Version in force as of 16 September 2026
This policy explains which personal data is collected on shop.freshapp.io and by our modules, why, how long it is kept and how to exercise your rights.
1. Data controller
Uprising Web (FreshApp brand), SARL, 5 rue Fragonard, 75017 Paris, France — RCS Paris 845 362 110.
For any question about your data: contact@freshapp.io.
2. Data collected and purposes
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Customer account, orders, invoices | Last name, first name, email, company and VAT number where applicable, billing address, order history | Performance of the contract; legal obligation for invoices | Account: 3 years after the last order or login. Accounting records: 10 years |
| Payment | Amount, status and reference of the transaction. Card data is entered with Stripe and never sent to us | Performance of the contract | With the corresponding order |
| Licences and updates | Account key, declared domain names and site type (production or test), PrestaShop version and versions of installed FreshApp modules, dates of first and last check | Performance of the contract; legitimate interest (enforcing the licence site quota) | For the lifetime of the customer account |
| Support and requests (after-sales, withdrawal) | Messages, attachments sent, order concerned | Performance of the contract; legal obligations | 3 years after the request is closed |
| Access given to support (back office, FTP…) | Credentials you choose to send in a request | Performance of the contract | At most 30 days after they are sent, or until the request is closed if that comes first |
| Newsletter | Email address | Consent | Until you unsubscribe, which you can do at any time on request |
| Security and visit statistics | IP address, pages viewed, connection date, browser | Legitimate interest (security, site operation) | 13 months maximum |
3. Data sent by our modules
The FreshApp PrestaConnect module, installed on your store, communicates with our servers only when it checks for updates or when you declare a domain. It sends your account key, the store's domain name, its type (production or test), the PrestaShop version and the list of installed FreshApp modules with their version. No data about your own customers or orders is sent.
Other FreshApp modules send no data to Uprising Web. Some rely on third-party services that you choose to enable (for example tarteaucitron.io or a translation provider): those services then process data under their own terms.
4. Recipients
Your data is intended for Uprising Web and is never sold. It may be processed on our behalf, strictly within the scope of their assignment, by:
- o2switch (Clermont-Ferrand, France): hosting of the site and data;
- Stripe Payments Europe, Ltd. (Dublin, Ireland): secure payment processing, described in Stripe's privacy policy;
- PrestaShop SA: services related to the PrestaShop software enabled on the store;
- administrative or judicial authorities, where required by law.
Where a provider processes data outside the European Union, the transfer is covered by an adequacy decision or by the European Commission's standard contractual clauses.
5. Cookies
The site uses:
- necessary cookies for it to work (session, cart, account login, remembering your cookie choices), which do not require consent;
- cookies subject to your consent, set only if you accept them in the tarteaucitron.io consent manager.
You can change your choices at any time using the cookie manager icon shown on the site. Your choice is kept for a maximum of 13 months.
6. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, to set instructions regarding your data after your death, and to withdraw your consent at any time. To exercise these rights, write to contact@freshapp.io; proof of identity may be requested in case of reasonable doubt. We reply within one month.
If you believe your rights are not respected, you may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
7. Security
Account passwords are stored in hashed form, card payments are handled by a specialised provider and access to data is restricted to those who need it.
Access details you give to support (back office, FTP…) are encrypted on receipt with a key only our team can open: neither the database nor the site files can be used to read them, even in the event of an intrusion. They are never sent by email, every viewing is recorded, and they are deleted automatically. We recommend creating a dedicated temporary account, to be deleted once the request has been handled.
8. Changes
This policy may change, particularly when a new service is added. The update date is shown at the top of the page.