Privacy policy

Data controller

[À COMPLÉTER], trading as Elma Lab (SIREN [À COMPLÉTER]), [À COMPLÉTER]. For any question about personal data: [email protected].

Data we process and why

• Your messages: if you write to us by email or through the contact form, we process what you tell us (name, company, email address, message) to reply and follow up on your request. Legal basis: pre-contractual steps and our legitimate interest in answering business enquiries.
• Booking a call: when you book on our booking page, we record your name, email address, the task you want to stop doing (with the example service you may have picked), the chosen slot, your time zone and the language of the page. This information is used to schedule and prepare the call, to send you the confirmation, a reminder about 24 hours before and the messages related to a change or cancellation. An event is created in our Google Workspace calendar, with a Google Meet invitation sent to your address. To limit abuse, we keep a non-reversible fingerprint of your IP address, never the address itself. Legal basis: pre-contractual steps.
• Technical data: like any website, our host records connection logs (IP address, date and time, pages requested) needed to run and secure the site. Legal basis: legitimate interest.
• Client relationship: if we work together, we process the data needed to perform the contract and meet our accounting and legal obligations.

Cookies and trackers

This site uses no advertising cookies, no analytics tool and no tracking technology. The only exception is the booking page, which loads an anti-bot check (Cloudflare Turnstile) needed to keep the form secure: it is not used for advertising or audience measurement. No consent banner is therefore needed. If that changes, this page will be updated and your consent collected before anything is set.

Recipients and processors

Your data is neither sold nor shared for commercial purposes. It is accessible to Elma Lab and to the providers strictly needed to run the site and our exchanges:

• Vercel Inc.: site hosting.
• Resend: email delivery of the contact form messages and of the booking emails (confirmation, reminder).
• Google: Google Workspace calendar (Google Calendar and Google Meet), where the event for each booked appointment is created.
• Supabase: hosting of the bookings database.
• Cloudflare: anti-bot check (Turnstile) on the booking page.

Transfers outside the European Union

Some of these providers are based in the United States. Any transfer is covered by the safeguards provided by the GDPR, such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework, depending on the provider.

Retention

• Messages and exchanges with a contact that did not lead to a collaboration: 3 years after the last contact.
• Call bookings (contact details, form answer, slot): the data recorded in our database is deleted 12 months after the date of the call. To ask for earlier deletion, write to [email protected].
• Client data: for the duration of the contractual relationship, then for the legal retention periods (notably 10 years for accounting records).
• Technical hosting logs: per the host's own retention period.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data. To exercise them, write to [email protected]; we reply within one month. You can object to being contacted again at any time.

If, after contacting us, you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

Security

We limit the data collected to what is needed and access to the people who need it. The site is served over HTTPS.

Changes

This policy may change, for example if we add a service to the site. The date of the last update is shown at the top of the page: October 5, 2026.