Privacy policy
Last updated: 2026-05-21
This policy describes how Cenaclo collects and processes your personal data, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act. During the waitlist phase (Phase 0), the data controller is the publisher of Cenaclo, whose identity is set out below.
Data controller
- Publisher: Nicolas Roger EGERMANN
- Status: sole trader — micro-enterprise (auto-entrepreneur), unregulated liberal profession
- SIRET: 522 700 640 00033
- Address: 79 rue des Micocouliers, 30260 Cannes-et-Clairan, France
- Personal data contact: privacy@cenaclo.com
No Data Protection Officer (DPO) is appointed at this stage: the processing is limited and does not fall within any of the cases that make appointment mandatory (article 37 of the GDPR).
Data collected
During the waitlist phase (Phase 0), when you sign up, we collect:
- Your email address
- Your language (fr / en)
- The sign-up source (the section of the site you signed up from)
- A SHA-256 hash of your IP address (anti-fraud — the salt is not rotated)
- The sign-up date
For anonymous audience measurement (PostHog Cloud EU, configured in CNIL-exempt mode):
- The URL of the visited page
- The traffic source (referrer)
- The device type (desktop / mobile)
- The approximate country (derived from the IP address truncated on the PostHog server, never stored in clear text)
We do not collect: name, first name, postal address, phone number, third-party advertising cookies, browser fingerprint, or cross-site behavioural tracking data.
Purpose
- Waitlist: build a list to inform you of the Cenaclo launch and gather signals of interest (volume, sources, languages).
- Audience measurement: understand how the site is used in order to improve it, without identifying you.
Legal basis
- Waitlist: article 6.1.a of the GDPR — explicit consent (mandatory “16 or older” checkbox, clear opt-in).
- Anonymous audience measurement: article 6.1.f of the GDPR — legitimate interest, in a configuration covered by the CNIL exemption under article 82 of the French Data Protection Act (strictly statistical audience measurement, no persistent cookie, no cross-session identification, truncated IP address). See the cookie policy for the technical details.
Retention period
- Active email (subscribed to the waitlist): until you unsubscribe or 12 months after the public launch.
- Unsubscribed email: deletion within 30 days (except for the minimum retention required by law).
- Email send logs (from V1 onward): rolling 13 months (proof of sending for disputes or GDPR requests).
- Audience measurement data (PostHog): rolling 12 months.
Recipients (sub-processors — article 28 of the GDPR)
| Sub-processor | Role | Hosting / jurisdiction | Safeguards |
|---|---|---|---|
| Listmonk (self-hosted by the publisher) | Management of the sign-up list and routing of all emails (transactional and campaigns) | Instance self-hosted by the Cenaclo publisher on a VPS located in the European Union (Hetzner, Germany) | Self-hosted: direct control, no data shared with any third party other than the Amazon SES SMTP backend below |
| Amazon Web Services EMEA SARL (Amazon SES) | SMTP backend used by Listmonk for actual email delivery; receives only send metadata (recipient, subject, content) for the duration of delivery | SES eu-west region (Ireland), AWS Europe legal entity in Luxembourg | Signed DPA, EU Standard Contractual Clauses (SCC) for any residual transfer, ISO 27001 / SOC 2 compliance |
| PostHog Cloud EU | Anonymous audience measurement of the landing (Phase 0) and product analytics (V1.5) | EU — Frankfurt hosting (PostHog EU clusters) | Signable DPA, EU SCC, “Discard client IP data” setting enabled at the project level to remain within the CNIL exemption in Phase 0 |
| Cloudflare, Inc. | CDN, DDoS protection, static hosting of the landing (Pages), anti-spam (Turnstile) | Cloudflare is a US entity; in Phase 0, data passes through a distributed cache including EU nodes | EU SCC (clauses published by Cloudflare), Data Processing Addendum available |
| Hetzner Online GmbH | Hosting of the Listmonk VPS (and the Cenaclo backend from V1 onward) | Datacenters in Germany (Falkenstein, Nuremberg) or Finland (Helsinki) | German jurisdiction, native GDPR compliance, DPA available |
| Discord, Inc. (V1+ only) | Reading the messages of a Discord server to migrate to a Cenaclo community — explicit opt-in per community | Discord is a US entity | EU SCC and explicit opt-in; not applicable in Phase 0 |
Transfers outside the EU
- In Phase 0 (waitlist): no significant transfer outside the EU. Listmonk, Amazon SES (EU region) and PostHog Cloud EU are all configured in the European zone. Cloudflare operates a distributed CDN (cache in Europe for European visitors).
- Cloudflare and Discord case: these entities are legally established in the United States. The actual processing is confined to European datacenters, but their US headquarters entail the application of the European Commission’s Standard Contractual Clauses (SCC) for any residual transfer.
Your rights
You can at any time:
- Access your data (article 15)
- Request its rectification (article 16)
- Request its erasure (article 17)
- Object to the processing (article 21)
- Request the portability of your data (article 20)
- Withdraw your consent (article 7-3)
To exercise your rights, contact privacy@cenaclo.com. Response time: one month maximum.
CNIL complaint
If you believe your rights are not being respected, you can lodge a complaint with the CNIL (the French data protection authority): www.cnil.fr/en/home — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
Cookies
The Phase 0 landing sets no advertising or profiling cookie. See the cookie policy for the technical details of the PostHog audience-measurement configuration covered by the CNIL exemption.
Changes
This policy may be updated. The last-updated date, shown at the top of the page, prevails.