Privacy Policy

Last updated: August 5, 2026. Applies to the EMASES website, the EMASES listings on Microsoft AppSource, and the YOYP Budget & Expenses Hub platform.

1. Who we are

EMASES is a French company (SASU), registered in France under RCS Créteil 990 457 665, with its registered office at 251B rue Paul Vaillant Couturier, 94140 Alfortville, France. EMASES designs, builds and operates governed business platforms on Microsoft technology, and is the data controller for the personal data described in this policy.

For anything related to personal data, contact us at privacy@emases.eu.

2. What this policy covers

This policy explains how EMASES handles personal information across:

• The EMASES website, emases.eu, including its French-language pages.
• Our Microsoft AppSource listings, including YOYP Budget & Expenses Hub, a governed budgeting, expense and forecasting platform for finance teams, built on Microsoft Power Pages and Microsoft Dataverse and deployed into the customer's own Microsoft tenant.
• The platform itself, once deployed at a customer.

3. The platform: your organisation owns and controls its data

YOYP Budget & Expenses Hub runs inside the customer's own Microsoft environment. This has a direct consequence for privacy:

• Your organisation is the data controller for all data inside its deployment of the platform, including any personal data of its users such as names, email addresses and role assignments used for sign-in and access control. That data lives in your organisation's Microsoft tenant, protected by your organisation's own Microsoft security, and governed by your organisation's policies.
• EMASES does not host, collect, or have standing access to this data. Where EMASES assists with deployment or support, any access takes place at the customer's request and under the customer's control and agreements, with EMASES acting on the customer's instructions.
• Within the platform, access is role-based: each signed-in person sees only the data their role and assignments permit, enforced by Microsoft Power Pages table permissions and web roles.

4. The optional AI assistant

The platform includes an optional, read-only AI assistant that explains figures and drafts reports. If a customer enables it:

• When a signed-in person asks a question or generates a report, the figures needed for that request are sent to our AI provider, Anthropic, to generate the narrative. Only the data that person is already permitted to see can be included, because the assistant reads through their own session and permissions.
• The relay operated by EMASES is stateless: it verifies the person's sign-in, passes the request on, and keeps no copy. Request content is not stored or logged by EMASES.
• Under the AI provider's commercial terms, data submitted through its API is not used to train its models and is retained only briefly for trust-and-safety purposes. Where this involves a transfer outside the European Economic Area, it takes place under appropriate safeguards in the provider's data processing terms.
• The assistant can never create, change, or delete data, and the feature can be switched off entirely, in which case nothing leaves the customer's environment.
• If a customer requires that data never leave their own Microsoft environment, the assistant can instead use a model running in the customer's own Azure tenant. In that setup, no figures are sent to Anthropic.

5. What EMASES collects, and why

We do not sell personal data, we do not use it for advertising, and we do not carry out automated decision-making or profiling.

The EMASES website uses no analytics tools, no advertising trackers and no non-essential cookies.

6. Who we share personal data with

• Microsoft, as the operator of AppSource and of the Microsoft cloud services our website, listings and business systems rely on.
• Anthropic, as the AI provider for the optional assistant, as described in section 4.
• Vercel, as the hosting and delivery provider for the EMASES website.
• Service providers, we use to run our business, such as email and accounting, under appropriate agreements.

We share personal data with no one else, and never for their own marketing. Where a transfer outside the European Economic Area occurs, it is covered by the relevant provider's data processing terms and appropriate safeguards.

7. How long we keep it

• Enquiries and leads: as long as needed to handle the enquiry and follow up, and no longer than 3 years after our last contact.
• Contract and invoicing records: for the periods required by French law.
• AI assistant requests: not stored by EMASES at all, as described in section 4.

8. Security

EMASES applies appropriate technical and organisational measures: the platform's data never leaves the customer's Microsoft environment; access within the platform is role-based and enforced by the platform itself; the AI relay is stateless and keeps no content; and our own systems run on Microsoft cloud services with access limited to those who need it.

9. Your rights

Under the GDPR, you have the right to access, rectify, and erase your personal data, to restrict or object to its processing, and to data portability. To exercise these rights, contact us at privacy@emases.eu. You also have the right to lodge a complaint with the French supervisory authority, the CNIL (cnil.fr).

If your question concerns data inside your organisation's deployment of YOYP Budget & Expenses Hub, your organisation is the controller for that data, so please contact your organisation's administrator; we will assist them where needed.

10. Changes to this policy

If we change this policy, we will update this page and the date at the top. Significant changes affecting customers will be communicated directly.