Privacy policy

This English translation is provided for convenience only. The French version is the authoritative text and prevails in case of any discrepancy.

This site collects two things: what you write in its form, and visitor statistics that do not identify you. This page sets out exactly what it does with them: what is collected, who receives it, and how long it is kept.

Who processes this data

The data controller is WAIBSITE, a French single-shareholder simplified joint-stock company (SASU) with its registered office at 200 rue de la Croix Nivert, 75015 Paris, France, represented by Clément Thiriet. Full contact details are in the legal notice.

What the form collects

The contact form on the home page is the only place on the site where you enter anything. It asks for four fields:

Your name, required, 2 to 80 characters.
Your email address, required, 160 characters at most: that is where I reply.
Your phone number, optional, 30 characters at most.
Your message, required, 10 to 4,000 characters.

A fifth field, named “site web” (website), is in the form's code but stays invisible and out of the keyboard path: a visitor cannot fill it in, only bots do. When it arrives filled in, the request is rejected without anything being saved, and the confirmation screen is shown anyway, so as to teach nothing to whoever keeps trying. Its content is never kept.

One last field, also hidden, gives the language of the page the request is sent from, French or English: it is used to bring you back to the page in that language, and to tell me which language to reply in. It says nothing else about you, and is not stored with the request.

Your IP address, and why it disappears

Along with your request, the IP address of your connection is the only data you do not enter yourself. It is stored alongside the request for a single purpose: to let no more than three submissions per hour through from the same address. Without this counter, the form would be an open tap for bots.

It is used for nothing else. It does not appear in the notification sent to me, so that replying to your message does not send it back to you quoted at the bottom. And twenty-four hours after the request, it is erased from the database: the request remains, and the column that held the address is emptied. Once the counter's window has passed, it has no reason to exist, and keeping it would turn this database into a visitor log.

Visitor statistics

Every page of the site loads a small measurement script, served from analytics.sitesolide.fr, an address on the server that hosts this site: nothing goes to a third party. It tells how many people visit, which pages and where they come from, without knowing who they are.

For each page view, it records:

the address of the page and the time of the visit;
where the visit comes from: the domain name of the site that contained the link, never the full address of its page, or the source and campaign written into the link itself, its utm_source and utm_campaign parameters;
your browser's language, reduced to its code, “en” for example;
a device category, mobile, tablet or computer, inferred from the screen width, along with the name of your browser and operating system;
the time spent on the page, counted while it is visible;
a number drawn at random on each load, used only to attach that time to the right page, and which does not follow you from one page to the next.

It does not record your IP address, your browser's full identifier, or any other parameters of the page address. It stores nothing in your browser: no cookie, no local storage, no identifier.

To recognize the same browser from one page to the next without a cookie, the server computes a fingerprint from your IP address, your browser's identifier and the site's name, with a key drawn at random every day. Only the fingerprint is kept, and the key is destroyed after two days: past that point, nothing can link the fingerprint back to an address. Since the site's name goes into the calculation, the same person has a different fingerprint on each measured site, and nothing allows them to be followed from one to another. One consequence: a reader who comes back the next day counts as a new visit.

If your browser sends the Do Not Track or Global Privacy Control signal, the script measures nothing. The figures stay on the server, and I am the only one who looks at them.

Why, and on what legal basis

Each processing activity has a single purpose. The form is used to answer your business inquiry, to discuss it with you and, where appropriate, to make you a proposal. Visitor statistics are used to know how many people read the site, and which pages.

Answering your request: Pre-contractual steps taken at your request, Article 6(1)(b) GDPR
Limiting submissions per IP: Legitimate interest in protecting the form from automated submissions, Article 6(1)(f) GDPR
Measuring traffic: Legitimate interest in knowing the site's audience without identifying its visitors, Article 6(1)(f) GDPR

The four fields requested are the ones needed to reply to you, and nothing more: the phone number is optional, and no sensitive data is requested.

Who receives it

I am the only one who reads the requests and the traffic figures. Two service providers are nonetheless involved along the way of the requests, and they are worth naming.

Hetzner Online GmbH, hosting

The site, the database that stores the requests and the visitor statistics database live on a server located in Falkenstein, Germany. The stored data does not leave the European Union.

Amazon Web Services (Amazon SES), notification delivery

As soon as a request arrives, a message notifies me by email. This message contains your name, your email address, your phone number if you gave it, your message and the language of the page; it does not contain your IP address. It is delivered by the Amazon SES service, in the us-east-1 region, in Northern Virginia.

The notification therefore passes through the United States, which constitutes a transfer of data outside the European Union. This is the consequence of a technical choice: the sending identity is verified in that region. The database itself stays in Germany, and this transfer only concerns the notification message.

No other recipient. Your details are never sold, exchanged or added to a mailing list, as the note under the form already says.

How long

IP address: 24 hours, then automatically erased
Name, email, phone, message: 3 years from our last exchange
Visitor statistics: 400 days, then automatically deleted
Fingerprint key: 2 days, then automatically destroyed

Erasing the IP address, deleting the visitor statistics and destroying their key all happen automatically. Requests are deleted by hand at the end of the three years. You do not have to wait that long: a request for erasure is honored as soon as it is received.

Your rights

The General Data Protection Regulation (GDPR) gives you the following rights over the data that concerns you:

a right of access, to know what I hold and obtain a copy of it;
a right to rectification, if any information is inaccurate;
a right to erasure of your request;
a right to object to the processing;
a right to data portability, to receive your data in a machine-readable format;
a right to restriction of processing.

To exercise them, write to clement@cthiriet.com, or by post to WAIBSITE, 200 rue de la Croix Nivert, 75015 Paris, France. I reply within one month.

Visitor statistics keep neither your name, nor your email address, nor your IP address: I have no way of finding the pages you viewed in them. To not be counted at all, turn on Do Not Track or Global Privacy Control in your browser.

Complaint to the CNIL

If my reply does not satisfy you, you can lodge a complaint with the French supervisory authority:

Commission nationale de l'informatique et des libertés (CNIL)
3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
www.cnil.fr

Cookies, trackers and fonts

This site sets no cookies. It has no advertising tracker and no social media button, and the JavaScript it loads, visitor statistics included, stores nothing in your browser. That is why no banner asks for your consent: the measurement described above only counts visits, cross-references nothing and identifies no one.

One exception deserves a mention. The site's typeface, Archivo, is loaded from Google Fonts, at fonts.googleapis.com and fonts.gstatic.com. Your browser therefore sends a request to Google's servers when the page loads, and Google sees your IP address on that occasion, along with the page the request comes from. This is the only call this site makes to a third party, and it happens before you do anything.

What is not done

No selling, no exchange, no sign-up to a mailing list.
No newsletter is sent from this form.
No automated decision-making, no profiling.
No tracking from one site to another.
No sensitive data is requested; please do not include any in your message.

Last updated: October 5, 2026.