Data Protection Policy

Data controller

Personal data collected on Band Flow is processed by Gauthier Daniels, publisher of the Service. Contact: contact@bandflow.app.

Data collected

The Service only collects the following data:

• account data: email address, username and password (stored exclusively in hashed form);
• public profile content: name, images, biography, social network links and published content (articles, events, releases);
• technical data strictly required for operation: session and security cookies, theme and language preferences;
• if a future paid offer is subscribed to: billing details and payment history.

Purposes and legal bases

This data is processed to provide the Service (performance of the contract): account creation and management, publication of profiles and content, authentication.

It is also used to keep the Service secure (legitimate interest) and to comply with the Publisher's legal obligations (invoicing, responses to requests from authorities).

No data is used for marketing purposes without prior consent, nor sold to third parties.

Cookies

Band Flow only uses cookies strictly necessary for the Service to work: authentication, security, theme and language preferences. No advertising or tracking cookies are set; these cookies do not require consent.

Recipients and processors

Data is hosted by Infomaniak Network SA (Les Acacias, Switzerland), on a server located in Satigny, Switzerland. Switzerland benefits from an adequacy decision of the European Commission: it provides a level of data protection equivalent to that of the European Union.

If a paid offer is subscribed to, payment data will be processed by an authorized payment provider, identified at the time of subscription. No other data transfer outside the European Union or Switzerland takes place at the Publisher's initiative.

Retention periods

Account and profile data is kept for as long as the account is active.

When an account or a piece of content is deleted, the data concerned is kept for two weeks so that a destructive operation (accidental or malicious deletion) can be cancelled. After that period, it is erased or anonymized, except for data whose retention is required by law (invoices in particular are kept for ten years).

Your rights

In accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the right to access, rectify, erase, restrict, object to and port your data.

To exercise these rights, write to contact@bandflow.app. You may also lodge a complaint with the CNIL (cnil.fr), the French supervisory authority.

Security

The Publisher implements appropriate technical and organizational measures: encrypted communications (HTTPS), password hashing, restricted access and logging of sensitive operations.