Draft. These pages are published for reference and have not been reviewed by counsel. They predate the current freemium offering and mix English and French. Do not rely on them as the operative agreement.

Privacy Policy

1. Data controller

MirrorWhales (personal project, non-professional publisher under LCEN Art. 1-1, II). Contact: contact@mirrorwhales.com.

2. DPO

No Data Protection Officer designated — the Art. 37 GDPR threshold is not met (solo operator, no large-scale processing, no systematic monitoring of data subjects).

3. Data we collect

  • Account data: email, argon2id-hashed password, role.
  • Session data: session token, pseudonymised IP (HMAC-SHA256), user-agent fingerprint, timestamps.
  • Audit events: login attempts, MFA actions, password changes, session revocations, data-export requests.

4. Purposes & legal basis (GDPR Art. 6)

  • Service delivery & account management — contractual necessity.
  • Abuse prevention & security — legitimate interest; IP addresses are pseudonymised immediately.
  • Legal obligations — compliance where applicable.

5. Retention

  • Account data: until account deletion + 30 days soft-delete window.
  • Audit logs: 12 months, then deleted.
  • Pseudonymised IP hashes: 90 days.

6. Your rights (GDPR Art. 12–22)

Access, rectification, erasure, restriction of processing, portability, and objection. Request via contact@mirrorwhales.com. A response will be provided within one month. You may also lodge a complaint with the CNIL (www.cnil.fr).

7. Sub-processors

  • OVH SAS — hosting (EU, France).
  • Resend — transactional email (EU/US under Standard Contractual Clauses).

8. Cookies

Strictly-necessary session cookies only. No analytics, no advertising, no third-party trackers. No consent banner is required because no non-essential cookies are set.

Last updated: 2026-04-17.