Privacy Policy

Last updated: 2026-10-10

1. Data Collection

We are committed to protecting your privacy and ensuring the security of your personal information.

2. Data Usage

To provide a comprehensive, professional-grade CMMS whose Core tier stays free forever, so businesses of all sizes can optimize their maintenance operations without financial barriers.

3. Data Security

Enterprise-grade security with data encryption, role-based access, and compliance reporting

4. Data retention

We keep your workspace data for as long as the workspace is in use. If nobody signs in and no maintenance activity is recorded for six months, we email the workspace administrators a first notice, followed by reminders 14 days and 7 days before closure. Closing a workspace changes nothing about the data itself: everything is preserved for a further 90 days, and signing in during that period restores the workspace immediately and cancels the scheduled deletion. Only once that period has elapsed is the workspace permanently deleted, along with the personal data it contains, in line with the GDPR storage limitation principle. Workspaces with an active paid subscription are never closed for inactivity. Deleted data, files included, also disappears from our backups within 90 days.

5. Data residency

All customer data (your CMMS records, uploaded files, user accounts) is stored on OVH datacenters located in France (European Union). Backups are encrypted and retained on the same OVH infrastructure. We do not transfer customer data outside the EU except where strictly necessary to operate the service (for example, for transactional emails routed via Brevo's EU infrastructure or for billing via the Merchant of Record once activated). All such transfers, when applicable, rely on Standard Contractual Clauses (SCCs) approved by the European Commission.

6. Data breach notification

FreeMaint acts as your data processor. If we confirm a personal-data breach affecting data we process on your behalf, we notify you without undue delay and within 72 hours — describing the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, and the remediation taken. This commitment is set out in Article 9 of our Data Processing Agreement (available on request at contact@freemaint.com) and meets the deadlines that breach-notification laws place on a processor, including GDPR Article 33 and US state laws such as the Florida FIPA. You then have what you need to notify affected individuals within your own statutory deadline.

7. Your Privacy Rights (GDPR & LGPD)

8. Cookies & Tracking

9. Sub-processors and infrastructure

FreeMaint relies on the following third-party service providers (sub-processors) to operate the platform. Each provider is bound by data processing agreements consistent with GDPR Article 28. We do not sell or share your data with any party for advertising or marketing purposes.

10. Public report forms (QR codes)

Organisations using FreeMaint can display QR codes on their equipment so that anyone on site — an employee, a student, a contractor — can report a problem without an account. This section describes that specific case.

11. Children's Privacy

Our services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page.

13. Data Protection contact

For all data protection requests (access, rectification, erasure, portability, objection) or any GDPR-related inquiry, contact: