Spine privacy policy
Last updated: November 1, 2026
This English translation is provided for convenience. If it differs from the French version, the French version prevails.
Spine is a work assistant intended for businesses. It is available on the web, on computers, and as a mobile app (iPhone and Android). This policy explains what data Spine processes, why, with whom, and how to exercise your rights.
1. Who is responsible for your data
Spine is published by Reverall, a limited liability company (SARL) with a share capital of €40,000, whose registered office is at 62 rue du Renard, 76000 Rouen, France, registered with the Rouen Trade and Companies Register (RCS) under number 915 359 566, and represented by Olivier Martineau, managing director (gérant).
Spine is a professional tool. Your account is created by the company that gives you access to Spine (your employer or the organization you work for). Each company has its own instance, separate from those of other companies.
As a general rule:
- the customer company is the controller: it decides to use Spine, chooses the features and services that are enabled, and manages the accounts;
- Reverall is its processor: we process the data on its behalf and in accordance with its instructions, under a contract.
The exact allocation of roles is set out in the contract entered into with each company. For the processing that Reverall carries out on its own behalf (for example, the overall measurement of service usage, see section 4), Reverall is the controller.
At Reverall, the person responsible for processing operations is Olivier Martineau, managing director.
2. The data we process
Your account
- your name and email address;
- your role in the company and your preferences in the app;
- if your company has enabled it, the information transmitted by Microsoft sign-in (technical account identifiers, name, email).
What you entrust to Spine
- the messages you write to the assistant and its replies;
- your dictations, converted into text (see section 9);
- the documents, files, and photos you add;
- the content of the services that you or your company connect to Spine (for example, email, calendar, or files), within the limits of the permissions granted.
Technical data
- the technical logs necessary for the operation and security of the service (sign-in dates, IP address, device used, errors);
- usage and consumption metrics (tools used, number of documents, volume processed by the assistant). They do not contain your name, your email, or the content of your exchanges or documents.
Notifications (iPhone app)
If you allow notifications, we process an identifier for your device in order to send them to you. A notification contains the title of a document (120 characters at most) and the beginning of its summary (240 characters at most), never the entire document. Notifications are not yet available on Android.
On your phone
The app stores your company's server address, your session tokens, and a few display settings locally. This data is erased when you sign out or uninstall the app.
3. The assistant and artificial intelligence providers
To answer you, Spine sends the following to an artificial intelligence provider:
- your message or dictation;
- the documents and photos you add;
- the document excerpts relevant to the answer;
- the necessary instructions and context.
The providers process this data solely to answer you, on behalf of your company.
Your agreement is requested in the app before any use of the assistant. Without this agreement, Spine cannot be used.
The possible providers are listed below. Those actually used depend on the instance and on the configuration chosen by your company. Your administrator can tell you which ones are active.
| Provider | Role | Processing location |
|---|---|---|
| Scaleway SAS (France) | Default assistant: writing answers and searching your documents | Paris, France |
| Mistral AI SAS (France) | Reading scanned documents and images (text recognition) | France |
| OpenAI (OpenAI Ireland Ltd.) | Assistant, if your company chooses it; image generation | European Union if the European project is used, otherwise possibly outside the EU |
| Google (Google Ireland Ltd.), Gemini | Assistant, if your company chooses it | Possibly outside the EU |
| Anthropic, PBC (United States) | Assistant, if your company chooses it | United States |
| Exa Labs, Inc. (United States) | Web search: receives the search query, which may include part of your request | United States |
For Scaleway, the default provider: Scaleway states that it does not retain requests by default (except abnormal requests, which are kept for up to two weeks), and the developers of the models it runs do not have access to your exchanges.
4. Why we use this data
| Purpose | Legal basis |
|---|---|
| Providing the service: account, sign-in, assistant, documents, notifications | Performance of the contract between your company and Reverall; for your company, generally its legitimate interests or the performance of your employment contract |
| Sending your data to AI providers | Your agreement, obtained in the app, in addition to the basis chosen by your company |
| Ensuring security and proper operation (logs, backups) | Legitimate interests |
| Billing the company and improving the product, based on usage metrics with no data that identifies you and no content | Reverall's legitimate interests |
We do not use your data for advertising.
5. Who receives your data
Your data is accessible only to authorized people in your company, according to the permissions set by its administrator, and to the Reverall teams who need it for the service.
It is also processed by the following service providers, in addition to the AI providers in section 3:
| Service | Role | Data | Location |
|---|---|---|---|
| Scaleway SAS | Hosting, file storage, backups | All data in the instance | France (Paris); backup copy in the Netherlands (Amsterdam) |
| Hetzner Online GmbH | Hosting of instances opened before September 2026 | All data in these instances | Germany (Falkenstein) |
| Scaleway SAS, email | Sending sign-in links and email notifications, if enabled | Email address, message content | European Union |
| Digital Shift OÜ (Capgo), then Apple (APNs) | Notifications on iPhone | Person's identifier, document title and beginning of its summary, unread count | Estonia (vendor); possible processing in the United Kingdom, the United States, and elsewhere |
| Ybug s.r.o. | Bug reporting, on the web and the desktop app only (not in the mobile app) | Screenshot, technical information, message and address you provide, only if you send a report | Germany; possible transit through the United States |
| GitHub, Inc. | Setting up the company's instance | Company name, name and email of its administrator | Possibly outside the EU |
Services connected by your company or by you. If you connect Google Workspace, Microsoft 365, Granola, or Linear, data flows between Spine and these services on behalf of your account. These services are chosen by your company or by you, and are subject to their own terms. What the assistant reads there is sent to the AI provider to answer you.
If you connect Spine to another assistant yourself (for example, through the MCP protocol), the data that this assistant reads is processed by its provider, which Reverall does not choose.
We do not sell your data. We do not share it with advertisers or data brokers.
6. Transfers outside the European Union
By default, Spine processes your data in France (Scaleway) or in Germany (Hetzner, for older instances).
Some services may process data outside the European Union: Capgo and Apple for notifications, OpenAI outside the European project, Google (Gemini), Exa, Anthropic, Ybug (transit), and the services you connect.
Each transfer outside the European Union is subject to one of the safeguards provided for by the GDPR (Articles 45 and 46), depending on the provider and the country concerned:
- an adequacy decision by the European Commission, which recognizes that the country provides an equivalent level of protection (for example, the United Kingdom, or U.S. companies certified under the EU-U.S. Data Privacy Framework);
- failing that, the standard contractual clauses adopted by the European Commission, incorporated into the contract or the data processing agreement entered into with the provider, supplemented where necessary by technical and organizational measures.
You can obtain information about the safeguard that applies to a provider, or a copy of it, by writing to us at hello@iamspine.com.
7. How long we keep your data
| Data | Retention period |
|---|---|
| Account and content | As long as your account is active, then 6 months after its deletion or the end of your company's contract |
| Deleted files | A technical copy remains for up to 30 days, then is erased |
| Backups | 6 months |
| Technical logs | 6 months |
| Usage metrics (with no data that identifies you) | 6 months |
| With AI providers | Varies by provider. Scaleway does not retain requests by default (see section 3); the other providers may keep them for a few weeks to detect abuse, then erase them |
8. Security
- Each company has its own instance: its data is not mixed with that of other companies.
- Communications between the app and the server are encrypted (HTTPS).
- Backups are encrypted on recent instances.
- The usage metrics sent to Reverall contain no name, no email, and no content.
- Data is encrypted at rest.
- Access to data by Reverall teams is restricted to the people who need it, and is controlled.
9. Mobile app permissions
The app asks for a permission only when you use the feature concerned. You can revoke it at any time in your phone's settings.
| Permission | Why |
|---|---|
| Camera | To take a photo of a document in order to add it. On Android, the app uses the system camera without requesting permission. |
| Microphone | To dictate a message. |
| Speech recognition (iPhone) | To convert your dictation into text. It uses the Apple or Google speech recognition service built into the phone, which may process the audio on its servers according to its own rules. |
| Notifications (iPhone) | To let you know when a document is waiting for you. |
Spine does not access your location, your contacts, or your photos, other than those you choose to add.
10. No advertising, no tracking
Spine contains no advertising. It does not use your data to track you across other apps or websites, and does not share it with data brokers.
11. Your rights
You have the right:
- to access your data and obtain a copy of it;
- to have it corrected;
- to have it erased;
- to restrict its processing or to object to it;
- to retrieve the data you have provided (data portability);
- to withdraw your agreement to your data being sent to AI providers, at any time. Without this agreement, Spine can no longer be used.
- to give instructions on what happens to your data after your death.
How to exercise them. As your company is generally the controller, contact it first (its Spine administrator or its Data Protection Officer). You can also write to us at hello@iamspine.com: we will forward your request to your company, or answer it directly when we are the controller. We respond within one month.
Complaint. If you believe that your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority: www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.
12. Deleting your account
You can request the deletion of your account and the associated data:
- directly in the app: My profile → Delete my account;
- from your company's Spine administrator;
- or by email to hello@iamspine.com, from your account's email address.
As soon as the request is made, your account is deactivated: you can no longer sign in, and your sessions are closed on all your devices. Your company's administrator can reactivate it.
Your name and email address are erased within 6 months. The documents you have shared with your company belong to it: they remain at its disposal.
Some data may be retained until it is erased from backups (see section 7) or where required by law.
13. Minors
Spine is a professional tool reserved for people aged 18 and over. It is not intended for children.
14. Changes
We may update this policy, in particular when a provider changes. The date at the top of the page indicates the latest version. In the event of a significant change, we will inform you in the app or by email.
15. Contact
Reverall, 62 rue du Renard, 76000 Rouen, France
Email: hello@iamspine.com
Data Protection Officer: Olivier Martineau, hello@iamspine.com