Privacy Policy
This policy describes how personal data is collected and processed when you visit formrift.com. It complies with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
1. Data controller
As of the date of publication, the Site is published on a personal basis as part of preparing a commercial project (see the Legal Notice page). The publisher is the data controller for the data collected via the Site.
Contact: via the form available on the /contact page.
2. Data collected
2.1 Contact form
When you write to us via the form on the /contact page, the following data is collected:
- Your full name
- Your email address
- Your company name (if provided)
- The subject and content of your message
2.2 Browsing data (with your consent)
If you accept analytics cookies via the consent banner, aggregated data about your visit is collected:
- Pages viewed, session duration, user journey
- Device type, operating system, and browser used
- Approximate country (never a precise address)
This data is collected via Google Analytics 4, configured to anonymize IP addresses. It is not used for advertising purposes.
2.3 Technical hosting data
Our host Vercel keeps access logs containing your IP address and technical request information for security and abuse detection purposes. These logs are retained according to the host's policy.
3. Purposes and legal bases
Your data is processed for the following purposes:
- Responding to your requests sent via the contact form — legal basis: pre-contractual measures and legitimate interest (GDPR Art. 6.1.b and 6.1.f).
- Measuring the Site's audience and improving its content — legal basis: your consent (GDPR Art. 6.1.a).
- Ensuring the technical security of the Site — legal basis: legitimate interest (GDPR Art. 6.1.f).
4. Retention periods
- Contact form messages: 3 years after the last exchange, in line with CNIL recommendations for B2B prospecting.
- Audience analytics data: 14 months (Google Analytics 4 default retention).
- Technical hosting logs: according to Vercel's policy (generally between 30 and 90 days).
5. Recipients and processors
Your data is processed by the following service providers, acting as processors within the meaning of the GDPR:
- Resend (sending email notifications related to the form) — resend.com
- Railway (database and content management system hosting) — railway.com
- Vercel (website hosting) — vercel.com
- Google Analytics, provided by Google Ireland Limited (audience measurement, placed only after consent)
6. Transfers outside the European Union
Some of the providers listed above (Vercel, Railway, Resend, Google) are based in the United States or may process data from servers located outside the European Union. These transfers are covered by:
- Standard Contractual Clauses (SCCs) approved by the European Commission, or
- The Data Privacy Framework (DPF) for certified providers.
7. Your rights
Under the GDPR, you have the following rights over your personal data:
- Right of access: obtain a copy of the data concerning you
- Right of rectification: request correction of inaccurate data
- Right to erasure: request deletion of your data
- Right to object: object to the processing of your data
- Right to restriction: request suspension of processing
- Right to portability: receive your data in a structured format
- Right to withdraw consent at any time for processing that depends on it
To exercise these rights, contact us via the form on the /contact page. If you believe your rights are not being respected, you can lodge a complaint with the CNIL: 3 Place de Fontenoy, 75007 Paris — cnil.fr.
8. Security
Communications between your browser and the Site are encrypted via HTTPS/TLS. Data stored in the database is protected by the standard technical measures of our hosts (encryption at rest, access control, regular backups).
9. Changes
This policy may be updated to reflect legal, technical, or functional changes to the Site. The date of the last update appears at the bottom of this page.