Privacy policy

Valentin BENEZET (AVRYN), sole trader, 2 rue de Lavernhe, 12210 Laguiole, France, SIRET 10767397200017. For any question about your data: hello@avryn.studio or 07 44 95 37 60.

• No selling, renting or exchanging your data, in any form.
• No automated decision-making about you.
• No social media widgets. The link to our Facebook page is an ordinary link: it sends nothing unless you click it.
• No embedded third-party content: no video, no map, no font loaded from elsewhere. Everything the page shows comes from our own servers.

When you write to us from the site, we record:

• your name and email address, so we can reply;
• your company, if you fill it in, the field is optional;
• the subject you picked and your message;
• the site language at the time, so we answer in it;
• your browser (the user-agent header), which helps tell a real enquiry from a bot;
• the date we received it.

Legal basis: your own request: pre-contractual steps taken at your initiative, and our legitimate interest in answering people who contact us.

Retention: three years from our last exchange, unless it led to a contract, in which case accounting obligations apply.

Your IP address is not stored. It is held in memory for at most one hour, solely to limit how many messages can be sent from one origin, then forgotten.

A bot check. When you open the form, and only then, your browser loads Turnstile, the bot-detection service run by Cloudflare, Inc. It checks that you are a person without asking you anything. Cloudflare receives your IP address and your browser name for this, and sets no cookie and no tracker. Browsing the site without opening the form triggers no call to them.

If you are a client with an account, we keep your email address, name, display initials and role, along with the records of your projects, hosting, invoices and messages with us.

Your password is never stored. Only a scrypt hash is: a function designed to be slow, and therefore expensive to attack. We cannot read it, and it cannot be recovered from our database.

Legal basis: performance of our contract. Retention: the length of the relationship, then five years, except accounting records kept ten years as the law requires.

This site uses Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to know how many people visit, how they arrive and which pages they read. These measurements also serve to assess our advertising campaigns.

Two cookies are set for this:

• _ga : tells one visit from another. Retention: thirteen months.
• _ga_54NK7CYS3G : holds the state of the current visit. Retention: thirteen months.

This data is processed by Google, which may transfer it to the United States. Google LLC is certified under the EU–US Data Privacy Framework. On our side we see aggregate statistics only: never your name, never your email address, never the content of a message you may have sent us.

Opting out. The opt-out add-on published by Google, tools.google.com/dlpage/gaoptout, applies to every site you visit. Refusing cookies in your browser settings has the same effect here.

Three items required to make the site work, plus the two audience-measurement cookies described just above.

• avryn_session : the client area login cookie. Set only after you sign in, unreadable by page JavaScript (HttpOnly), restricted to this site (SameSite=Lax), encrypted in production, valid thirty days. Signing out clears it.
• avryn.locale : remembers the language you chose, in your browser. It is never sent to us.
• avryn.intro : remembers, for this visit only, that the opening animation has already played. Cleared when you close the tab.

The last two are not cookies but local storage: they never leave your device.

Us, and no one else beyond the providers strictly needed to run the service:

• The host: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France. It hosts the site, the database and the files, on servers located within the European Union.
• Email delivery: no provider to date. Form messages are stored in the database and read from the admin area. If a delivery service is introduced, this page will name it before it goes live.
• The bot check: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Called only when you open the contact form, to tell a person from a program. It receives your IP address and your browser name, and nothing else: not your name, not your message. Cloudflare is certified under the EU–US Data Privacy Framework.
• Audience measurement: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. See the “Audience measurement” section above for what is collected and how to opt out.

The host and the bot check act only on our instructions and have no right to use your data for themselves; Google acts as a joint controller for measurement data, under its own terms.

The site, its database and its files are hosted within the European Union. Two processes leave it: the bot check, which covers your IP address alone, and audience measurement.

• Traffic to and from the site is encrypted (HTTPS).
• Passwords are kept as a scrypt hash, never in clear text.
• Admin access is protected by authentication and walled off by role.
• Sign-in attempts and messages sent from the form are both capped per origin, to contain automated traffic.

You may ask to access your data, have it corrected or erased, restrict or object to its processing, or receive a portable copy.

Write to hello@avryn.studio or to the postal address above. We answer within one month. We may ask for proof of identity if we have reasonable doubt about who you are.

If our answer does not satisfy you, you may complain to the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or through cnil.fr.

This policy may change as the site does. The version online is always the one that applies; the date it was last updated is visible in the site admin.