Draft to be reviewed by a lawyer. This text is not in force yet.
Privacy policy
1. Controller
[TO BE COMPLETED: company name], [TO BE COMPLETED: registered address]. Contact for your data: [TO BE COMPLETED: e-mail for personal data requests]. Data protection officer: [TO BE COMPLETED: name and contact of the DPO, or "no DPO appointed"].
2. Data we process
- Account: e-mail address, password (stored only as an irreversible bcrypt hash), language, creation date, last login date, address confirmation.
- Consents: date and version of the accepted terms of sale and privacy policy; newsletter opt-in or not.
- Orders and subscriptions: number, product, price, dates, status, consent to immediate access, withdrawal or cancellation. The website stores no card data: it is handled by the payment provider.
- Account use: followed files, requested alerts, alert settings, list of e-mails sent (type and date).
- Security: open sessions (hashed identifier, date), anti-abuse counters computed from a fingerprint of the IP address (the IP address itself is not stored).
We use no advertising or analytics cookies: see the cookies page.
3. Purposes and legal bases
- Creating and managing your account, giving access to what you bought: performance of the contract.
- Sending account e-mails (address confirmation, forgotten password, order confirmation, acknowledgements): performance of the contract and legal obligation.
- Sending the alerts you chose: performance of the contract (requested service), changeable at any time.
- Sending the newsletter: your consent, withdrawable in one click.
- Bookkeeping and legal obligations: legal obligation.
- Protecting the website against abuse (rate limiting, form security): legitimate interest.
4. Retention
Proposed periods, to be confirmed:
- Account: while active. An account with no login for 3 years may be deleted, after a warning e-mail.
- Account never confirmed: deleted after 7 days.
- Orders and invoices: 10 years (accounting obligations), without your e-mail address if you deleted your account.
- List of e-mails sent: 12 months.
- Links sent by e-mail: address confirmation 48 hours, forgotten password 60 minutes.
5. Recipients
Only the people running the website have access. We do not sell your data. The providers below act on our behalf (processors):
| Provider | Role | Status |
|---|---|---|
| Stripe Payments Europe, Ltd. | Online payment (card), subscriptions, invoices | Planned, not used yet |
| E-mail delivery provider (for example Brevo) | Sending account e-mails and alerts | Planned, not used yet |
| Website host | Hosting of the website and database | Planned, not used yet |
If a provider processes data outside the European Union, the transfer is covered by GDPR safeguards (adequacy decision or standard contractual clauses). Details: [TO BE COMPLETED: transfer safeguards to be specified once providers are chosen].
6. Your rights
You have the right to access, correct and erase your data, to restrict or object to some uses, to data portability, to withdraw consent, and to give instructions about your data after your death.
From your account, "My data" page: download all your data (JSON file) and delete the account. Alerts and the newsletter are set in "Alerts" and with the unsubscribe link in every e-mail. For any other request: [TO BE COMPLETED: e-mail for personal data requests]. We reply within one month.
You can also lodge a complaint with the CNIL (French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.
7. Security
Passwords hashed with bcrypt, sessions and one-time links stored as hashes, protected cookies (HttpOnly, SameSite, Secure over HTTPS), protection of forms against cross-site submissions, rate limiting, data files readable only by the server.
8. Changes
This policy may change. The date and version are shown at the bottom of the page. We will tell you by e-mail about any significant change.
Last updated: 25 October 2026. Version 2026-10-25-brouillon.
