Privacy policy

Maison des Réseaux Sàrl is the controller of your personal data: it decides the purposes and means of processing, and answers for this policy. "Must Network" is the name of the platform it operates, not a legal entity. The application is designed and technically operated by Digital Tales, a studio based in Geneva, on its behalf; Digital Tales acts solely as a technical provider, that is, as a processor within the meaning of the law.

For any question about your data, or to exercise your rights, write to contact@mustnetwork.net, or to the postal address above.

We process four families of data:

• Account data. When you create an account: your email address and your name. If you choose to sign in via Google, we receive from that service your email and the basic public profile information (name, possibly photo). We never receive your password.
• Service usage data. The information you enter while using Must: your relationships, your opportunities, your networking activity. It serves solely to provide you with the service and is visible only to you (and to the people concerned, according to your actions). One exception, on your own initiative: when you ask the Companion about your own situation, a summary of your data is transmitted to our artificial intelligence provider for the time of the reply. See section 5.
• Ecosystem directory. To make the ecosystem visible, Must lists organisations (clubs, venues, providers) and, for some of them, the public professional data of their representatives (name, role, organisation, professional link such as LinkedIn). This information comes from public sources and concerns people in their professional role, not their private life. See section 8 for your right to object.
• Requests you send us. If you fill in one of our public forms (train a school, train a team within a company, become a coach), we receive what you write there: the name of your organisation, your name, your role, your email address, your telephone number if you give it, and the description of your need. You do not need an account for this, and we do not create one without your knowledge. This information serves solely to call you back and to prepare a conversation.

• Providing and securing your account and the service (performance of the contract / your settings).
• Making the networking ecosystem visible and useful (legitimate interest in documenting a public ecosystem).
• Improving the product and preventing abuse (legitimate interest, minimised data).
• Contacting you with information essential to the service (performance of the contract).
• Responding to the requests you send us through our public forms, and preparing the corresponding commercial proposal (pre-contractual measures taken at your request).

The core of Must is hosted in Switzerland and in the European Union. The database, your credentials and your files (profile photo) are hosted by Supabase in the region of Zurich, Switzerland. The application is served by Vercel from the region of Frankfurt, Germany.

Three processing operations fall outside this perimeter, and we prefer to tell you so clearly rather than write a promise we would not keep:

• the sending of your emails is carried out from France, in the European Union. The sending logs and the addresses concerned are kept there, and do not leave European jurisdiction;
• the Companion and the translation are processed in France, in the European Union, and only when you call on them;
• the satellite map backgrounds and the company logos are served from content delivery networks located notably in the United States. These services receive your IP address, like any image loaded from another site.

The details of each provider appear in section 5.

We never sell your data and we never pass it on to anyone for advertising purposes. We call on the technical providers below, strictly necessary for the operation of the service, which act on our instructions.

Always active

• Supabase (database, authentication, storage of your files). Data hosted in Zurich, Switzerland.
• Vercel (hosting and execution of the application). Frankfurt region, Germany. American company.
• Scaleway SAS (Paris, France) for the emails linked to your account: registration confirmation, password reset, invitations and notifications. The sending and the logs remain in France, Paris region. The service receives your email address and the content of the message.
• OpenStreetMap Foundation (United Kingdom) for the map backgrounds. Servers located in the United Kingdom, Ireland, the Netherlands and Norway. The service receives your IP address and the area you are viewing.
• Esri (United States) for the satellite view of the maps, only if you activate it. The service receives your IP address.
• Brandfetch SA (Savigny, Switzerland; content delivery network in the United States) to display the logos of the listed companies. The service receives your IP address.

Only if you trigger them

• Mistral AI SAS (Paris, France) for two functions:
  • the Companion. In “About Must” mode, only your question is transmitted. In “About me” mode, a summary of your situation goes with it: your first name and surname, your company, your business sector, your city, your Relational Capital (score, level, activity level and breakdown by pillar), your opportunities (number, titles, status, expected result, next actions and their due dates), the number of your actions awaiting confirmation, the number of your relationships and how many have had no exchange for more than three months, the number of clubs you have declared and of those that are verified, the ecosystem's upcoming public events, your Must Academy level and your number of certifications, and finally what is still missing from your profile. No data of another member enters this summary: no third-party name appears in it.
  • the translation of a post, when you click on “See translation”. The text concerned is transmitted in order to be translated.
  Mistral AI keeps these requests for thirty days at most, in order to detect abuse, then deletes them. Mistral AI undertakes not to use the data from its professional interface to train its models. You can use Must without ever calling on the Companion or the translation.
• Google (United States) for assisted address entry, when you complete your profile or a listing. The text you type into the address field is transmitted to Google in order to offer you suggestions.
• Google and Apple (United States), LinkedIn (United States, European entity in Ireland), only if you choose to create your account or to sign in through one of these services, and only the one you choose. In that case we receive only your name, your email address and possibly your photo, never your password. The services offered on the sign-in screen may vary: only those that appear there are active.

Today we use no audience measurement or advertising tool, and no tracker for those purposes. Should that change, this page would be updated before activation.

We keep your account data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within a reasonable time, save for a legal retention obligation. The data of the public directory is kept for as long as it remains relevant and public, and is removed upon a request to object (section 8).

Requests sent through our public forms are kept for three years from the last exchange, the usual length of a commercial relationship, then deleted. You may ask for them to be deleted sooner at contact@mustnetwork.net.

In accordance with the revised FADP, you have the following rights:

• to access the data we hold about you;
• to have inaccurate data corrected;
• to request the erasure of your data;
• to object to certain processing operations;
• to obtain a copy of your data in a readable format.

To exercise any of these rights, write to contact@mustnetwork.net, or to the postal address given in section 1. We answer as quickly as we can.

Deleting your account and your data. You may ask at any time for your account and the associated data to be deleted, by writing to contact@mustnetwork.net with the subject "Deletion of my data".

Objection for the people in the directory. If you appear in the ecosystem directory by virtue of a public role and you do not wish to appear there, write to us: we remove your listing from display. The service is designed to honour this objection technically.

We apply appropriate technical and organisational measures: compartmentalisation of access at database level (row level security), principle of least privilege, encryption of exchanges, secrets never exposed on the client side, hosting in Switzerland. As no system is infallible, we continuously improve our security.

Must uses the cookies strictly necessary for your sign-in (maintaining your session). We do not use advertising cookies. Any audience measurement that may take place is carried out in a privacy-respecting way.

We may update this policy. In the event of a significant change, we will inform you through the service. The date of the last update appears at the top of this page.

For any question about this policy or your data: contact@mustnetwork.net.