Privacy policy

Who we are

Celeste Solutions, enterprise number BE 1041.844.534, based in Belgium, is responsible for the personal data described here. For any question about this policy or your data, write to hello@celeste-solutions.com.

This website

This website sets no cookies, runs no scripts and uses no analytics or tracking.

• Hosting. The site is served by Amazon Web Services (Amazon CloudFront). To deliver a page, AWS necessarily processes your IP address and the details your browser sends with the request. We do not keep access logs.
• Fonts. The page loads its typeface from Google Fonts, so your browser connects to Google, which receives your IP address. Google describes how it uses that in its own privacy policy.

When you email us

If you write to us, we receive your name, email address and whatever you put in the message. We use this only to answer you and, if we end up working together, to prepare and carry out that work. Our email is hosted by Google Workspace. We keep correspondence as long as it is needed for that purpose and for our accounting and legal obligations.

Legal basis: our legitimate interest in answering messages, or the steps needed to enter into a contract with you.

Retail Portal

Retail Portal is our web application for retail stores. It handles two kinds of data, and our role differs for each.

Your user account

For each person with access, we keep:

• name and email address;
• a password, stored only as a secure hash, never in readable form;
• the secret and recovery codes for two-factor sign-in;
• role, the stores the person may see, and personal settings such as favourite stores;
• active sign-in sessions, and which reports the person uploaded.

We are the controller for this data. We use it to give access to the portal, keep it secure and support its users. Legal basis: the contract with the customer the account belongs to, and our legitimate interest in keeping the service secure.

Store reports

The reports a customer uploads or forwards are the customer's own business data: sales, purchases, margins and account statements. They can contain some personal data, for example the name of a supplier or of a person on a customer account. For this data the customer is the controller and we act as its processor: we process it only to provide Retail Portal, following the customer's instructions and our agreement with them.

The assistant

When you ask the built-in assistant a question, your question and the figures it looks up for the store you are viewing are processed by a language model (Anthropic's Claude) through Amazon Bedrock, inside the European Union. AWS does not use this data to train models and does not share it with the model provider.

Cookies in the portal

• Session cookie (strictly necessary): keeps you signed in. It lasts at most 30 days, and the portal signs you out after 60 minutes without activity.
• Sign-in cookie (strictly necessary): lives only for the few minutes between entering your password and your two-factor code.
• Google Analytics: measures how the portal's pages are used, so we can improve them. Google receives your IP address and information about your browser and the pages you open.

Where the data is stored

Retail Portal runs on Amazon Web Services in the Ireland region (eu-west-1). Its database, the archived report files and the reports received by email are stored there, encrypted at rest, and all traffic to and from the portal is encrypted in transit.

The service providers we use are:

• Amazon Web Services EMEA SARL (Luxembourg): hosting, storage, email reception and the assistant, in the EU.
• Google Ireland Limited: email (Google Workspace), web fonts and Google Analytics. Google may transfer data to the United States, under the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.

We do not sell personal data and do not share it with anyone else, unless the law requires us to.

How long we keep it

• User accounts: as long as the account exists. When an account is closed or the customer's contract ends, we delete it, unless the law requires us to keep something longer.
• Store reports and their archived PDFs: for as long as the customer uses Retail Portal, then deleted or returned as agreed with the customer.
• Database backups: seven days, after which they are overwritten.

Security

Access to the portal requires a password and two-factor sign-in, and each person sees only the stores they work in. The systems run in a private network, and every change to them is made in code and tested before it is deployed.

Your rights

Under the General Data Protection Regulation you may ask to see the personal data we hold about you, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable format. Write to hello@celeste-solutions.com; we answer within one month. If your request concerns store reports, we pass it on to the customer that controls them.

You can also lodge a complaint with the Belgian Data Protection Authority:

Gegevensbeschermingsautoriteit / Autorité de protection des données
Drukpersstraat 35, 1000 Brussels
www.dataprotectionauthority.be

Changes

If we change how we handle personal data, we update this page and the date at the top.