Privacy policy
In short
- Only your email address is required. It's used for your Founder spot and the beta emails.
- VEKTOREP news and offers only if you tick the third box on the form. It starts unticked.
- Your data is stored in France, in Paris. It is never sold, and your email is never passed to Meta or Google to target you.
- Every email has a "Delete my sign-up and my data" link: one click and everything is deleted, on our side and in our email tool.
- No analytics or advertising cookie without your consent.
- You must be 16 or older (15 if you live in France).
Who is responsible for your data
Opsylia, a French simplified joint-stock company (SAS) being incorporated, publisher of VEKTOREP. Until the company is registered, the data controller is Clément Dormy, acting in the name and on behalf of the company Opsylia, being incorporated. Once registered, Opsylia will take over this processing: we'll tell you by email and its SIREN number will be shown here.
Address: 26 bis rue Félix Pithon, 94320 Thiais, France. Email for any question about your data: contact@vektorep.com.
We have not appointed a data protection officer: it isn't required for our activity. Clément Dormy answers requests directly.
What we collect, why, and on what basis
One row per use. The legal basis is the one in Article 6 of the GDPR.
| Data | Why | Legal basis | Required? |
|---|---|---|---|
| Email address | Book your spot, confirm your address, send you the beta emails: confirmation, ticket, beta opening, end-of-beta survey | Performance of the Founder terms, which you accept with the second box (Art. 6(1)(b)) | Yes: no email, no sign-up |
| Email address, if you tick the third box | Send you VEKTOREP news and offers | Your consent (Art. 6(1)(a); Article L34-5 of the French Postal and Electronic Communications Code) | No: the box starts unticked |
| Date, time, language and wording of the boxes you ticked, declared age | Prove your consent and apply the minimum age | Legal obligation to be able to prove consent (Art. 6(1)(c) and 7(1)) | Recorded automatically |
| Watch or chest strap you use, Strava use, interest in Pro | Prepare the beta: which watches to connect first, what to ask beta testers | Your consent: you answer, or you click "Skip" (Art. 6(1)(a)) | No |
| Founder spot number, waiting-list rank, referral code, referrer if any | Apply the Founder offer, the waiting list and referrals | Performance of the Founder terms (Art. 6(1)(b)) | Created automatically |
| Where your visit came from: ad or link parameters (utm_source, utm_campaign, utm_content), page version seen | Know which ads and links bring sign-ups | Our legitimate interest in measuring our ads (Art. 6(1)(f)). You can object: see "Your rights" | Recorded only if the link contains them |
| Browsing and ad origin, through cookies | Measure visits and ad performance, show our ads to similar people | Your consent in the banner (Art. 6(1)(a); Article 82 of the French Data Protection Act) | No: nothing without your consent |
| Email, subject and message from the contact form | Reply to you | Our legitimate interest in answering requests (Art. 6(1)(f)) | Yes, so we can reply |
| IP address and technical browser signals, when you send a form | Block bots (Cloudflare Turnstile) | Our legitimate interest in protecting the site (Art. 6(1)(f)) | Yes, to send a form |
| Technical logs: IP address, page requested, date | Security and proper running of the site | Our legitimate interest (Art. 6(1)(f)) | Automatic, as on any site |
No health data is collected on this site: no weight, no heart rate, no workouts.
What we don't do
- No automated decision or profiling about you (Article 22 GDPR). The order of spots only follows the time you confirm your email.
- No selling or renting of your data.
- Your email is never uploaded to Meta, Google or any other advertising tool.
- We don't track, person by person, whether you open our emails or click in them: this tracking is turned off in Brevo. The images in our emails are hosted on our site and are not used to know whether you opened an email.
How long we keep your data
- Sign-up never confirmed: deleted automatically after 30 days.
- Confirmed sign-up: as long as you stay signed up, and at most 3 years after your last action (confirmation, survey answer, new sign-up) if you don't become an app user.
- Unsubscribing: everything is deleted straight away, in our database and in Brevo, including the proof of your consent.
- Contact form message: for the time of the exchange, then 1 year at most.
- Bot check: for the time of the check. Nothing is stored in our database.
- Technical logs: 1 day at Supabase; at o2switch, according to its hosting policy.
- Cookies: see the table below.
Who has access
The VEKTOREP founders and the providers below. These providers act only on our instructions, under a data processing agreement (Article 28 GDPR), and don't use your data for themselves. Google and Meta only come in if you accept cookies (see below).
| Provider | What it does | Where the data is | Safeguard outside the European Union |
|---|---|---|---|
| Supabase Inc. (United States), on Amazon Web Services servers | Sign-up database and the function that handles the forms | Paris. Supabase staff may access it from the United States for support and security | European Commission standard contractual clauses |
| Brevo (Sendinblue SAS, France) | Sending emails, list of confirmed sign-ups, forwarding contact form messages | European Union | No transfer on our part; standard clauses in the contract for any sub-processors outside the EU |
| o2switch SAS (France) | Hosting the site and the contact@vektorep.com mailbox | France (Clermont-Ferrand) | No transfer |
| Cloudflare, Inc. (United States) | Bot check on the forms (Turnstile) | Global network, United States possible | EU–US Data Privacy Framework, and standard contractual clauses in the contract |
| Tally BV (Belgium) | End-of-beta survey, sent later to beta testers | European Union | No transfer on our part; standard clauses in the contract for any sub-processors outside the EU |
Cloudflare also reuses the technical signals from the check to improve its bot detection, as explained in its Turnstile privacy policy. Turnstile sets no tracking cookie and doesn't ask for your consent, because it only protects the forms.
Are you between 15 and 17?
- If you live outside France, you must be 16 to sign up on your own: it's the highest age set by the GDPR, and we apply it everywhere outside France. In France, the age is 15 (Article 45 of the French Data Protection Act), which is why the French version of the site says 15.
- If you're younger, please don't sign up. If we learn that a sign-up comes from someone too young, we delete it. A parent can write to us at contact@vektorep.com.
- What we do with your email, in one sentence: we write to you about the beta, and about offers only if you ticked the third box. One click in any email deletes everything.
- The site sells nothing. In the app, any purchases go through the App Store and Google Play and their parental controls.
Your rights
- Delete everything, right now: the "Delete my sign-up and my data" link at the bottom of every email. Your spot is freed and goes to the first person on the waiting list.
- Stop offers only: the "Unsubscribe" link at the bottom of offer emails, or a message to contact@vektorep.com. You keep your spot.
- Access your data, correct it, get a copy in a readable format (portability) or restrict its use: write to contact@vektorep.com from the address you signed up with, or use the Contact page.
- Object to recording where your visit came from, which relies on our legitimate interest (Article 21 GDPR): write to us and we'll delete that information from your sign-up.
- Withdraw your consent at any time, without affecting what was done before: for offers, with the "Unsubscribe" link; for cookies, with the "Cookies" link at the bottom of every page.
- Say what happens to your data after your death (Article 85 of the French Data Protection Act): write to us.
We reply within one month at most. We may ask you to confirm the address is yours, nothing more.
If you think your rights are not respected, you can complain to the French data protection authority, the CNIL (cnil.fr/fr/plaintes, or by post to CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France), or to the authority of the country where you live.
Security
The sign-up database is closed to the public: only the site's function can read it, with a key kept on the server. Connections are encrypted (https) and data is encrypted on Supabase's servers. Access to our tools is limited to the founders. If a breach puts you at risk, we notify the CNIL within 72 hours and, if the risk is high, each person concerned.
Cookies
No analytics or advertising cookie is set before you choose in the banner. Refusing is as easy as accepting, and you can change your mind at any time with the "Cookies" link at the bottom of every page: if you withdraw your consent, the cookies concerned are deleted. Your choice is kept for 6 months in your browser (local storage, no cookie), then we ask again.
| Category | Tool | Why | Duration |
|---|---|---|---|
| Audience measurement | Google Analytics 4 (Google Ireland Ltd) | Pages viewed, where visits come from | Up to 13 months |
| Advertising | Meta pixel (Meta Platforms Ireland Ltd) | Which ad brought you here, showing our ads to similar people | 3 months |
For the Meta pixel, Meta Platforms Ireland and we are jointly responsible for collecting the data and sending it to Meta; after that, Meta uses it under its own responsibility (Meta's policy). For Google Analytics, Google acts on our behalf.
These tools may transfer data to the United States under the EU–US Data Privacy Framework.
Visit and journey counter, no cookie. We also count page views ourselves, with no cookie, nothing stored in your browser and no identifier: only the page, the site or link you came from (for example vektorep.com/insta), whether it is your arrival on the site, whether you use a phone or a computer, the time spent on the page, how far you scroll, which "Join" button you click and which steps of the form you reach (never what you type in it). Your IP address is not kept. These figures are stored with Supabase, in Paris, and only tell us how many people visit the site.
Changes
If this policy changes on an important point (new data, new provider, new use), we'll tell you by email before the change applies. The date of the current version is at the top of this page.
The French version of this policy prevails.