In force since 2026-09-28.
This page says what we store about you, why, for how long, and what you can do about it. It is written to be checked against the software, not to reassure.
The data controller is the publisher identified in the legal notice. Contact for any privacy question: clement@gautier.im.
| Category | Data | Legal basis | Retention |
|---|---|---|---|
| Account | Email address, whether and when it was confirmed, hashed password, optional company name | Performance of the contract | Until you delete the account, then 30 days |
| Billing | Invoices and the payment reference from Stripe. We never store card numbers. | Legal obligation | 10 years — accounting obligation |
| API usage | Per-call counters attached to your key, for quota and billing | Performance of the contract | 13 months |
| Traffic attribution | Aggregate daily counts of which campaign, source or referring site a visit came from, plus the campaign labels on your own signup. Counters only: no IP address, no device identifier, nothing stored on your device, and no row that can be traced back to a person. | Legitimate interest — preventing abuse of a free service | 26 months (aggregates, non-identifying) |
| Advertising click identifier | If you reached us from an ad, the identifier the ad platform added to the link (for example gclid or fbclid), kept on your account. This one does identify a specific click, so it is listed separately and deleted sooner than the labels above. | Legitimate interest — preventing abuse of a free service | 90 days, then erased |
The register data itself describes companies rather than people. One exception is honest to state: a sole trader's registration is attached to a natural person, so a part of the public register does concern identifiable individuals. We republish it as ADEME publishes it, under the Licence Ouverte, and we do not enrich or cross-reference it.
Stripe, for payment. Our host, to run the servers. Nobody else: we sell evidence, not data, and there is no third-party advertising or analytics vendor on this site. Audience measurement runs on our own servers, so the figures never leave our infrastructure.
The service and its backups are hosted in France. Stripe may process payment data outside the EU under the European Commission's standard contractual clauses.
Passwords are stored hashed with scrypt, never in clear. Sessions use HttpOnly cookies over HTTPS only. Backups are encrypted in transit and kept off-site.
You may access, correct, delete, or export your data, object to its processing, or ask us to restrict it. Write to clement@gautier.im; we answer within one month. You may also complain to the CNIL, the French data protection authority, at cnil.fr.
This site sets 3 cookies, all strictly necessary to a function you asked for. None of them tracks you, profiles you, or follows you to another site. There is no advertising or audience-measurement cookie here, which is why there is no consent banner: under article 82 of the loi Informatique et Libertés there is nothing to consent to. We list them anyway, as the CNIL recommends.
| Cookie | Purpose | Retention | Why no consent is needed |
|---|---|---|---|
repere_session |
Keeps you signed in to your dashboard | 30 days, or until you sign out | Authentication to a service you requested |
repere_csrf |
Blocks forged requests made in your name | Session | Security of the authentication mechanism |
repere_lang |
Remembers whether you chose French or English | 1 year | Interface personalisation — language choice |
Your browser can block these cookies. If you block them, signing in stops working — they are what makes that feature possible.