Privacy policy.

01Our principles

1. Minimum necessary. I only collect what I need to respond to your request or run the site.
2. No resale, no sharing. Your data is never sold, exchanged, or shared with third parties for commercial purposes.
3. You stay in control. You can view, modify, or delete your data at any time by writing to me.

02Data controller

The data controller is Noah Vernhet, sole proprietor based in Toulouse.

03Data collected

Via the contact form

• First and last name (required)
• Email address (required)
• Company and phone (optional)
• Project type, budget, timeline (optional)
• Message content

The fields marked required are required contractually, not legally: without them I simply cannot reply to you or prepare a quote. Leaving them empty has no other consequence than that. Optional fields help me prepare the conversation; leaving them blank changes nothing about how your request is handled.

Via the newsletter

• Email address only

Via the booking form

• First and last name (required)
• Email address (required)
• The message you attach to the request (optional)
• The slot you pick

This information is used to create the meeting in a Google calendar and to send you the invitation with the video link. It is therefore passed to Google, including the message if you write one.

Via browsing

The site uses Google Analytics 4 for audience measurement: page views, traffic source, device type. It sets the _ga and _ga_* cookies and generates a measurement identifier, which counts as personal data under the GDPR.

The site also uses PostHog, which sets the ph_* cookies and generates a visitor identifier, counting as personal data under the GDPR. PostHog serves six purposes:

• Journey measurement: page views, booking steps, contact and audit form submissions.
• Session replay: your navigation is replayed, to see where the site snags. What is recorded is your movements, clicks, scrolling and the addresses of the pages you visit. Page text is masked by default: only the navigation, header and footer stay readable. Every input field is masked at recording time: your name, email, phone number, message contents and the address you submit to the audit tool are neither recorded nor transmitted. What is recorded is your movement through pages whose content is public.
• Click maps: click positions and scroll depth, aggregated per page.
• Surveys: short questions shown on the site. Answering is optional; your answers are stored in PostHog.
• A/B tests: two versions of the same page served to different shares of traffic, to compare which works better.
• Error tracking: technical errors hit by your browser, with the address of the page involved and the associated technical trace.

Before you consent, and if you decline

Google Analytics is not loaded at all until you accept.

PostHog runs in anonymous mode, and it is worth being precise about what that means: your visits are counted even if you decline. This mode differs from the one above on three points, and those are what make it legitimate without consent:

• Nothing is written to your device. No cookie, no local storage. The only exception is the flag recording your refusal, without which you would be asked again on every page.
• The identifier is not yours. PostHog's servers recompute it from your IP address and browser, mixed with a salt that changes daily and is not kept. It is therefore not reversible, and two visits a day apart cannot be linked. Your IP address is not stored.
• No session replay, no surveys, no A/B tests. All three need to store data on the device, and PostHog disables them itself in this mode.

What is still measured: page views, traffic source, device type, rendering performance and technical errors. None of it identifies you or follows you from one day to the next. The legal basis is legitimate interest (GDPR art. 6.1.f): knowing which pages are read and which load badly is necessary to run this site, and the intrusion on your privacy is nil once nothing is stored on your device and nothing designates you.

After you consent

Accepting switches PostHog to full mode: the ph_* cookie is set, session replay, surveys and A/B tests turn on, and Google Analytics is loaded. You can change your mind at any time on the cookies page: the _ga* and ph_* cookies are then deleted, along with the PostHog data kept locally by your browser, and measurement returns to the anonymous mode described above.

04Purposes & legal bases

No decision producing legal effects or significantly affecting you is taken by automated means, and no profiling takes place. The audit tool analyses a website address, not the person submitting it, and its result is not kept to qualify you.

05Retention periods

• Unconverted inquiries: 3 years from last exchange.
• Client data (quotes, invoices): 10 years (accounting obligation).
• Newsletter: as long as subscribed, deleted immediately on unsubscribe.
• Google Analytics statistics: 14 months, set on the property. After that, user-level data is deleted automatically.
• PostHog statistics: the ph_* cookie set on your device expires after 12 months. Session recordings are kept for 30 days, a duration set on the project, then permanently deleted: PostHog cannot restore them. Events and survey answers are kept on the European instance for the retention period of the current plan. You can request their deletion at any time (see “Your rights”).

06Recipients

Your data is accessible only to Noah Vernhet and the following GDPR-compliant service providers:

• IONOS (VPS hosting): data hosted in the European Union.
• Resend (transactional emails): a US company. The signed data processing agreement includes the European Commission's standard contractual clauses.
• Google Analytics (audience measurement): Google Ireland Limited, with a transfer to Google LLC in the United States covered by the EU-US Data Privacy Framework. Enabled on your consent only.
• PostHog (measurement, session replay and surveys): PostHog Inc., a US company, whose European instance (eu.i.posthog.com) is the one used here. Data is stored in Germany, and the PostHog sub-processors that access it are established in Germany and France, with one exception: the Cloudflare delivery network routes data through its points of presence worldwide. That transit is covered by PostHog's sub-processing chain. A data processing agreement signed on 31 August 2026 incorporates the European Commission's standard contractual clauses. Enabled on your consent only.
• Google Calendar and Google Meet (booking): Google Ireland Limited. Creating the slot passes your name, your email address and, if you write one, the message attached to your request. Google then sends you the invitation and the video link. Transfer to Google LLC in the United States covered by the EU-US Data Privacy Framework.
• Stripe (payments, clients only).

Transfers outside the European Union are therefore limited to these providers, and each is covered either by an adequacy decision or by standard contractual clauses. A copy of the safeguards covering these transfers can be obtained on request, at the address given in the “Your rights” section below.

07Your rights

Under the GDPR, you have the following rights:

• Access: know what data I hold about you.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your data. For measurement data, which carries no name, finding your session requires you to give me something to identify it — the date and time of your visit, for instance. Failing that, recordings disappear on their own after 30 days.
• Restriction: freeze processing during a dispute.
• Portability: receive your data in structured format.
• Objection: refuse processing based on legitimate interest.
• Withdraw consent: at any time, without justification.
• Complaint: lodge a complaint with the CNIL, the competent supervisory authority, if you believe your rights are not being respected.

08Security

Data transits over HTTPS end-to-end. Databases are encrypted at rest. Admin tools are protected by strong passwords and two-factor authentication. The hosting interface is further reachable only through a private VPN tunnel.

09Changes

This policy may be updated to reflect changes in practices or regulations. The date at the top reflects the last modification. Newsletter subscribers will be notified of any substantial changes.