Skip to content
MRRup

Privacy policy

Last updated 21 October 2026

This policy explains what personal data QUASYN LABS (“MRRup”, “we”) collects, why, and what rights you have under the General Data Protection Regulation (GDPR) and French data protection law.

Who is responsible

The controller is QUASYN LABS, 47 rue Vivienne, 75002 Paris, France. For any privacy question or request, email contact@mrrup.io.

What we collect and why

When you contact us. Your name, email address, the content of your message and any details about your product you choose to share. We use them to reply and to prepare a proposal. Legal basis: steps taken at your request before a contract, and our legitimate interest in answering enquiries. We keep them for 3 years after our last exchange.

Clients and client accounts. Contact details of the people we work with, the Google account name, email and profile picture used to sign in to the client dashboard, and the records of each engagement (scope, findings, reports, invoices). Legal basis: performance of our contract. Accounts are deleted when access is removed. Engagement records are kept for the duration of the relationship plus 5 years; invoices and accounting records for 10 years, as French commercial law requires.

Business prospecting. We may contact founders and companies whose businesses are publicly listed, for example on startup directories and marketplaces, about services relevant to their role. We use business contact details and business information they or their company have published, such as name, work email, company website and publicly displayed business metrics. Legal basis: our legitimate interest in offering our services to businesses. You can object at any time by replying “unsubscribe” or emailing us; we then keep only what is needed to never contact you again. Otherwise we keep this data for 3 years after our last contact.

Product testing. When our testers use a client’s product, they may see personal data held in it. We process that data only on the client’s behalf and instructions, as a processor, and only to carry out the test. We keep screenshots and notes to the minimum needed to document findings, avoid capturing the client’s users’ data wherever possible, and delete test credentials at the end of the engagement.

Testers. If you test for us: your name, contact and payment details, and your session notes. Legal basis: our contract with you. Kept for the duration of the relationship plus 5 years, and longer where accounting law requires.

Payments. Payments are processed by Stripe. We receive the payment status, amount and billing details, never your full card number.

Website visits. Our host records technical logs (IP address, browser, pages requested, time) to keep the service secure and working. Legal basis: our legitimate interest in security. These logs are kept for a short period set by the host.

Cookies

We use no advertising or analytics cookies and no tracking pixels. We only set cookies that are strictly necessary: a session cookie when you sign in, and a cookie remembering your light or dark theme. These do not require consent.

Who receives your data

Your data is accessible to the MRRup team and, for a test, to the testers bound by confidentiality who work on it. We never sell it. We rely on these service providers, acting on our instructions:

We may also disclose data where the law requires it.

Transfers outside the EU

Some of these providers are based in the United States or may process data there. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.

Your rights

You can ask to access, correct or delete your data, to restrict or object to its use, to receive it in a portable format, and to withdraw any consent you gave. You can object to prospecting at any time, without giving a reason. You can also give instructions about what happens to your data after your death. Email contact@mrrup.io; we reply within one month and may ask you to prove your identity.

If you think your rights are not respected, you can complain to the French data protection authority, the CNIL (cnil.fr), or the authority where you live.

Security

Access to personal data is limited to people who need it and protected by authentication. Data is encrypted in transit. Client credentials shared for a test are stored only as long as the test requires.

Changes

We may update this policy. The date at the top shows the latest version; significant changes will be announced to clients by email.