Privacy notice.

• Your account — email address (for magic-link sign-in) and language preference.
• Your page — slug, bio, avatar, links, social icons, theme, notes you add.
• Visit logs — per request: a salted IP hash (rotates daily, no cross-day correlation), country/region/city from edge headers, device class (mobile/desktop/tablet/bot), referrer hostname, timestamp. No cookies, no fingerprint, no IP stored in clear.
• No third-party trackers — Linkette ships no Google Analytics, Facebook Pixel, TikTok Pixel, Hotjar, or anything like them. Ever.

• Render your page and route link clicks (contractual basis, Art. 6.1.b).
• Show you analytics about visits and clicks on your own page (legitimate interest, Art. 6.1.f).
• Mistral can write a weekly editorial brief about your numbers (opt-out anytime in Settings).
• Send the optional weekly digest email (opt-out anytime).

• Web app — Next.js + CoolifyOVHcloud · Roubaix 🇫🇷
• Pages · links · analyticsSupabase · Paris 🇫🇷
• Avatars · thumbnailsBunny · EU edge 🇪🇺
• Magic-link & digest emailBrevo · Paris 🇫🇷
• AI editorial briefMistral La Plateforme · Paris 🇫🇷
• Payments (when checkout opens)Mollie · Amsterdam 🇳🇱

Nothing leaves the European Union. Ever. No US data-transfer mechanism (SCCs, DPF, etc.) is invoked because no transfer happens.

We use a single AI provider: Mistral AI SAS (Paris, France) via its La Plateforme API. No US AI vendor is in our stack.

• What we send — your onboarding description (when you ask for an AI draft), the labels of links you ask to enrich, and compacted weekly stats with any notes you typed yourself. Never your raw event logs, IP hashes, or visitor data.
• What Mistral does with it — generates a draft / enrichment / weekly editorial brief, returns it, and (per their terms) does not retain prompts or outputs for training. Sub-processor: OVHcloud (Roubaix, FR) for inference compute.
• Retention of AI usage records — we log token counts + cost for billing fairness in the ai_usage table; 90 days, then deleted. Optional Langfuse trace IDs (EU-hosted) for the same window.
• Opt out — flip "Weekly AI brief" off in Settings and we stop calling Mistral on your account for briefs, optimize, and the weekly digest email (GDPR Art. 21).
• EU AI Act notice — Mistral-written text on Linkette is labelled with a ✦ mark in compliance with Regulation (EU) 2024/1689 Article 50. We do not use AI for any automated decision that produces legal or similarly significant effects (GDPR Art. 22) — every Mistral output is editorial copy you can edit or ignore.

GDPR Articles 13–22 + CNIL. Every right has a one-click action in Settings:

• Access · Portability — download your entire account as JSON
• Rectification — edit anything from the editor
• Restriction — pause your page without deleting it
• Objection to AI — turn off Mistral processing
• Erasure — delete your account permanently
• Information — this page
• Lodge a complaint — links to the CNIL and other EU DPAs in Settings

• Account data is kept for as long as your account exists.
• Visit logs are kept for 12 months, then aggregated into monthly counts and the raw rows discarded.
• AI usage records (token counts, cost) are kept for 90 days.
• Payment records (Mollie payment ids, status, amount) are kept for 10 years as required by French commercial law (Art. L123-22).
• If you delete your account, every personal row referencing you is removed within seconds (cascading foreign keys). No soft-delete, no archive — payment records are anonymised (user id detached) rather than deleted, per the legal retention above.
• Breach pledge — if a personal-data breach happens, we notify the CNIL within 72 hours of becoming aware of it (GDPR Art. 33) and email affected users directly when the risk to their rights is high (Art. 34). The notification will name the data involved, the likely impact, and the steps we've taken.

The data controller is the entity that decides how and why your data is processed (GDPR Art. 4(7)):

We have not appointed a Data Protection Officer because we are below the GDPR Art. 37 thresholds. Any privacy question can be addressed to the email above and is answered by a human, not an inbox auto-responder.

For any question or complaint, write to privacy@linkette.eu. If you're not satisfied with our response, you can lodge a complaint with the CNIL or the supervisory authority of the EU country you live in.