Your data
Privacy.
This is the most serious page on the site. Everything on it is true, and it tells you everything.
Last updated: November 13, 2026
In short
- We sell no data. We share none. We don’t want any.
- The pages of this site set no cookies and run no analytics. Only the account, if you create one, uses a cookie: the one that keeps you signed in.
- An account is a username and a password. Email is optional, and we only write to you when you ask us to.
- Your order and your gift cards are encoded in their link. An order only reaches us if you choose to file it in your account or to receive its link by email.
- The newsletter is optional. Your address only joins it after confirmation, and every email has a link that erases it.
- Deleting your account takes one click and erases everything, immediately.
Who is responsible
The data controller is the publisher of this site: [TO BE COMPLETED]. For any question about your data: [TO BE COMPLETED].
What actually exists, and for how long
This is the complete list. If it isn’t in this table, we don’t have it.
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Server logs: IP address, date and time, page requested, browser, response code | To run the site and protect it from abuse | Legitimate interest | 7 days, then deleted automatically by our host |
| IP address, used as a key when you place an order | To stop bots from inflating the counter | Legitimate interest | 1 minute |
| The “Riens ordered to date” counter | To show it on the homepage | None: it isn’t personal data | As long as the site exists. It’s a number, and that’s all. |
| Account: username, hashed password (unreadable, even to us), language, creation date | To let you sign in | Performance of the service you request | Until you delete the account, in one click |
| Account email address, if you add one and confirm it | To recover your password; to send you an order link, if you ask | Consent | Until you remove it or delete the account |
| Address awaiting confirmation | To send you the one message asking you to confirm it | Consent | 24 hours (48 hours if sending is postponed), then erased automatically |
| Orders filed in an account: number, status, configuration | To find them again from your account | Performance of the service you request | Until you remove them or delete the account |
| A guest’s order email request: address and order code | To confirm the address, then send the single message | Performance of your request | Erased as soon as it is sent. Unconfirmed: 24 hours (48 hours if sending is postponed) |
| Email waiting to be sent (address and content), if our email service’s daily quota is reached | To send it the next day | That of the email concerned | Until sent, 48 hours at most |
| Password reset token (hashed), tied to the confirmed address | To check the “new password” link | Performance of your request | 60 minutes |
| Keyed fingerprints of the email address, IP and username (never in plain text), with a counter | To stop anyone flooding someone else’s inbox, or trying passwords in bulk | Legitimate interest | 1 minute (sign-in), 1 hour (sign-up and sending), 24 hours (confirmation requests) |
| Session: a file on the server (random identifier, anti-forgery token and, if you are signed in, your account number), pointed to by the session cookie | To keep you signed in and protect forms | Strictly necessary | Until you sign out, or 14 days without a visit |
| Sending logs at Brevo: recipient address, subject, date, delivery status | To prove and track email delivery | Legitimate interest | [TO BE COMPLETED] |
| Pending newsletter subscription: address and language | To send you the one message asking you to confirm the address | Consent | 24 hours (48 hours if sending is postponed), then erased automatically. Erased on our side as soon as it is confirmed |
| Newsletter subscribers: address, language (one list per language), sign-up date. Kept at Brevo, not by us | To send you the newsletter: the first issue, empty, then update announcements | Consent | Until you unsubscribe. Through the link in our emails, or by deleting your account: erased immediately at Brevo. Through the link in an email sent from Brevo: Brevo keeps the address on its suppression list, only so as not to write to you again |
| Technical backups of the database (accounts included) | To restore the site after a failure | Legitimate interest | [TO BE COMPLETED] |
Your orders and gifts
When you order Rien, your configuration and order number are written into the page link, after the # sign. Your browser never sends that part of the link to our server, so it doesn’t even appear in our logs.
The same goes for “Give Rien” cards: the message and the name travel inside the link, which you pass on yourself. We don’t see them and we don’t store them. Anyone with the link can read them, so share it as you would share the card.
When you place an order, your browser only asks the server to add 1 to the counter. No order information is sent.
If you choose “Add to my account” or “Get the link by email”, the order code is then sent to the server, at your request and only at that moment. See the table above.
In your browser
No local storage (localStorage, sessionStorage, IndexedDB), no tracking pixels, no third-party analytics scripts. One cookie only, the session cookie, and only on account pages. See the Cookies page. Cookies
Our technical providers
Two technical providers, and that’s all:
- Infomaniak Network SA (Rue Eugène-Marziano 25, 1227 Les Acacias (GE), Suisse), which hosts the site and keeps the server logs. Switzerland benefits from a European Commission adequacy decision: your data is protected there to a standard equivalent to the GDPR.
- Sendinblue SAS (Brevo) (106 boulevard Haussmann, 75008 Paris, France), which sends the emails you ask for: address confirmation, order link, new password, newsletter. Brevo is a French company, subject to the GDPR. It also keeps the list of newsletter subscribers, and nothing else: for every other email, it only receives the message, at the moment it is sent.
What remains after an account is deleted
The account, its address and its orders are erased immediately. If that confirmed address was subscribed to the newsletter, it is erased at Brevo too. All that remains are technical traces that erase themselves: server logs (7 days), sending-limit fingerprints (24 hours at most), Brevo’s sending logs ([TO BE COMPLETED]) and backups ([TO BE COMPLETED]).
Your rights
You have the right to access, rectify, erase, restrict, object to and port your data. Write to us: [TO BE COMPLETED].
If you have an account, you can do it all yourself from your account page: download your data, remove your address, delete the account.
Otherwise, in all honesty, we probably won’t have anything to send you: we don’t know who you are, and server logs delete themselves after 7 days.
You can also lodge a complaint with your data protection authority (in France, the CNIL: cnil.fr).