Privacy policy

Data controller

The controller of the data described below is the operator of the service, identified in the legal notice: Edouard Souron EI, 37 chemin de Kergonan, 29000 Quimper, France. The controller can be contacted at missions@serotonin-app.com.

Data actually collected

Only the following data is processed:

• first name and surname
• email address
• content of the mission request, location indicated if provided, any attachment
• budget envisaged, if indicated
• where applicable, images or voice recorded openly during a mission for the Provider's communication and, where it is requested from you, the authorisation to publish given in the conversation of your mission: text presented, choices made, date and time, any withdrawal
• quotes and proposals for offered missions, with their successive versions
• response to a quote or to an offered proposal: acceptance, refusal or absence of response
• upon an acceptance: date and time, version and exact text of the conditions presented, declaration of legal capacity, language, IP address and browser used
• upon acceptance of a quote: declared billing information (individual or business, company name, billing address, company identifiers, VAT number, order reference, as applicable)
• date or time frame agreed in the quote, and whether it is mandatory
• agreement to the involvement of a third party, where applicable: text presented, date and time
• request for early start of the mission, where applicable: exact text presented, version, date, time, origin of the request, IP address and browser
• messages and photos exchanged on the request or mission page, any removal of a message or image and its reason, reports, requests for cancellation or ending of the mission and their reasons, supporting documents provided, statements of account and classification of requests
• withdrawal statement, where applicable: its content, date and time
• mission history: performance, confirmation, complaint, cancellation, closure
• internal assessments by the provider, disclosed to no third party: estimated commercial value and reason for an offered mission, estimated cost of offered expenses, mission review (time spent, travel, expenses, assessment, notes)
• for paid missions only: payment, refund and invoicing references, partly kept by Stripe
• bank details (IBAN and account holder) provided for a refund or a payment by bank transfer, where applicable
• identifiers and delivery statuses of emails sent through Resend
• non-reversible technical fingerprints of the origin of the request, of the email address and of the content, solely for the purpose of limiting abuse
• cookie-free audience measurement of the pages visited, provided by Vercel

No bank card number is received or stored by the provider.

Purposes

Reviewing the request; deciding freely whether to accept it, to draw up a quote or to propose offering the mission; sending quotes and proposals; collecting payment for paid missions; performing the mission; communicating with the client; keeping proof of what was accepted; handling reports and cancellations; keeping internal track of the value, cost and progress of missions in order to improve the service; measuring site audience; protecting forms against automated abuse; sending the personal access link again on request; communicating about the Provider's activity, without identifying individuals except with written authorisation where it is necessary.

No decision is taken by automated means: Édouard reviews each request himself and decides alone whether to follow it up, by a quote or by proposing to offer the mission.

Legal bases

Each processing operation is based on a specific legal basis:

• reviewing the request, drawing up the quote, performing the mission, related communications, handling complaints and cancellations, refunds and payments: performance of the contract or pre-contractual measures taken at your request
• proof of what was accepted — date and time, version and exact text of the conditions presented, declaration of legal capacity, IP address and browser: for a contract of €120 or more, compliance with the legal obligation to keep contracts concluded by electronic means; in all cases, the Provider's legitimate interest in being able to establish the content of the agreement in the event of a dispute
• invoicing, credit notes and accounting records: compliance with legal accounting and tax obligations
• dissemination of images or voice making it possible to identify you: your consent, obtained in writing before dissemination where it is necessary, which you may withdraw at any time for the future
• open recording before any decision to disseminate: the Provider's legitimate interest in communicating about their activity
• technical fingerprints for limiting abuse: the Provider's legitimate interest in protecting the form against automated submissions
• cookie-free audience measurement: the Provider's legitimate interest in knowing page traffic
• internal assessments and mission review: the Provider's legitimate interest in assessing and improving the service. This data is disclosed to no third party and produces no automated effect concerning you.

Recipients

Data is neither sold nor transferred for consideration. It is processed only by the technical providers necessary for the service, listed below. Stripe is involved only for paid missions: an offered mission transmits no data to it. Internal assessments are disclosed to no third party.

Stripe also acts as a separate controller for fraud prevention and compliance with its own legal obligations.

The site's data is stored in the European Union: the database in Google Cloud's “Europe” multi-region, files in a storage space located in the European Union. The site's functions run on Vercel in the Paris region (France); emails are sent by Resend from the European Union (Ireland). The data may nevertheless be processed in the United States by the following companies or by companies in their group: Vercel Inc., Google LLC, Stripe, LLC and Plus Five Five, Inc. (Resend). As of the date of this version, each of these companies appears on the official list of active participants in the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission; transfers to these companies may rely on that framework, within the limits of their certification. Content disseminated with your authorisation is accessible to the public on the chosen platforms, which process it under their own terms.

• Vercel Inc.

  Site hosting and cookie-free audience measurement

• Google Cloud France SARL (Google Cloud, Firebase)

  Database (“Europe” multi-region) and file storage (European Union)

• Stripe

  Payments, for paid missions only

• Plus Five Five, Inc. (Resend)

  Sending the service's emails

• OVHcloud

  Mailbox of the address missions@serotonin-app.com, for emails sent to it

Retention periods

• File of a mission that gave rise to a contract (accepted quote or accepted offered mission): quote, exchanges, history — 5 years from closure of the mission (basis: general limitation period)
• Contract accepted by electronic means for an amount ≥ €120: text of the conditions, fingerprint, proof of acceptance — 10 years from performance of the mission (basis: retention of electronic contracts)
• Invoices, credit notes and accounting records — 10 years from end of the financial year (basis: accounting obligations)
• Records that may be requested by the tax authorities — 6 years from last transaction (basis: tax authorities' right of inspection)
• Request or proposal that gave rise to no contract, with the related exchanges, messages and attachments — 12 months from last exchange (basis: legitimate interest in following up proposals received)
• Emails received at missions@serotonin-app.com — period applicable to the request or mission they concern
• Copies of emails sent by the service, kept by Resend — 30 days from sending (basis: provider's terms)
• IP address and browser associated with an acceptance — kept with the proof of acceptance of which they form part (basis: proof of acceptance)
• Withdrawal statement and acknowledgement; request for early start; agreement to the involvement of a third party — kept with the proof of acceptance of which they form part (basis: proof of the contract)
• Internal assessments and mission review — kept with the mission file (basis: legitimate interest)
• Bank details for transfer — until the transfer, then with the related accounting records (basis: performance; accounting obligations)
• Shots in which a person is identifiable, without authorisation to disseminate — deleted or made non-identifiable as soon as the decision not to disseminate is taken (basis: data minimisation)
• Authorisation to publish and its withdrawals — with the mission file and, if that date is later, up to 5 years after the end of the authorisation (expiry or withdrawal) (basis: proof of consent; general limitation period)
• Technical fingerprints for limiting abuse — 12 months from recording (basis: abuse prevention)
• Audience measurement — aggregated, without individual identifier

These periods correspond to legal retention obligations or to the periods during which a complaint remains possible. When they expire, the data is intended to be deleted or anonymised.

Requests and proposals that gave rise to no contract are intended to be deleted 12 months after the last exchange, together with their exchanges, messages and attachments. An automatic deletion mechanism is being brought into service: to date, it does not yet delete any data. These periods apply unless a longer retention is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability.

These rights are exercised within the limits provided for by the regulations. In particular, data whose retention is required by law — proof of the accepted contract, invoices and accounting records — cannot be erased before the date indicated above, even at your request.

You can obtain the exact text of the conditions you accepted, as well as your quote as accepted, on simple request.

Identity, contact and mission data are necessary to review your request and to conclude and perform the contract: without them, the mission cannot be carried out. Other information is optional.

Any request may be sent to missions@serotonin-app.com. The Provider replies within one month. You may also lodge a complaint with the French data protection authority (Commission nationale de l'informatique et des libertés, CNIL). You may set out instructions concerning the retention, erasure and communication of your data after your death, and indicate whether it may be communicated to a third party you designate, by writing to missions@serotonin-app.com.

Images and publication

The rules are those of Article 24 of the General Terms and Conditions: open recording for the Provider's communication; no dissemination making it possible to identify you without your written authorisation, separate and revocable for the future, where such authorisation is necessary; no shot and no dissemination making it possible to identify a minor. Withdrawal of the authorisation does not affect earlier publications, which the Provider nevertheless removes where they are under the Provider's control.

The authorisation to publish is requested in the conversation of your mission, separately from the quote and the general terms and conditions; it states the content, the purpose, the media, the duration (3 years) and the territory (worldwide, publication on the Internet); you choose, item by item, what you authorise. You may withdraw it at any time, for the future, from the conversation or by a message to Édouard.

Cookies

The "Édouard — Natural Intelligence" site sets no audience-measurement or advertising cookies. A strictly technical cookie is used for the administration session, which is not accessible to the public.