Privacy Notice
What personal data Lokom holds, why, where it lives, and how to get it back or erased.
1. Who we are
Lokom is commission-management software for sales teams using Pipedrive. This notice explains what personal data we handle when you use it.
The controller for the data described in section 3 is Nicolas Roulis EI, an *entreprise individuelle* registered in France under SIREN 877 528 109, 173 rue de Courcelles, 75017 Paris. Lokom is the name the service is sold under, not the legal name.
Contact for any question or request in this notice: [email protected].
We have not appointed a Data Protection Officer. Lokom does not carry out large-scale systematic monitoring of individuals, so none is required under GDPR Art. 37 at our current scale.
2. Two different roles, and why it matters to you
Lokom handles personal data in two capacities, and your rights work differently in each.
As a controller, for the people who sign into Lokom: account holders, administrators, and anyone we email. We decide why and how that data is used.
As a processor, for the data your organisation loads into Lokom about its sales representatives and its deals. Your employer decides why that data exists; we only act on their instructions. If you are a sales rep whose commission is calculated in Lokom, your employer is the controller — send access or erasure requests to them, not to us. We will help them answer you, and we will tell you where to go if you write to us by mistake.
3. Data we handle as a controller
| Category | Examples | Where it comes from |
|---|---|---|
| Account identity | name, email address, password hash, preferred language | you, at sign-up |
| Authentication | session tokens, sign-in timestamps | generated when you sign in |
| Billing | company name, billing address, VAT number, card country, last four digits, invoice history | you and Stripe. We never see or store your full card number — it goes directly to Stripe |
| Support | messages you send us in the in-app chat, and your name and email alongside them | you, when you start a conversation |
| Product analytics | pages viewed, features used, a pseudonymous device identifier — only if you accept it | your browser, once you accept the cookie banner (see section 9) |
| Security and audit | IP address, browser user-agent, the action taken, and a sanitised before/after of configuration changes | your requests |
The audit trail is deliberately narrow. It records that an action happened and by whom; it does not record commission amounts, payout values or deal values, and our logging rules forbid writing those into logs.
4. Data we handle as a processor
When your organisation connects Pipedrive, Lokom reads:
- Deals — value, currency, stage, close date, owner, and the deal fields
your administrator selects as commission inputs.
- Pipedrive users — name and email, so a deal can be attributed to a rep.
We request the OAuth scopes `deals:read` and `users:read` and nothing else. Both are read-only: Lokom cannot modify or delete anything in your Pipedrive account, and does not ask for permission to.
Your administrator additionally creates, inside Lokom, records for the people being paid: name, email, team, role, quota or on-target earnings, and the resulting commission calculations. This is HR-sensitive data and we treat it that way — see section 8.
5. Why we handle it, and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the service you signed up for | Performance of a contract, Art. 6(1)(b) |
| Taking payment and issuing invoices | Contract, Art. 6(1)(b), and a legal obligation for invoice retention, Art. 6(1)(c) |
| Service emails (invitations, payment failures, deletion warnings) | Contract, Art. 6(1)(b) |
| Keeping the service secure, and the audit trail | Legitimate interests, Art. 6(1)(f) — running a multi-tenant system safely |
| Product analytics | Consent, Art. 6(1)(a) — see section 9 |
| Answering support requests | Legitimate interests, Art. 6(1)(f) |
We do not sell personal data, we do not share it for advertising, and we do not use it to train machine-learning models.
6. Who else processes it
These are our sub-processors. Each is bound by a contract restricting them to our instructions.
| Provider | What for | Where it processes |
|---|---|---|
| Supabase | Database and authentication | EU — Ireland (`eu-west-1`) |
| Railway | Application backend | EU West |
| Vercel | Web frontend and its API proxy routes | United States — Washington DC (`iad1`). See section 7 |
| Stripe | Payments, invoicing, tax | EU and United States |
| PostHog | Product analytics, only once you consent | EU — `eu.posthog.com` |
| Sentry | Error monitoring | EU — Germany (`de.sentry.io`) |
| Crisp | In-app support chat | EU — France |
| Pipedrive | The CRM you connect. Your data stays yours; we read from it | Your own Pipedrive region |
Stripe, Supabase, Vercel, PostHog, Sentry and Crisp each publish a standard Data Processing Agreement that applies automatically when their service is used to process personal data; using each of these services constitutes acceptance of those terms.
7. Data leaving the EU
Your data is stored in the European Union. The database, the authentication system and the analytics all run in EU regions.
One part does not. Our web frontend is hosted by Vercel in the United States (iad1). Some browser requests pass through it on their way to our EU backend — for example when you update your profile or load your Pipedrive field list. Data transits the United States there; it is not stored there.
That transfer relies on the European Commission's Standard Contractual Clauses, which Vercel has in place for exactly this kind of transfer. Stripe's US transfers rely on the same Standard Contractual Clauses, and Stripe also self-certifies under the EU–US Data Privacy Framework.
If you would rather this transit did not happen, tell us — it is a hosting region setting, not an architectural constraint.
8. How we protect it
- Tenant isolation is enforced twice. Every query is filtered by
organisation in the application, and PostgreSQL row-level security enforces the same boundary underneath it. A missed filter returns no rows rather than someone else's.
- Credentials are never stored in plain text. Pipedrive and Stripe tokens
live in a secrets vault; other sensitive values are encrypted with AES-256-GCM.
- Payout values stay out of logs. Our internal rules forbid logging
commission amounts, deal values or personal identifiers, and an automated check runs against the commission and billing code on every commit.
- Traffic is encrypted in transit. Passwords are hashed and never recoverable.
No system is perfectly secure, and we would rather say so than imply otherwise.
9. Cookies and analytics
Lokom uses cookies and local storage for two things:
- Signing you in. Strictly necessary; the service cannot work without them.
- Product analytics, through PostHog, if you agree to it.
Analytics cookies are off until you say otherwise. When you first visit lokom.org or app.lokom.org, a banner asks you to accept or reject audience measurement — refusing is exactly as easy as accepting, and nothing from PostHog loads until you accept. Your choice is remembered for six months, is shared across lokom.org and the app so you are only asked once, and you can change it at any time from the "Cookies" link in the footer.
| Cookie | Purpose | Expiry |
|---|---|---|
lokom_consent | Records the choice you made here | 6 months |
ph_* | Distinguishes one visit from the next, only once you accept | 1 year |
We do not build a profile of you before you have an account, and automatic capture of everything you click is turned off.
10. How long we keep it
| Data | Kept for |
|---|---|
| Your account and your organisation's data | While the account is open |
| After you ask us to delete the organisation | A 14-day grace period, during which you can cancel. Then every record belonging to it is erased |
| Proof that a deletion happened | Kept permanently, by design. It records that an organisation was deleted, when, and on whose instruction — nothing about the people in it |
| Invoices and billing records | 10 years, under Art. L123-22 of the Code de commerce |
| Security and audit logs | 12 months is the target. No automated deletion job enforces this yet — logs currently accumulate without limit, which we are correcting |
| Backups | 7 days, under our current Supabase plan. A deletion reaches the live database immediately; it ages out of any backup taken before it within that 7-day window |
The deletion is real. When the grace period ends, an automated pipeline erases every table belonging to your organisation and then re-counts them to prove nothing was left behind. A test in our build fails if a new table is ever added without a deletion rule, which is what stops this promise from quietly decaying.
11. Your rights
Under GDPR you can ask us to: give you a copy of your data; correct it; erase it; restrict or object to how we use it; and give it to you in a portable format. Where we rely on consent, you can withdraw it at any time.
Write to [email protected]. We will reply within one month.
If your commission is calculated in Lokom by your employer, ask them instead — they decide what happens to that data. Write to us anyway if you cannot reach them and we will point you the right way.
You can complain to the French data protection authority, the CNIL (cnil.fr), or to the authority where you live.
12. Changes
If we change this notice materially we will email account holders before it takes effect. The date at the top always reflects the current version.