Privacy policy
Last updated: September 28, 2026
Draft. Pending legal review. This text is not yet final and some company details are still to be completed.
This policy explains what personal data Crowd Signal processes, why, and what your rights are.
1. Data controller
The controller is [À compléter], [À compléter]. For any question about your data: [À compléter].
2. Data we process
- Account: your name, email address and profile picture, as provided by GitHub or Google when you sign in.
- Use of the service: the sectors and sources you follow, your bookmarks, votes and reading activity, and your settings.
- Billing: your subscription and invoice history, your billing country, and the brand, last four digits and expiry date of your card. Card numbers are handled by Stripe and never reach us.
- Technical: connection logs and performance measurements kept to run and secure the service.
3. Why we use it
- To provide the service and your account (performance of the contract).
- To bill subscriptions and keep accounting records (performance of the contract and legal obligation).
- To secure the service and prevent abuse (legitimate interest).
- To measure audience and performance in aggregate (legitimate interest).
4. Who processes it for us
We share data only with the providers needed to run the service, bound by contract to process it on our instructions:
- Stripe, for payments and invoicing.
- GitHub and Google, for sign-in.
- Our hosting and infrastructure providers.
We do not sell your data.
5. How long we keep it
- Account and usage data: while your account is open.
- Billing records: for the period required by accounting law (10 years in France).
- Security logs: up to 30 days. Records of administrative actions on accounts and payments: 5 years.
6. Transfers outside the EU
Some providers, such as Stripe, may process data outside the European Union. Such transfers rely on the safeguards provided by the GDPR, such as the European Commission’s standard contractual clauses.
7. Your rights
You can access, correct, delete or export your data, object to or restrict its processing, and give instructions about what happens to it after your death. Write to [À compléter]. You may also lodge a complaint with the CNIL (www.cnil.fr) or your local data-protection authority.
9. Security
Data is encrypted in transit, access to it is restricted and logged, and payment data stays with Stripe, which is certified to the PCI DSS standard.
10. Contact
Data protection contact: [À compléter].