Privacy policy
How Mukeï collects, uses and protects your personal data.
Last updated: 2 September 2026
1. Data controller
MUKEI SAS, a French simplified joint-stock company with share capital of €4,700, registered with the Antibes Trade Registry under number 894 147 644, with its registered office at 11 Chemin du Collet du Malvan, 06800 Cagnes-sur-Mer, France. For any question about your data: contact@mukei.fr.
2. Data we collect
We collect only what the service needs to work. Account data : Email address, first and last name, password (hashed, never readable), phone number and job title if you provide them, profile picture if you upload one. Sign-in data : Last activity date, password change date, IP address at sign-in attempts. This data serves account security and abuse prevention. Professional data you enter : Information about your assets, financial data, uploaded documents, generated reports. It belongs to you: we process it to provide the service, never for any other purpose. Sign-in with an external provider : If you sign in with Google, Microsoft or LinkedIn, we receive your email address, name and profile picture. We never receive your password, and access no other data from those accounts.
3. Purposes and legal bases
Providing the service and performing the contract: account, valuations, reports. Legitimate interest: service security, abuse prevention, administrator access log. Legal obligation: retention of accounting records. We do not use your data for advertising or profiling, and we sell it to no one.
4. Processors
The service relies on the following providers, each bound by a data processing agreement: • Contabo GmbH (Germany) - server and database hosting. All your data is hosted in Europe. • Resend (United States) - transactional email delivery: address verification, password reset, invitations. Only the address and the message content are transmitted. • Supabase, self-hosted on our servers - storage of documents and uploaded files. No data leaves our infrastructure. • Anthropic (United States) - suggested editorial comments, on explicit request. No client data is used to train a model. • INPI and Pappers (France) - public register lookups (trademarks, patents, companies). Only the search term is sent, never your identity.
5. Retention periods
Account data: kept while the account is active, then three years after deactivation. Sessions: 24 hours. Address verification and password reset tokens: 24 hours, deleted after use. Administrator access log: three years. Documents and reports: kept until you delete them, then erased with the account.
6. Cookies
Mukeï uses no advertising cookies and no analytics tools. Only two cookies are set: your session cookie, required to stay signed in, and an interface cookie that remembers whether the sidebar is collapsed. Neither requires your consent under the ePrivacy directive, as both are strictly necessary or purely functional.
7. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data. To exercise it, write to contact@mukei.fr: we reply within one month. You may also lodge a complaint with the CNIL (www.cnil.fr).
8. Security
Passwords are hashed with bcrypt and never stored in clear text. All traffic goes over HTTPS. Documents you upload sit in a private space, reachable only through short-lived signed links. Administrator access to a client file is logged.
9. Transfers outside the European Union
Your data is hosted in Germany. Two providers are established in the United States (Resend, Anthropic): transfers to them are governed by the European Commission's standard contractual clauses. They receive a strict minimum - an email address for one, a text to rephrase for the other.
10. Changes
This policy may change. Any substantial modification will be notified by email or at your next sign-in. The last update date appears at the top of this page.