Privacy policy
Last updated: November 10, 2026
This policy describes the personal data processed by TurbineTrail, for what purpose, for how long, and how to exercise your rights.
We do not sell any data and use no advertising, no audience measurement tool and no third-party tracker.
1. Data controller
Blade Expert SARL, 53 avenue des Pyrénées, 62217 Beaurains, France, publisher of TurbineTrail, is the controller of the processing described below. Contact: contact@turbinetrail.com.
No data protection officer has been appointed, as this is not mandatory for our activity.
2. Two distinct situations
We are the data controller for user accounts, authentication, service emails and the operation of the website.
For the data that customer companies record in their workspace (records, photos, videos and other files, comments, names of technicians, information about their wind farms), the customer company is the data controller and we act on its behalf as a processor. For this data, send your requests to the company concerned; if you write to us, we forward your request to it.
3. Data processed, purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Create and manage your account and your company's workspace | First name, last name, work email, password (stored as a hash, never readable), language, company name and type, role | Performance of the contract |
| Authenticate you and secure the service | Session identifier, IP address, browser used, login dates | Performance of the contract and legitimate interest (security) |
| Monitor the use of the service and administer the workspaces (internal statistics, complimentary access) | Sign-up and last activity dates of each account in each workspace, number of items created in a workspace (wind farms, wind turbines, records, files), without their content | Legitimate interest |
| Send service emails: address verification, password reset, invitations | Email, first name, last name and language; for an invitation, the invitee's email, the company name and the name of the person inviting | Performance of the contract; for invitations, legitimate interest of the inviting company |
| Remember your display preferences | Chosen language and theme | Legitimate interest |
| Answer your support requests and the messages of the contact form | Email and content of the exchanges; for the form, name, company and profile given and language of the page | Legitimate interest |
| Bill the subscription and collect payments | Company name, address and VAT number, billing email, invoices and payments; card or bank account details are entered with Stripe and never transmitted to us | Performance of the contract and legal obligation (accounting) |
- Purpose
- Create and manage your account and your company's workspace
- Data
- First name, last name, work email, password (stored as a hash, never readable), language, company name and type, role
- Legal basis
- Performance of the contract
- Purpose
- Authenticate you and secure the service
- Data
- Session identifier, IP address, browser used, login dates
- Legal basis
- Performance of the contract and legitimate interest (security)
- Purpose
- Monitor the use of the service and administer the workspaces (internal statistics, complimentary access)
- Data
- Sign-up and last activity dates of each account in each workspace, number of items created in a workspace (wind farms, wind turbines, records, files), without their content
- Legal basis
- Legitimate interest
- Purpose
- Send service emails: address verification, password reset, invitations
- Data
- Email, first name, last name and language; for an invitation, the invitee's email, the company name and the name of the person inviting
- Legal basis
- Performance of the contract; for invitations, legitimate interest of the inviting company
- Purpose
- Remember your display preferences
- Data
- Chosen language and theme
- Legal basis
- Legitimate interest
- Purpose
- Answer your support requests and the messages of the contact form
- Data
- Email and content of the exchanges; for the form, name, company and profile given and language of the page
- Legal basis
- Legitimate interest
- Purpose
- Bill the subscription and collect payments
- Data
- Company name, address and VAT number, billing email, invoices and payments; card or bank account details are entered with Stripe and never transmitted to us
- Legal basis
- Performance of the contract and legal obligation (accounting)
We carry out no profiling and no automated decision-making producing legal effects concerning you.
5. Recipients
Your data is accessible to:
- the members of your company's workspace, according to their role;
- the companies with which a member of your workspace shares an event, for the information in that event, for example the name of the author of a record; and, when you enter records in an event that another company entrusts to you, that company, for those records and the name of their author;
- authorised Blade Expert staff, for operations, maintenance and support;
- our processors, listed below, within the limits of their assignment;
- public authorities, where required by law.
| Processor | Assignment | Data location |
|---|---|---|
| Render Services, Inc. | Hosting of the application and database | European Union (Frankfurt, Germany) |
| Amazon Web Services EMEA SARL | Storage of record files (photos, videos, recordings, documents) and backups | European Union (Frankfurt, Germany; backups in Paris, France) |
| Google Ireland Limited (Google Workspace) | Sending service emails, receiving the messages of the contact form | European Union and United States |
| Stripe Payments Europe, Limited (Ireland) | Payment, billing, VAT calculation and customer portal; independent controller for its own obligations, in particular fraud prevention | European Union and United States |
- Processor
- Render Services, Inc.
- Assignment
- Hosting of the application and database
- Data location
- European Union (Frankfurt, Germany)
- Processor
- Amazon Web Services EMEA SARL
- Assignment
- Storage of record files (photos, videos, recordings, documents) and backups
- Data location
- European Union (Frankfurt, Germany; backups in Paris, France)
- Processor
- Google Ireland Limited (Google Workspace)
- Assignment
- Sending service emails, receiving the messages of the contact form
- Data location
- European Union and United States
- Processor
- Stripe Payments Europe, Limited (Ireland)
- Assignment
- Payment, billing, VAT calculation and customer portal; independent controller for its own obligations, in particular fraud prevention
- Data location
- European Union and United States
6. Transfers outside the European Union
The application, database and record files are hosted in Frankfurt, and their backups in Paris. Render Services, Inc. and Amazon Web Services, Inc. are US companies and Google may process emails in the United States through Google LLC. Any such transfers are governed by the European Commission's standard contractual clauses and, for Google LLC, by its certification under the EU–US Data Privacy Framework. Stripe may process billing data in the United States through Stripe, Inc., certified under the EU–US Data Privacy Framework.
7. Retention periods
| Data | Period |
|---|---|
| Account and workspace data | For as long as you use the service, then deleted within 90 days of the account or workspace being closed |
| Sessions (IP address, browser) | Until logout, at most 30 days after the last activity |
| Verification and reset links | 24 hours for email verification, 1 hour for password reset |
| Invitations | Valid for 7 days, then deleted no later than 30 days after expiry |
| Copies of service emails | 12 months in the sending mailbox |
| Support exchanges and messages of the contact form | 3 years after the last exchange |
| Backups | Deleted data disappears from them no later than 30 days after its deletion |
| Billing data (invoices, payments) | 10 years from the end of the financial year, as accounting records |
- Data
- Account and workspace data
- Period
- For as long as you use the service, then deleted within 90 days of the account or workspace being closed
- Data
- Sessions (IP address, browser)
- Period
- Until logout, at most 30 days after the last activity
- Data
- Verification and reset links
- Period
- 24 hours for email verification, 1 hour for password reset
- Data
- Invitations
- Period
- Valid for 7 days, then deleted no later than 30 days after expiry
- Data
- Copies of service emails
- Period
- 12 months in the sending mailbox
- Data
- Support exchanges and messages of the contact form
- Period
- 3 years after the last exchange
- Data
- Backups
- Period
- Deleted data disappears from them no later than 30 days after its deletion
- Data
- Billing data (invoices, payments)
- Period
- 10 years from the end of the financial year, as accounting records
Some data may be kept longer where the law requires it, for example accounting records, for 10 years.
8. Security
- Encrypted connections (HTTPS).
- Passwords stored as hashes (scrypt), never in plain text.
- Session cookies inaccessible to page scripts.
- Strict isolation of workspaces: every request is filtered by the company and role of the logged-in user.
- Hosting in the European Union.
In the event of a personal data breach posing a risk to you, we notify the French data protection authority (CNIL) within 72 hours and inform you where the law requires it.
9. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection, as well as the right to set instructions regarding the handling of your data after your death.
To exercise them, write to contact@turbinetrail.com from your account's email address. We reply within one month and may ask you to prove your identity if in doubt. You can also change your name and email address, or delete your account, from the "My account" page.
You can also lodge a complaint with the CNIL (cnil.fr) or with the data protection authority of your country.
10. Changes
We update this policy when the service changes. The date of the last update appears at the top of the page; in the event of a significant change, we notify users by email.