Notice, version 2026-10-30

Who is responsible for your data

Regroop is not a company yet. Until it is, Louis Fanien, who runs Regroop, is personally responsible for your data (the "controller" in the GDPR's words). For anything about your data, write to contact@regroop.com.

What we collect

When you sign up, we store your email address, the language of the page you used, the version of the consent sentence you ticked, and the time; then, for the confirmation email, a fingerprint of the code in its link, when that code was made, when the email was sent and when you confirmed. Nothing else: no name, no account, no cookie.

The page also counts how many times it is shown, per day and per language. That count holds nothing about you: no address, no cookie, no device or browser details.

Like every web server, ours sees your IP address while it answers you. It uses it only to slow down automated abuse, and does not store it.

Why we use it, and on what legal basis

We use your email address for one thing: to write to you when Regroop opens. When you sign up, we send you one email asking you to confirm that the address is yours, and nothing else before the opening; only confirmed addresses receive the opening announcement. The legal basis is your consent (GDPR Article 6(1)(a)), which you give by ticking the box next to the consent sentence.

The visit count and the abuse limit rest on our legitimate interest in knowing whether the page is seen and in keeping it working (Article 6(1)(f)). They keep no data about you.

Giving your address is voluntary. Without it, we cannot write to you; nothing else happens. We make no automated decisions about you and build no profile.

Who else sees your data

• Fly.io, which hosts our servers and our database, in a data centre in Paris, France.
• Amazon Web Services, which sends the confirmation and announcement emails through Amazon SES, from Paris, France.
• The provider of the contact@regroop.com mailbox, which sees the messages you send there.
• Amazon Web Services, which keeps the encrypted backups of our database in Paris, France. It never has the key to the backups it keeps, so it only ever holds them encrypted.

Nobody else. No analytics, no advertising, no trackers. We never sell your data.

Where your data is kept, and for how long

Your data is stored in the European Union. Our servers and our database are in Paris, France. Fly.io is a company established in the United States, so it may access your data from there. That transfer rests on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795 of 10 July 2023), under which Fly.io is certified. Amazon Web Services is part of Amazon.com, Inc., a company established in the United States, so it too may access your data from there, and it is certified under the same framework. Backups keep a copy for 7 days at most, so a deletion reaches every copy within 7 days. If we ever restore a backup, we first delete again every address deleted after that backup was made.

• If you do not confirm your address within 30 days of the latest confirmation email, it is deleted, whatever we decide; the link in that email works for those 30 days only. If you confirm, it is deleted 30 days after the opening announcement is sent; to stay in touch after that, you create an account. Once the email service holds your address, every deletion, on request or scheduled, reaches it at the same time as our database.
• If we stop, or change the game Regroop is for, every address is deleted within 14 days of that decision.
• If we only change the page's words or where we share it, and this notice and the consent sentence stay the same, we keep your address for the next run. If this notice or the consent sentence changes in what it promises you, we treat it like a change of game: every address is deleted within 14 days of our decision to change the text, and the new text applies only to people who sign up after it. A correction that changes no promise, such as naming the email service or the backup storage above, changes only the date of this notice.
• In every case, no address is kept after December 24, 2026, and no backup holds one after December 31, 2026.

When you write to us about your data: a deletion request and our reply are deleted 8 days after the deletion; a request for a copy of your data and our reply are deleted 30 days after we reply; a request we could not act on, because it did not come from the address it concerns and was never confirmed from it, is deleted 30 days after it arrived. Each period covers every message of the exchange.

Your rights

You can ask for a copy of your data, have a wrong address corrected (sign up again with the right one and ask us to delete the wrong one), have your data deleted or its use restricted, and receive it in a form you can take elsewhere. You can withdraw your consent at any time: what we did before stays lawful, and we then delete your address.

To do any of this, write to contact@regroop.com from the address you signed up with. We act only on a request sent from that address, or confirmed by a reply from it, and we answer only to that address, so that nobody else can learn whether you signed up or have you removed.

If you think we handle your data wrongly, you can complain to a data protection authority, in particular the one of the country where you live or work, or where the problem happened. In France, that is the CNIL (cnil.fr). The European Data Protection Board lists the authority of every EU country (edpb.europa.eu, "Our members").

Changes to this notice

This notice is dated 2026-10-30. A correction that changes none of its promises, such as naming the email service or the backup storage above, changes only the date. A change to what this notice or the consent sentence promises you is handled as the section above says: every address given under the old text is deleted within 14 days of our decision to change the text, and the new text applies only to people who sign up after it. We never apply new terms to an address given under old ones.