FORME_JURIDIQUE), SIREN TODO_LEGAL(SIREN), TODO_LEGAL(ADRESSE). Contact for personal data: TODO_LEGAL(EMAIL_RGPD).
2. The content of your backups: we can’t read it
The files and databases you back up are encrypted on your server, before they are sent, with a key that never leaves that server. YOOBOOST SAS stores this encrypted data without being able to read it, decrypt it or restore it for you.
For that data, you are the controller and YOOBOOST SAS acts as your processor, under the data processing agreement (https://neverwiped.com/legal/dpa). This policy covers the other data: your account and your use of the service.
3. Data, purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and running your account, logging in | Email, name, password (hashed), role, email verification date, last login, sessions (IP address, browser) | Performance of the contract |
| Providing the backup service | Registered servers (hostname, system, architecture, agent version), backup plan (paths, databases and volumes found), backup history (dates, sizes, status, error messages), API keys (fingerprint only) and their use (daily counts, last IP address and user agent), storage used, storage access reissued after a lost server (new hostname, IP address) | Performance of the contract |
| Sign-in security and team access | Second factor (encrypted authenticator secret, passkeys: name and public key, hashed recovery codes), team members and invitations (email of the invited person, role), log of the actions on your account by you and your members (date, action, IP address, browser) | Performance of the contract; legitimate interest (account security) |
| Subscription, payment and invoicing | Country, company name, billing address, VAT number and its VIES check, Mollie customer, payment and mandate references, hashed fingerprint of the card or IBAN, invoices and credit notes | Performance of the contract; legal obligation (keeping invoices) |
| Collecting unpaid amounts | Steps of the procedure, amounts due, emails sent | Performance of the contract; legitimate interest |
| Transactional emails and alerts | Email, name, log of the emails sent | Performance of the contract |
| Referrals and fraud prevention | Referral code, clicks (IP address), sign-ups and conversions of referred users, anti-abuse signals (email, domain, payment fingerprint, sign-up IP, billing address), months credited | Legitimate interest (preventing referral fraud); performance of the contract |
| Platform security | IP addresses (rate limits), audit log of administrative access | Legitimate interest; security obligation (GDPR article 32) |
| Support | Email exchanges; messages sent with the feedback form or neverwiped feedback (text, agent version) | Performance of the contract; legitimate interest |
| Private beta | Invitation (email of the invited person), version of the beta terms accepted, onboarding emails sent, unsubscribe from non-essential emails | Performance of the contract; legitimate interest |
We don’t use your data for targeted advertising or profiling, and we don’t sell it. No automated decision with legal effects is taken, except the automatic refusal of a referral when an anti-abuse signal is found; you can ask for a human review at TODO_LEGAL(EMAIL_CONTACT).
4. Where each category lives
| Data | Where |
|---|---|
| Content of your backups (files, databases, volumes), encrypted on your server | France, on the backup storage. It goes straight from your server to the storage and back, and never passes through the platform. |
| Account, billing, invoices, backup metadata (server names, plan paths, dates, sizes, status), referrals, logs | European Union (TODO_LEGAL(PAYS_HEBERGEUR_PLATEFORME)), on the platform (website, dashboard, API, database) |
| Encrypted backup of the platform database | Second site, country: TODO_LEGAL(PAYS_SAUVEGARDE_PLATEFORME) |
| Payment data | Mollie, Netherlands; TODO_LEGAL(possible transfers by Mollie’s own sub-processors, not checked) |
| Emails being sent | TODO_LEGAL(PRESTATAIRE_EMAIL), TODO_LEGAL(email provider location and safeguards, from its DPA) |
5. Retention
Account data is kept while the account exists. Backups are deleted 7 days after the end of a trial, 30 days after a cancellation takes effect, 45 days after an unpaid amount that isn’t settled, immediately when you delete a server, and 7 days after you ask for your account to be deleted (you can cancel until then). Invoices are kept for 10 years (legal obligation).
6. Recipients and sub-processors
Only authorised people at YOOBOOST SAS can access your data, and every access to the back office is logged. The data is entrusted to these sub-processors:
| Sub-processor | Role | Location |
|---|---|---|
| TODO_LEGAL(HEBERGEUR_PLATEFORME) | Hosting of the platform (website, dashboard, API, database: account, billing, backup metadata) | European Union (TODO_LEGAL(PAYS_HEBERGEUR_PLATEFORME)) |
| TODO_LEGAL(HEBERGEUR_STOCKAGE) | Hosting of the backup storage server (encrypted content) | France |
| TODO_LEGAL(SITE_SAUVEGARDE_PLATEFORME) | Encrypted backup of the platform database | TODO_LEGAL(PAYS_SAUVEGARDE_PLATEFORME) |
| TODO_LEGAL(PRESTATAIRE_EMAIL) | Sending emails | TODO_LEGAL(email provider location and safeguards, from its DPA) |
| Mollie B.V., Amsterdam | Card payments and SEPA direct debit | Netherlands; TODO_LEGAL(possible transfers by Mollie’s own sub-processors, not checked) |
| European Commission (VIES) | Checking the VAT number of EU businesses | European Union |
7. Data location and transfers outside the European Union
The platform is hosted in the European Union. The platform (website, dashboard, API and database) is hosted in the EU by TODO_LEGAL(HEBERGEUR_PLATEFORME) (TODO_LEGAL(PAYS_HEBERGEUR_PLATEFORME)). The data in article 3 is processed there: account, sessions, billing and invoices, backup status and metadata, referrals, logs. Hosting the platform therefore needs no transfer mechanism under chapter V of the GDPR.
The content of your backups is stored in France. Encrypted on your server, it is sent straight to the storage server in France, without passing through the platform.
Other locations. The encrypted backup of the platform database is kept on a second site (country: TODO_LEGAL(PAYS_SAUVEGARDE_PLATEFORME)); if it is outside the European Economic Area without an adequacy decision, the transfer is covered by the Commission’s standard contractual clauses. The sub-processors of article 6 that are not checked yet (email provider, Mollie’s own sub-processors) may involve transfers: TODO_LEGAL(possible transfers by the email and payment sub-processors, and their safeguards). You can get the current list of sub-processors and their safeguards by writing to TODO_LEGAL(EMAIL_RGPD).
8. Cookies
The site uses no advertising cookie, no audience measurement and no third-party tracker. It only sets:
| Cookie | Role | Duration |
|---|---|---|
nw_session | Keeps you logged in to the dashboard (strictly necessary) | 30 days, renewed on use |
nw_account | Remembers which account you chose in the account switcher (team members) | 30 days |
nw_mfa | Holds a sign-in that waits for its second factor (strictly necessary) | 10 minutes |
nw_ref | Remembers the referral link you followed, to credit the referral | 30 days |
These cookies are needed for the service you asked for and don’t require prior consent.
9. Security
TLS for every connection, backups encrypted on your server before sending, encrypted disks, hashed passwords (scrypt), API keys stored as fingerprints, append-only storage, audit log of administrative access, rate limits against repeated attempts. Details: https://neverwiped.com/security.
10. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to set instructions about your data after your death.
- Export: your dashboard, “My account”, downloads all your account data as JSON in one click.
- Deletion: the same page asks for your account and all your backups to be deleted, after you confirm with your password. The deletion takes place 7 days later, you can cancel until then, and you then get a deletion number. Invoices are kept under the legal obligation; the full timeline is in the retention policy.
- Other requests: TODO_LEGAL(EMAIL_RGPD). We answer within one month.
You can lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or with the authority of your own EU country.
11. Changes
We notify you by email of any significant change to this policy before it takes effect.