Privacy policy

1. Who is the data controller?

When you browse our Website or when we manage our contractual relationships with customers, the data controller is Dibby, a French simplified joint-stock company (SAS) registered with the Paris Trade and Companies Register under number 939 503 181, with its registered office at 70 avenue de la grande armée (“We” or “Us”). This Policy does not apply to personal data processing for which dibby acts as a processor. For personal data about your customers or prospects that you entrust to us when using our services, you act as the controller and we act as a processor within the meaning of the GDPR. You are therefore responsible for ensuring that individuals are informed, that their rights are respected and, more generally, that the applicable regulations are complied with.

2. What data do we collect?

Personal data is information that identifies an individual directly or when combined with other information. We collect personal data in the following categories:

• Identification data (username, email address).
• Data relating to your subscriptions.
• Connection data (connection logs, encrypted passwords).
• If you choose to sign in through a third-party authentication service (such as Google, Microsoft or GitHub), certain data, such as your name and email address, may be obtained from that service. By choosing this method, you agree to that service sharing this data with us. We do not collect the password for your third-party account.
• Browsing data (pages viewed, connection date and time, browser, operating system, user ID).
• Location data.
• Any information you choose to send us as part of a contact request.

2.1. Use of Google user data

When you use Google authentication to access our platform, we collect and use Google user data as follows:

• Data collected: We access only the basic profile information (name, email address, profile picture) necessary to create and manage your account.
• Use of data: This data is used exclusively to:
  • Create and authenticate your user account.
  • Personalize your experience on the platform.
  • Send you service-related communications.
  • Provide customer support.
• Limited access: We do not access any other Google data (Gmail, Drive, Calendar, etc.) without your additional explicit consent.
• No transfer: We do not sell, rent or transfer your Google user data to third parties for advertising or commercial purposes.

2.2. Sharing and transfer of Google user data

We do not sell, rent or transfer your Google user data to third parties. We do not access any Google data without your explicit consent.

2.3. Protection and use of data

Your Google user data is used only when you choose to activate a specific feature that requires that data to automate and deliver the requested service. This use takes place only with your explicit consent and within the scope of the feature you have chosen.

2.4. Signing in with Microsoft

If your organisation enables Microsoft single sign-on (SSO), we receive the information needed to identify you and associate you with your organisation: your name, email address, Microsoft identifier and Microsoft organisation (tenant) identifier. We do not receive your Microsoft password.

This information is used to create or locate your dibby account, check that you belong to an authorised organisation, secure your sign-in and provide the service and support. For a user acting on behalf of a customer organisation, this processing is based on our legitimate interest in providing secure access to the service purchased by that organisation. The retention periods for accounts and sign-in logs are set out in section 4.

SSO alone does not grant access to the contents of your Microsoft 365 emails, files or calendars. Enabling an Outlook, OneDrive, SharePoint or other Microsoft connector requires a separate connection and the corresponding permissions from the user or authorised administrator. These permissions can be withdrawn through the Microsoft settings of the user or their organisation.

We do not sell this information or use it for advertising. Access is limited to recipients needed to provide and secure the service, as described in section 5. Revoking Microsoft access prevents the affected future sign-ins; it does not automatically delete the dibby account. You may exercise your rights by contacting [email protected].

3. How do we collect data?

We collect your data either because you provide it directly to us (for example, by completing a contact request form on our Platform), or when you browse our Platform.

4. Purposes, legal bases and retention

5. Who receives your data?

The following may have access to your personal data:

• Our company’s personnel.
• Our processors: hosting, audience measurement and analytics, messaging, request management and secure payment providers, within the scope of their tasks.
• Our partners acting as independent controllers. We disclaim responsibility for personal data processing carried out by our partners and invite you to consult their privacy policies.
• Where applicable, public and private bodies, solely to meet our legal obligations.

6. Can your data be transferred outside the European Union?

Data hosted by dibby is stored in the European Union. We use, in particular, Amazon Web Services (AWS) and Cloudflare for our hosting, content delivery and security infrastructure. Storage locations do not determine where every other processing activity or access by our providers takes place. In connection with the tools we use, your data may be transferred outside the European Union. These transfers are safeguarded through the following mechanisms:

• Transfer to a country covered by a European Commission adequacy decision under Article 45 of the GDPR. In this case, the country provides a level of protection considered sufficient and adequate under the GDPR.
• Transfer to a country whose level of data protection has not been recognised as adequate under the GDPR. These transfers rely on appropriate safeguards under Article 46 of the GDPR, adapted to each provider, including, without limitation, European Commission-approved standard contractual clauses, binding corporate rules or an approved certification mechanism.
• Transfer based on one of the appropriate safeguards described in Chapter V of the GDPR.

7. What rights do you have over your data?

You have the following rights concerning your personal data:

• Right to information: This is why we have prepared this policy. This right is provided for in Articles 13 and 14 of the GDPR.
• Right of access: You may access all your personal data at any time under Article 15 of the GDPR.
• Right to rectification: You may correct inaccurate, incomplete or outdated personal data at any time under Article 16 of the GDPR.
• Right to restriction: You may obtain restriction of processing in the circumstances defined in Article 18 of the GDPR.
• Right to erasure: You may request deletion of your personal data and prohibit future collection on the grounds set out in Article 17 of the GDPR.
• Right to lodge a complaint: You may complain to a competent supervisory authority (the CNIL in France) if you believe the processing of your personal data infringes applicable law, under Article 77 of the GDPR.
• Right to give instructions: You may give instructions concerning the retention, erasure and disclosure of your personal data after your death.
• Right to withdraw consent at any time: For processing based on consent, Article 7 of the GDPR allows withdrawal at any time. Withdrawal does not affect the lawfulness of processing carried out beforehand.
• Right to data portability: Subject to the conditions in Article 20 of the GDPR, you may receive personal data you provided to us in a standard, machine-readable format and request its transfer to a recipient of your choice.
• Right to object: Under Article 21 of the GDPR, you may object to processing of your personal data. We may nevertheless continue processing for legitimate grounds or for the defence of legal claims.

You can exercise these rights by contacting us using the details below. We may ask you for additional information or documents to verify your identity.

8. Which cookies do we use?

Essential cookies support sign-in, security and the operation of dibby. Your choice about optional services is saved in your browser’s local storage for 6 months, whether you accept or refuse.

Only with your consent, PostHog measures pages viewed and predefined interactions, such as a confirmed access request or a booking. We do not send names, email addresses, or the contents of forms, documents or conversations. Page addresses are filtered to exclude search parameters and record identifiers. In the application, when analytics is enabled, a pseudonymous identifier links visits by a signed-in user, including their website journey before sign-in when those visits were measured with their consent and the same browser identifier is available. It contains neither their name nor their email address. Session recording and automatic click capture are disabled on the marketing website. In the application, after you consent, PostHog may also record clicks and sessions to identify usability difficulties. Text, input fields and element attributes are masked before transmission. Images, embedded documents, media and canvases are excluded. Network request contents and console logs are not recorded.

PostHog uses cookies prefixed with “ph_dibby_” and session storage to recognise permitted visits. They are deleted when consent is withdrawn or its expiry is detected, with a maximum lifetime of 6 months for cookies. Limited technical information, such as browser and device type, accompanies events. The server also receives the connection information needed for transmission. See PostHog’s privacy policy and its documentation on event retention.

Calendly or Google calendars are external services authorised separately from analytics. They load only after your choice in the banner or after you click “Show calendar”. Booking information is then processed by the provider under its privacy policy. Refusing PostHog does not prevent you from booking a meeting.

You can change your choices at any time. Withdrawal stops new analytics collection and deletes accessible analytics identifiers on our domain; it does not delete data already collected. To exercise your rights over that data, contact us using the details below.

9. Contact for exercising your rights

Contact email: [email protected]

Contact address: 70 avenue de la grande armée, 75017 Paris, France.

10. Changes

We may amend this policy at any time, in particular to reflect regulatory, case-law, editorial or technical developments. Changes apply from the effective date of the amended version. Please regularly consult the latest version of this policy. We will nevertheless inform you of any significant changes to this privacy policy.

Initial version: 3 February 2025. Presentation and cookie information updated: 17 September 2026.