Privacy Policy — DashFlow
Last updated: September 2026
DashFlow is a product of NICOMATIC SENEGAL, a company registered in Senegal. This privacy policy describes how we collect, use, store and protect your personal data when you use the DashFlow platform.
Data Controller
NICOMATIC SENEGAL Dakar, Senegal Contact: contact@NICOMATIC.sn
Data Collected
Data you provide to us
- Account data: name, email address, password (hashed), company name.
- Organization data: invited members, created groups, assigned roles.
- Billing data: subscribed plan, billing history (no credit card is stored on our servers — processing is delegated to our payment provider).
Data collected automatically
- Usage data: number of AI requests, generated dashboards, connected data sources, quota consumption.
- Technical data: IP address (anonymized after 30 days), browser, operating system, pages visited, session duration.
- Cookies: one session cookie (required for operation), one language preference cookie.
Data you import
- Files and databases: any content you import (CSV, database data, API data) remains your responsibility. NICOMATIC SENEGAL only accesses it to provide the service (storage, processing, display in your dashboards).
Purposes of Processing
| Purpose | Legal basis |
|---|---|
| Service delivery (dashboards, AI, ETL) | Contract performance |
| Account and organization management | Contract performance |
| Billing and fraud prevention | Legal obligation / Legitimate interest |
| Service improvement (anonymous aggregates) | Legitimate interest |
| Service communications (updates, incidents) | Legitimate interest |
| Marketing (newsletter, offers) | Consent |
Hosting and Transfers
Your data is hosted on Amazon Web Services (AWS), region eu-west-3 (Paris). It stays within the European Union. No transfer to third countries takes place without appropriate safeguards (standard contractual clauses).
Retention Periods
- Account data: retained for the duration of the contractual relationship, then 3 years after termination for legal purposes.
- Imported data: retained while your account is active. Upon termination, deleted within 30 days.
- Technical data: maximum 13 months.
- Billing data: 10 years (legal obligation).
Your Rights
Under the General Data Protection Regulation (GDPR) and Senegalese personal data law, you have the following rights:
- Access: obtain a copy of your data.
- Rectification: correct inaccurate data.
- Erasure: request deletion of your data.
- Portability: receive your data in a structured format.
- Objection: object to certain processing (including marketing).
- Restriction: temporarily restrict processing.
To exercise your rights, contact us at contact@NICOMATIC.sn. We respond within 30 days.
Security
- Encrypted communications (HTTPS/TLS 1.3).
- Hashed passwords (bcrypt).
- Data isolated per organization (strict multitenancy).
- Production data access restricted to authorized personnel.
- Your data is never used to train third-party AI models.
Cookies
| Cookie | Type | Duration | Purpose |
|---|---|---|---|
session | Necessary | Session | Authentication |
lang | Preference | 1 year | Interface language |
No advertising or third-party tracking cookies are set.
Changes
Any material change to this policy will be notified to you by email at least 15 days before it takes effect. The current version is always accessible at /privacy-policy.
Contact
NICOMATIC SENEGAL — contact@NICOMATIC.sn