Privacy policy

1. Data controller

Secondia, a sole trader registered in Australia, ABN [to be completed]. A Belgian company is being incorporated and will take over this role. Contact for any question about your data: contact@secondia.app.

2. What data we process, why, and on what basis

Site visitors: anonymous audience measurement (Vercel Analytics, no cookies or personal identifiers). Basis: legitimate interest (Art. 6(1)(f) GDPR) in understanding how the site is used.

Forms (diagnostic, trial, contact request, chat): name, firm, business email and phone, your message. We use them to reply to you and prepare your trial. Basis: pre-contractual steps (Art. 6(1)(b)).

Clients: account data, billing (handled by Stripe, we never see your card) and documents you entrust to us. Basis: performance of the contract (Art. 6(1)(b)) and legal accounting obligations (Art. 6(1)(c)). For calls handled by our agents on your behalf, we act as a processor: see our Data Processing Agreement (DPA).

B2B prospecting: we contact Belgian accounting firms using public sources (firm name, published business email, website). Basis: legitimate interest (Art. 6(1)(f)) in presenting a service relevant to their business. Every email includes a one-click unsubscribe link. Once you object, we never contact you again and keep only your address on a suppression list, so that your refusal is respected.

3. Gmail (Google)

We use Google's Gmail API only on our own mailbox, contact@secondia.app, with two permissions: gmail.send, to send emails we have approved from that address; gmail.readonly, to read replies received in that mailbox, sort them and prepare a draft reply that we review before anything is sent.

We do not access anyone else's Gmail account. Messages we read are stored on our workstation and in our Supabase database (EU). To prepare a reply, their content may be sent to our AI provider (Anthropic), which does not use it to train its models. Gmail data is never sold, never used for advertising, and never read by a human other than ourselves to handle our correspondence. Access can be revoked at any time at myaccount.google.com/permissions.

Secondia's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

4. Recipients and sub-processors

Google (Workspace, email), Vercel (site hosting, United States), Supabase (database, EU), Stripe (payments), Resend (service emails), Anthropic (AI), Retell (voice agent). We do not sell any data.

5. Transfers outside the European Union

Some providers are based in the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.

6. Retention periods

Chat messages: 180 days. Enquiries and prospects with no follow-up: 12 months after the last exchange. Client data: for the duration of the contract, then deleted on termination, except accounting records kept for 7 years (Belgian legal requirement). Prospecting suppression list: for as long as the objection stands.

7. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection (including to prospecting, without giving a reason). Write to contact@secondia.app: we reply within one month. You may also lodge a complaint with the Belgian Data Protection Authority (rue de la Presse 35, 1000 Brussels, dataprotectionauthority.be).

8. Cookies

The site sets no advertising or analytics cookies. Only technical cookies are used: language choice, client-area login session and Stripe payment. They do not require consent.

9. Changes

We will update this page if our processing changes. The version date is shown at the top of the page.