Your data, your rights.
The data Guteneo uses, who receives it, how long it is kept and how to exercise your rights.
Updated on 23 October 2026
Who responds to you
Nicolas Pieper is the controller for the processing necessary to operate Guteneo: accounts, access, dispatch preparation and tracking, security and support. You can contact him at guteneo@pieper.fr, or by post at 59 rue du général de Gaulle, 57330 Hettange-Grande, France.
This policy covers the Guteneo website and service, including its assistant connections. If an organisation gives you access to its account or includes your contact details in a document, it remains responsible for the purposes of that use. It is your first point of contact for the content it entrusts to the service; we can help you identify the relevant request.
The data used
- Account and connections: identity and email address, account membership, role, assistant connections, permissions, sessions and any delegation mandates.
- Documents: PDFs sent or imported at your request, name, size, page count, file fingerprint and check results. Content supplied to create a PDF, its renderings and requested page images may also be processed.
- Dispatches: sender, recipient, channel, options, quote, spending limit, approval or delegation used, status, events and provider reference.
- Operation: credit and reservations, usage, access and security logs, technical connection data and support exchanges.
The workspace can also process CSV, XLSX, XML, JSON or Word sources you provide, their profiles and sample data, templates, field mappings, generation data and distribution manifests. When PDF/UA or PDF/A diagnostics are available, their reports are linked to the exact document and its fingerprint. This information supports the creation, checks and retrieval you request; it may be returned to your assistant according to its permissions.
This data comes from you, authorised account members, the assistant you connect or the provider returning a status. Guteneo receives the parameters and files sent to its tools; connecting an assistant does not give it access to your entire conversation. Information returned to that assistant nevertheless becomes accessible to that service under its own rules.
Account data required for authentication and information required for dispatch are essential to those functions. Without them, sign-in or dispatch cannot be completed. Provide only necessary data and ensure you are entitled to use third-party documents and contact details.
In ChatGPT and Codex workflows, do not transmit payment-card data covered by PCI DSS, protected health information, government identifiers, authentication secrets or sensitive personal data. This restriction covers documents, messages, templates and datasets, including those already stored. Antivirus checks do not filter these categories.
Why and on what basis
Account creation and the functions you request are based on performance of the service: importing a document, checking it, producing a quote, obtaining authorisation, transmitting the dispatch and providing its tracking.
Preventing abuse, protecting access, diagnosing incidents and keeping evidence needed for a dispute are based on the legitimate interest in operating a safe service and defending the rights of those concerned. For recipient contact details supplied by a user, this interest includes delivering their authorised correspondence. You may object to this processing under the conditions provided by applicable regulations.
Requests to exercise rights and applicable legal obligations are handled to comply with those obligations. A dispatch approval or technical mandate is not general consent to reuse your data for other purposes.
Document, permission, credit and destination checks may automatically block an operation. You can ask support for an explanation. Guteneo does not use these checks to build an advertising profile.
Who data is shared with
Authorised members of your account access information according to their permissions. The publisher may process information necessary for support, security and operation. Providers are involved only for the relevant functions:
- Cloudflare : website and service hosting, database, file storage, technical processing and security.
- Auth0 : authentication and sign-in management.
- Telnyx : document and information needed for a fax when that channel is available and the dispatch is authorised.
- Pingen and the relevant postal operators: preparation, printing and delivery of postal mail. A draft may be transferred to Pingen before the dispatch order; that transfer requires separate authorisation.
- Optional workspace AI assistance: if an administrator has enabled it and authorized this transfer, OpenAI may receive bounded excerpts of the data or template, their structure and your instruction to produce the requested proposal. The request uses store:false; this does not mean the provider retains no data. This assistance is separate from your connected assistant and does not initiate any delivery.
- Your connected assistant, such as ChatGPT: tool results, metadata, requested document content or pages, according to the permissions granted.
The final recipient naturally receives the authorised correspondence. Sending emails through Guteneo and purchasing credit are not available in this version of the beta.
Guteneo’s databases and document storage use Cloudflare’s European jurisdiction options. This does not guarantee that all processing by Cloudflare, Auth0, dispatch providers or the assistant remains within the European Union. Their involvement may include other countries, particularly the United States. To learn about the locations and transfer safeguards applicable to your use and obtain available information about those safeguards, contact guteneo@pieper.fr. No claim of wholly European processing is made.
How long data is kept
PDFs stored by Guteneo: automatic deletion becomes possible 90 days after creation. It takes place during a maintenance run, when no associated dispatch is ongoing or still unresolved. An open dispatch can therefore extend retention. This mechanism does not guarantee deletion to the exact minute or day; keep your own original.
Deleting a file does not automatically delete all its metadata or dispatch history. References, statuses, approvals, credit movements and audit records are kept to manage operations, respond to requests and establish what happened in a dispute. Their necessity is reviewed when deletion or closure is requested: records no longer needed are deleted or anonymised; an applicable obligation, unresolved operation or dispute may justify retention limited to the relevant records and the time needed.
Data sources and their profiles become eligible for deletion after 30 days, unless a related generation job is still queued or running. Word originals become eligible for deletion after 30 days. Per-record data and intermediate generation artifacts become eligible after 90 days, once generation has stopped. Maintenance performs these deletions in batches; generated PDFs follow the PDF retention rules.
Templates, published versions, field mappings, manifests and diagnostic reports remain in the account history; deleting their source files does not automatically erase them. Their continued necessity is reviewed when you request erasure or account closure, according to the residual needs described above.
Account data is kept while the account is in use, then according to the same remaining needs after closure. Support requests are kept until resolved, then only if follow-up or a dispute requires it. Full self-service account deletion is not currently available: send your request to guteneo@pieper.fr.
Operational monitoring records successful connections, their date, the account and member concerned, the access type and the country estimated by Cloudflare when available. This register stores neither IP addresses nor detailed browser information. It is restricted to the publisher for security and service monitoring. Connection events and access records for this control panel are excluded from views after 90 days, then deleted during maintenance.
For each assistant connection, the date of its last successful tool use is kept with the connection to indicate whether it works. This tracking does not store the call’s content. You can revoke the connection in My account to prevent future access; requests to erase this history follow the rights procedure below.
Sessions and temporary authorisations have expiry dates; maintenance clears expired entries. Daily content-view counters are cleared after 31 days. A copy already sent to a recipient, assistant or provider is also subject to their own retention rules; deleting the file at Guteneo does not recall a dispatch.
Exercise your rights
You may request access, rectification, erasure or restriction of processing of your data, and portability where applicable. You may object to processing based on legitimate interest for reasons relating to your situation. These rights may be limited by other people’s rights, a legal obligation or the need to resolve an operation or dispute.
Write to guteneo@pieper.fr with your request and the account concerned. Additional identity information will be requested only if there is reasonable doubt, in a proportionate manner. A response is provided within one month; for complex or numerous requests, an extension of up to two months may be needed and will be explained during the first month.
You can read the CNIL’s explanation of your rights and lodge a complaint with the CNIL. This policy will be updated if the service or its processing changes.