Privacy Policy

Last updated: March 2026

This Privacy Policy describes how Sébastien Gonin, Sole Proprietorship, operating under the trade name Capsul (hereinafter "we," "our," or "Capsul") collects, uses, stores, and protects the personal data of users (hereinafter "you" or "the User") of the Capsul service (hereinafter "the Service"), in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable data protection laws.

Article 1 — Data Controller

The data controller is Sébastien Gonin, Sole Proprietorship, registered in Nice (06), France. SIRET: 911 087 591 00010. For any questions regarding the protection of your data, you may contact us at: la.fabrique.des.reves06@gmail.com.

Article 2 — Data Collected

In connection with the provision of the Service, we collect the following categories of data:

Identification data: name, surname, email address, profile picture (via Google OAuth)
Content data: messages written in capsuls, capsul titles, chosen opening dates
Usage data: IP address, browser type, pages visited, connection dates and times, actions performed on the Service
Transaction data: pack purchase history, amounts paid (credit card data are processed exclusively by Stripe and are never stored on our servers)
Recipient data: email addresses of capsul recipients

Article 3 — Legal Basis and Purposes of Processing

We process your personal data on the following legal bases:

Performance of a contract (Article 6(1)(b) GDPR): processing is necessary for the provision of the Service, including account creation, capsul management, and message delivery on the chosen date
Consent (Article 6(1)(a) GDPR): for sending marketing communications and personalizing the user experience
Legitimate interest (Article 6(1)(f) GDPR): for improving the Service, fraud prevention, and Service security
Legal obligation (Article 6(1)(c) GDPR): for compliance with our accounting and tax obligations related to transactions

Article 4 — Data Storage and Security

Your data is stored in a securely hosted PostgreSQL database. We implement appropriate technical and organizational measures to protect your data against unauthorized access, modification, disclosure, or destruction.

Security measures include: encryption of data in transit (TLS/SSL), encryption of sensitive data at rest, strict access controls based on the principle of least privilege, regular backups, and continuous system monitoring.

Article 5 — Cookies

The Service uses cookies strictly necessary for the operation of the application, including for authentication and user session management. These cookies are exempt from consent requirements under applicable law.

Subject to your consent, collected via the banner displayed on your first visit, we use Google Analytics 4 (Google Ireland Limited) to measure site traffic and improve the Service. These cookies (_ga, _ga_*) last no longer than 13 months and are only set after you accept. The data collected (pages viewed, device type, approximate location) may be transferred to the United States under the EU–US Data Privacy Framework. You can withdraw your consent at any time via the ‘Manage cookies’ link at the bottom of every page. No advertising cookies are used.

Article 6 — Third-Party Services

The Service relies on the following third-party providers, which may have access to certain data in connection with their services:

Stripe (Stripe, Inc.): payment processing for pack purchases. Stripe processes your payment data in accordance with its own privacy policy and PCI-DSS standards. Privacy policy: https://stripe.com/privacy
Google OAuth (Google LLC): user authentication. Google processes your identification data in accordance with its privacy policy. Privacy policy: https://policies.google.com/privacy
Vercel (Vercel Inc.): application hosting and request processing. Privacy policy: https://vercel.com/legal/privacy-policy

We ensure that each of these providers offers sufficient guarantees regarding the protection of personal data. Data transfers to countries outside the European Economic Area are governed by standard contractual clauses approved by the European Commission.

Article 7 — Your Rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights regarding your personal data:

Right of access (Article 15): you may obtain confirmation that your data is being processed and access all your personal data
Right to rectification (Article 16): you may request the correction of inaccurate or incomplete data
Right to erasure (Article 17): you may request the deletion of your data, subject to our legal retention obligations
Right to restriction of processing (Article 18): you may request the restriction of processing of your data in certain cases provided for by the GDPR
Right to data portability (Article 20): you may receive your data in a structured, commonly used, and machine-readable format
Right to object (Article 21): you may object to the processing of your data based on legitimate interest, including profiling
Right to withdraw your consent at any time, where processing is based on consent

To exercise these rights, send your request by email to la.fabrique.des.reves06@gmail.com with a copy of an identity document. We are committed to responding within one month in accordance with the GDPR. This period may be extended by two months in the case of complex requests.

Article 8 — Data Retention Periods

Your personal data is retained for the following periods:

Account data: for the duration of Service use, then deleted within 30 days after account deletion
Capsul content: until the capsul's opening date, then for 1 year after opening to allow viewing, unless an earlier deletion request is made
Transaction data: 10 years in accordance with accounting and tax obligations under applicable commercial law
Connection data: 1 year in accordance with applicable legislation
Session cookies: duration of the browsing session

Article 9 — Protection of Minors

The Service is intended for persons aged 13 and over. We do not knowingly collect personal data from children under 13. If we learn that we have collected personal data from a child under 13 without verifiable parental consent, we will take steps to delete such data as soon as possible. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at la.fabrique.des.reves06@gmail.com.

Article 10 — Data Protection Officer

Our Data Protection Officer (DPO) can be reached at la.fabrique.des.reves06@gmail.com. The DPO is your primary contact for any questions regarding the protection of your personal data.

Article 11 — Filing a Complaint with the Supervisory Authority

If you believe that the processing of your personal data constitutes a violation of the GDPR, you have the right to lodge a complaint with the relevant supervisory authority. In France, this is the Commission Nationale de l'Informatique et des Libertes (CNIL) — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07. Website: https://www.cnil.fr. For other EU countries, you may contact your local data protection authority.

Article 12 — Modification of the Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Any substantial modification will be notified to Users by email or notification within the Service at least 30 days before it takes effect. The current version is always accessible on the Service at /legal/privacy.

Legal Terms of Use Terms of Sale