Privacy policy

Data controller

Controller

ECLIPSE STUDIO DEVELOPMENT

Address

22, Rue Ampère
35800 DINARD
France

Contact

arthur@eclipsestudiodev.fr

Data collected by the contact form

• name, email address and message (required);
• phone number and company (optional);
• chosen subject (website, AI automation, both, other), page the message was sent from and site language;
• an anti-bot proof of work computed by your browser and checked by the site, with no third-party service and no cookie.

Your IP address is only used, for the duration of the request, to limit abusive submissions: it is not stored with your request.

Purposes and legal bases

• Answering your request and corresponding with you: the publisher's legitimate interest in replying to people who contact them (article 6(1)(f) GDPR).
• Preparing a quote, a proposal or a meeting at your request: pre-contractual steps (article 6(1)(b) GDPR).

Your data is never sold or rented, and is not used for marketing without your consent.

Recipients and processors

Only the publisher has access to your messages. The following technical providers are involved:

• Brevo (Sendinblue SAS, France, European Union): sends the email notifying the publisher of your message and, where applicable, the acknowledgement sent to you.
• Cal.com (Cal.com, Inc., United States): appointment booking, if you book a call.
• Vercel (Vercel Inc., United States): website hosting.
• Back-office server: the provider hosting the private server that runs the back-office (Strapi) and its database, where your request is stored.

Where data is transferred outside the European Union, these transfers rely on the safeguards provided by the GDPR (adequacy decision or standard contractual clauses) offered by the providers concerned.

Help with drafting replies (artificial intelligence)

To help sort their mailbox and prepare replies, the publisher may send the content of an email you addressed to them (your name, your address, the subject and the text of the latest message, without attachments) to an artificial intelligence provider acting as a processor (for example Anthropic, OpenAI, Mistral AI, Google or OpenRouter, depending on the service configured). The provider only suggests a classification or a draft: the publisher reviews, edits and sends every reply themselves. No automated decision producing effects concerning you is taken on this basis.

This processing is based on the publisher's legitimate interest in answering the requests they receive efficiently. The services used are configured not to reuse this data for training where that option exists; only the generated classification and summary are kept, for at most 13 months. You may object to this processing by saying so in your message or by writing to the address given in the “Data controller” section.

Prospect and client records: public sources

To build a prospect's or client's record (company name, legal form, company identifier, VAT number, registered office address, representative), the publisher may consult public sources based on the company's website or registration number: the legal notice and terms pages published on its website, the French government's Recherche d'entreprises API (annuaire-entreprises.data.gouv.fr, data from INSEE and the national business register) and the European Commission's VIES service to check an EU VAT number. Only the website's domain and the company identifier are sent to these services. When these pages do not reveal an identifier, their public text may be submitted to the artificial intelligence provider mentioned above, which only extracts the information they contain.

Address entry is assisted by address suggestion services: the IGN Géoplateforme (French national address database) for France, and Photon (komoot, OpenStreetMap data, Germany, European Union) for other countries; only the text of the address being typed is sent to them. None of this information is saved until the publisher has reviewed and approved it. Legal basis: the publisher's legitimate interest in managing business relationships and drawing up accurate contracts (article 6(1)(f) GDPR), and pre-contractual steps (article 6(1)(b)). This information is kept with the prospect's or client's record, for the periods stated below.

Electronic signature of contracts

When a contract is offered to you for signature through a personal link, the following data is processed to evidence your signature (simple electronic signature, eIDAS regulation and article 1367 of the French Civil Code):

• signer's name, first name and capacity, image of the drawn or typed signature;
• the client's email address, to which the verification code is sent (the code itself is only stored as a hash);
• dates and times of viewing, of sending and checking the code and of signing, IP address and browser (user agent) used;
• fingerprints (SHA-256) of the contract before and after signature.

This data appears in the certificate attached to the signed contract and in its audit trail. Legal basis: performance of the contract and pre-contractual steps (article 6(1)(b) GDPR), and legitimate interest in being able to prove the signature (article 6(1)(f)). It is kept with the contract for the legal retention period of contracts (five years after the end of the contractual relationship, general limitation period).

Payments and invoicing (Qonto)

The publisher's business account is held by Qonto (Olinda SAS, France, European Union), a licensed payment institution, which is also the tool used to issue their invoices. For the account itself, Qonto acts as a separate data controller subject to its own obligations (in particular anti-money-laundering rules); for invoicing, as the publisher's processor.

When you pay a deposit, an instalment or an invoice by bank transfer, the details of that transfer (payer name, amount, date, label and reference, last four characters of the IBAN) are read by the publisher's back-office to match the payment with the corresponding invoice or contract; the full IBAN is never stored there. The match is only suggested: the publisher confirms it themselves, and no automated decision producing effects concerning you is taken on this basis. Legal basis: performance of the contract (article 6(1)(b) GDPR) and the publisher's accounting obligations (article 6(1)(c)). Matched payments are kept with the contract and the accounting records for ten years (article L123-22 of the French Commercial Code); transfers without a match are deleted from the back-office after 13 months.

Approval of case studies

Before publishing a case study about a project, the publisher submits it to the client through a personal link. When the client approves it, the following is kept as proof of consent: the name entered, the exact text of the ticked approval, the date and time, the IP address and browser (user agent), and a fingerprint (SHA-256) of the approved content. A change request is kept with its comment. Legal basis: the client's consent to publication (article 6(1)(a) GDPR) and legitimate interest in being able to prove it (article 6(1)(f)). This data is kept for as long as the case study is published, then five years after it is withdrawn. Consent can be withdrawn at any time by writing to the address given in the “Data controller” section: the case study is then removed from the site.

Questionnaires, briefings and client reviews

The questionnaires sent to prospects and clients (preparatory questionnaire before a project, feedback for a case study, review of the service) are hosted on Typeform (Typeform SL, Spain, European Union), acting as a processor. The answers (name, email address, role, company, website, answers to the questions) are sent to the publisher's back-office and linked to the client's record. Legal basis: pre-contractual steps and performance of the contract (article 6(1)(b) GDPR) for the preparatory questionnaire, the publisher's legitimate interest in preparing case studies and collecting client feedback (article 6(1)(f)) for the others. These answers are kept for the duration of the relationship with the client, then for at most three years after the last contact.

To prepare a meeting or draft a case study, the publisher may send these answers, together with the information about the project concerned, to an artificial intelligence provider acting as a processor (for example Anthropic, OpenAI, Mistral AI, Google or OpenRouter, depending on the service configured; on OpenRouter, only providers that do not keep data for training are used). The provider only produces a summary sheet or a draft: the publisher reviews and corrects them, and no case study is published without the client's approval. No automated decision producing effects concerning you is taken on this basis.

A review is published on the site only with the explicit consent of its author, given in the questionnaire, and after review by the publisher. It is published exactly as written, unedited, with the author's first name, last name, role, company, rating, date and the logo of their website. Private answers (points to improve, email address) are never published. The text of the consent given is kept as proof for as long as the review is published, then five years after it is withdrawn. The author can withdraw consent at any time by writing to the address given in the “Data controller” section: the review is then removed from the site.

Retention period

Contact requests are kept for 36 months from the last exchange, then deleted, unless a contractual relationship begins (the data is then governed by the contract).

If you subscribe to the newsletter, your email address is kept until you unsubscribe, which you can do at any time by writing to the address below.

Your rights

You have the right to access, rectify and erase your data, to object to and restrict its processing, and to data portability. To exercise these rights, write to arthur@eclipsestudiodev.fr. You will receive an answer within one month.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL (the French data protection authority): cnil.fr/fr/plaintes.

Cookies, local storage and third-party services

The site does not set advertising cookies. It stores a few preferences needed for it to work in your browser (local storage, never sent to the server):

preferred-language

chosen language (French or English)

mode-site

chosen display mode (relief or Eclipse)

consentement-traceurs

your audience measurement choice and its date (asked again after six months)

newsletterDismissedAt, newsletterSubscribed

avoid showing the newsletter prompt again

scrollToSection

home section to scroll to after a page change

portfolio-reading-bar-ui-v1

article reading bar settings

devMode

a demonstration display mode of the site

portfolio-music-playback-v1

music player state during the visit (cleared when the tab is closed)

paymentThanks

thank-you message after a payment (cleared when the tab is closed)

Some pages also load third-party services:

• Ahrefs Web Analytics: audience measurement (page views, referrers), loaded only if you accept it in the banner; you can change your mind at any time with the “Manage cookies” link in the footer.
• Cal.com: call booking widget; Cal.com may set its own cookies when you open the calendar.
• EcoIndex: the footer badge queries ecoindex.fr with the address of the current page to show its environmental score.