Privacy policy

In one sentence

Gather publishes nothing, does not keep your messages and sets no tracking cookie: it only keeps what is needed for identifiers to work, that is the link between an account and its identifiers, and the holder's contact address.

Data controller

Breizhzion, a public-interest association, 34 rue Decomberousse, 69100 Villeurbanne, France. Contact: dev@breizhzion.com.

If you write to an identifier

• Your message is sent by email to the identifier's holder, then is not kept by Gather. If you include a contact detail, it is part of the message: it is recorded nowhere else.
• Your IP address is turned into a non-reversible fingerprint that is specific to the day, used to count your sends (per hour and per day) to limit abuse. These counters are kept for forty-eight hours at most, then erased. Two of your actions on the same day share the same fingerprint, so they can be linked on that day, never from one day to the next. The address itself is written in no log and is not attached to your message.
• An anti-bot check (Cloudflare Turnstile) verifies that a person fills in the form: Cloudflare receives technical information about your browser for this, and Gather passes it your IP address at the time of the check.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR), operating the service and protecting it from abuse.

If you have an account and identifiers

• Your Breizhzion account is managed by the association's sign-in service (login.breizhzion.com), under its own policy. Gather receives, and keeps, your account identifier and your account address, and queries the sign-in service, with that address, to know whether your membership is up to date.
• Gather keeps your identifiers (number, creation date, status, regulation choice), your contact address, verified by a confirmation code, and the record of decisions (creation, address change, suspension, closing), tied to your account, kept for twenty-four months. A session lasts twelve hours at most. A copy of the database is backed up every day, by the association, and kept for up to six months in a backup that cannot be altered.
• Deleting your account is done on login.breizhzion.com. Gather is notified and then erases your account, your identifiers, your sessions and your contact address. The record of decisions and the backups already made are kept until they expire.
• When your membership ends, Gather notices by querying the sign-in service with your account address, every hour. Your identifiers are then suspended, then closed if the membership stays overdue for more than sixty days. The code of a closed identifier is kept on its own, with no link to you or to your address and with no time limit, so that it is never given to anyone else: the former holder's contacts would otherwise get mixed up with the new holder's.

Legal basis: performance of the service you request (Art. 6(1)(b) GDPR).

If a report is made

The content sent (reported message or description of an identifier), the date and the reason are kept for twelve months to handle the report and justify the decision, then erased. Only association members in charge of moderation have access.

The anti-spam reading mode

This mode, which only a member holder will be able to turn on expressly, is not available yet. Its full terms and the provider involved will be published before it opens, and it will require specific acceptance. By default, no message is read.

The website and the app

• No tracking cookie and no audience measurement. Two technical cookies are set only if you sign in: a ten-minute state cookie during sign-in, then a session cookie lasting twelve hours at most to keep you signed in.
• Fonts are served by the site itself. No resource is loaded from a third party to display pages. The only exception is the anti-bot check, loaded from challenges.cloudflare.com on pages that have a public form.
• The mobile app uses the same data as the website, through the same server. It embeds no advertising, analytics or crash-reporting tool, and does not ask for access to your contacts or your location. On iPhone, saving the QR code to your photos happens only when you ask for it, with write-only access: the app never reads your photos. Its session (fourteen days at most) is kept in your phone's secure store and revoked when you sign out. The anti-bot check is shown there in a Gather web page. The app stores (Apple, Google) may process data on their own behalf: this policy does not cover them.
• Cloudflare, which delivers the site, sees your IP address and request headers in order to route and protect traffic.

Processors

Breizhzion uses the following processors, bound by confidentiality and security obligations under Article 28 GDPR:

• OVH SAS (Roubaix, France): server hosting, datacenter in France.
• Cloudflare, Inc. (San Francisco, USA): proxy, CDN and anti-bot check; transfer framed by the standard contractual clauses (Art. 46(2)(c) GDPR).
• Amazon Web Services EMEA SARL (Luxembourg), email delivery service, Ireland region: delivery of messages to holders.

Your rights

Under the GDPR, you have the following rights:

• Right of access to your data (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)

To exercise your rights, write to dev@breizhzion.com. Response time: 30 days maximum. You may also lodge a complaint with the CNIL. Because Gather does not keep your messages, we may have nothing to give you about them.