Privacy policy

This is an editorial site: it is read without an account and without a form. There is almost nothing for it to process. What follows states exactly what there is, and on what basis.

Data controller

Florian Dupuis, Independent consultant — registered micro-enterprise, SIRET 852 600 543 00015, registered in France.
For anything concerning personal data: hello@dupflo.dev.

Given the nature and volume of the processing, appointing a data protection officer is not required. Requests are handled directly by the controller.

Data processed

• Host server logs. Every request to the site is logged by Vercel: IP address, timestamp, requested URL, response code, user agent, referrer. These logs are generated automatically by the infrastructure.
• Contact messages. If you write to hello@dupflo.dev, I process your email address, your name where the message carries one, and the content of the message.
• Aggregate analytics. Vercel Analytics counts page views without a cookie, without a persistent identifier and without browser fingerprinting. The data is aggregate: I see volumes per page, not visitors.
• Article reactions. The button at the end of an article increments a counter. It records no identity, no IP address, and nothing that ties that click to you.

No advertising cookie, no marketing tracker, no social pixel, no data sold. The site sets no non-essential cookie, so there is no consent to collect and no banner to display.

No special category of data within the meaning of Article 9 GDPR is collected, and the site is not directed at children under fifteen.

Purposes and legal bases

• Serving the pages and keeping the site secure (server logs): legitimate interest, Article 6(1)(f) GDPR. The interest pursued is keeping the site available and detecting abuse, such as an attack or a spike of automated traffic.
• Answering a message (contact email): performance of a request you initiate, Article 6(1)(b) where it concerns an engagement, legitimate interest, Article 6(1)(f), otherwise.
• Understanding which pages are read (cookieless aggregate analytics): legitimate interest, Article 6(1)(f), exempt from consent since nothing is stored on your device.

No automated decision-making and no profiling is carried out on this data.

Retention

• Contact messages: 12 months from the last exchange, then deleted. Exchanges that lead to a commercial relationship are kept under accounting and tax obligations, which is ten years for supporting documents.
• Server logs: around 30 days, per the host's retention policy, then purged automatically.
• Analytics: aggregate figures only, with no individual record to keep or erase.

Recipients

Your data is not sold, rented or handed on. It is accessible to me, and to the technical processors strictly needed to run the site:

• Vercel Inc. (440 N Barranca Avenue #4133, Covina, CA 91723, USA): hosting, page delivery, server logs, analytics.
• My email provider: delivery and storage of the messages you send me.
• Upstash: storage of the reaction counter, which holds no personal data.

Each acts on instruction, under a processing agreement within the meaning of Article 28 GDPR.

Transfers outside the European Union

Vercel Inc. is a company incorporated in the United States. Some processing, the server logs in particular, may therefore involve a transfer of data outside the European Union.

Those transfers are covered by the European Commission's standard contractual clauses (decision 2021/914), together with the host's technical measures: encryption in transit and at rest, and access partitioning. No data is transferred to a third country outside that framework.

Your rights

Under Articles 15 to 22 GDPR you have the right of access, rectification, erasure, restriction of processing, objection to processing based on legitimate interest, and data portability.

To exercise any of them, write to hello@dupflo.dev; a postal address is given on request. You will get an answer within one month, extendable by two months for a complex request, in which case you will be told. Proof of identity may be requested where there is reasonable doubt about who is asking.

If the answer does not satisfy you, you may lodge a complaint with the French data protection authority, the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or online: cnil.fr/en/plaintes.

Security

The site is served over HTTPS only, with HSTS: a browser that has visited it once refuses any unencrypted connection afterwards. The usual security headers are in place, notably against framing the site from a third-party origin and against content-type sniffing.

Pages are pre-rendered and served as static files: there is no visitor database, no user account and no session, so there are no credentials to protect. Access to the administration tools — code repository and hosting — is protected by two-factor authentication.

Changes

This policy may be updated to follow changes in the site or in the regulation. The version in force is the one published on this page, dated below.

Governing version

This is a translation. The French version prevails in case of any discrepancy.