Privacy policy

Last updated: 30 September 2026.

This English version is provided for convenience. The French version prevails.

Controller

Yann Touanen, Bordeaux, France, contact@yanntouanen.com.

Principle

Only the data needed for each purpose is collected. There is no audience measurement, no advertising, no tracking cookie, and nothing is sold on.

Visitors' IP addresses are never written to the database. They are used in memory, briefly, to rate-limit form submissions and stop bots.

What is collected

• Contact form: name, email, subject, Instagram handle if given, message. To answer you. Kept three years after the last exchange.
• Lesson booking: name, email, phone, Instagram handle if given, message, slot, language, Stripe payment references. To run the lesson and invoice it. Contact data kept three years; accounting records ten years.
• Software purchase and licence: email, name given at payment, Stripe references, a technical fingerprint of the activated computer, operating system, plug-in version, activation dates. To deliver the key, enforce the seat limit and provide support. Kept for the life of the licence, then three years; accounting records ten years. The licence key is stored encrypted and hashed, never in clear text.
• Free trial: device fingerprint, start and last-seen dates, plug-in version. To run the trial period and prevent endless restarts. Kept two years after the last contact. No name or email is required to try.
• Newsletter: email address, on your consent, until you unsubscribe, which takes one click in every message. Sending is handled by Brevo, a French company.

The device fingerprint is an irreversible digest of a hardware identifier. It cannot identify you directly, but it is personal data because it is attached to your licence.

Recipients

Vercel (hosting and file storage), Neon (database), Stripe Payments Europe (payments and invoicing), Resend (transactional email), Brevo (newsletter). Nothing is sold, rented or shared for advertising.

Transfers outside the EU

Some providers are established in the United States. Such transfers rely on the European Commission's standard contractual clauses and, where applicable, the provider's certification under the EU–US Data Privacy Framework.

Security

Traffic is encrypted. Secrets and licence keys are encrypted at rest. Administration access is restricted and password-protected.

Automated decisions

None. No profiling is carried out.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability, and the right to give directions about your data after your death. Where processing relies on consent, you may withdraw it at any time.

Write to contact@yanntouanen.com; you will get an answer within one month.

If you believe your rights are not respected after contacting us, you may lodge a complaint with the French data protection authority, CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.