This policy describes how YOUWRITE collects and processes users' personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act.
1. Data controller
- YOUWRITE (SASU), 5, Allée de la Grande Treille, Bureau 3, 35200 Rennes, France
- SIREN 910899723 — Contact: [email protected]
No Data Protection Officer (DPO) has been appointed, as this is not mandatory for this activity. Any request relating to personal data may be sent to [email protected].
2. Data collected
- Account data: name, email address, password (stored as an encrypted hash).
- Profile data: preferred language, role, information provided by the user.
- Purchase data: buyer email (including for account-less store purchases), order history.
- Usage and technical data: progress, interactions, logs, cookie identifiers.
3. Purposes and legal bases
- Providing the service and access to content — performance of the contract.
- Managing orders and payments — performance of the contract and legal obligation.
- Marketing communications and newsletters — consent (withdrawable at any time).
- Audience measurement and session replay (Microsoft Clarity) — consent.
- Security, fraud prevention and proper operation — legitimate interest.
- Accounting and tax obligations — legal obligation.
4. Recipients and processors
Data is processed by YOUWRITE and by the following processors, within the scope of their respective tasks:
- Polar.sh (Merchant of Record, payments) — United States.
- Amazon Web Services (SES) (email delivery) — United States.
- Bunny.net (video hosting and delivery) — European Union (Slovenia).
- Hosting / file storage (S3) — OVH SAS (Strasbourg, France — UE).
- Anthropic (AI writing assistance) — United States.
- Microsoft Clarity (audience measurement and session replay) — United States.
Full payment details (card numbers) are never stored by YOUWRITE: they are processed directly by the payment provider.
5. Transfers outside the European Union
Some processors are located in the United States. Transfers are carried out on the basis of the EU-US Data Privacy Framework adequacy decision where the processor is certified, or otherwise on the basis of the European Commission's Standard Contractual Clauses and additional appropriate safeguards.
6. Session replay (Microsoft Clarity)
Subject to the user's consent, Microsoft Clarity performs audience measurement, heatmaps and anonymized session recordings to improve the site's usability. Sensitive input fields are masked. This processing is based on consent and can be disabled at any time via the cookie manager.
7. Retention periods
- Account data: duration of the subscription, then 3 years after the last contact.
- Billing data: 10 years (legal obligation).
- Cookies and trackers: 13 months maximum.
- Marketing data: until consent is withdrawn.
8. Your rights
Users have the rights of access, rectification, erasure, restriction, objection, portability, the right to withdraw consent at any time, and the right to set directives regarding their data after death. These rights can be exercised at [email protected].
Users may lodge a complaint with the CNIL: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.
9. Security
YOUWRITE implements appropriate technical and organizational measures: password hashing, encryption of communications, application-level access control and logging.