Privacy policy version: buyer-managed-20261111-v6
Privacy
What data the seller website and the purchase process collect, why they collect it, how long they keep it and what rights you have.
Fabien Stépho EI, trading as Alto Brio, is the data controller for the seller website, its demo and the purchase process. Business address: 173 rue de Courcelles, 75017 Paris, France. Contact contact@altobrio.com for privacy requests. This seller service is separate from the application you build and its users’ data.
Browsing and cookies
You can browse without an account. The Atelier demo uses fictional data and needs no email address or payment card. Its __Host-atelier_demo cookie is restricted to the demo website and lasts thirty minutes. Demo workspaces are temporary and excluded from seller backups.
Our host processes your IP address and request information to deliver and secure the website. The demo uses a pseudonymous network identifier to prevent abuse, without retaining the raw IP address. These demo security records expire after forty-eight hours.
GitHub sign-in verifies the source recipient and provides access to orders and invoices. We receive your GitHub identifier, login and available two-factor authentication status. We retain your declaration that the receiving account uses two-factor authentication without SMS, and its time, with the accepted offer. GitHub authentication tokens are discarded after verification. Short-lived request limits help prevent abuse.
The __Host-atelier_oauth cookie holds the encrypted browser sign-in record for GitHub and lasts ten minutes.
The __Host-atelier_session cookie keeps you signed in for up to seven days; signing out ends that session. The __Host-atelier_csrf cookie protects account actions against forged requests and lasts seven days. These functional cookies are restricted to the seller website and are not used for audience measurement. Blocking them can prevent sign-in and buyer-account actions.
Audience counts
We count public page views, demo entries and selected demo actions by day, page, event and normalized source category. The counts contain no visitor identifier, IP address, browser user-agent, raw URL or individual browsing history. No analytics cookie is used. These counts are kept separately in each service and are not linked to accounts or orders. They may include automated visits and do not measure unique people.
Purchase data
Before Checkout, we record your declared business country, professional purchase declaration, GitHub identity and security declaration, accepted terms and source identity. Stripe Checkout collects your business, contact and billing details. To administer your purchase, we retain the completed transaction details and payment, tax, invoice, delivery and refund records supplied by Stripe, together with GitHub source-access records.
Purposes and legal grounds
Preparing and fulfilling an individual’s purchase relies on the contract or requested pre-contractual steps. For a company representative, we rely on our legitimate interest in administering the company’s purchase. Legitimate interests also cover service security, fraud prevention and aggregate audience counts; required accounting records rely on legal obligations.
Providers and storage
Render hosts the seller website, order database and demonstration in Frankfurt, Germany. The demonstration has a separate database and uses fictional data. OVHcloud Object Storage holds encrypted independent backups in France. Stripe provides Managed Payments, transaction taxes and invoicing; GitHub verifies your existing account and provides source access. Google Workspace Gmail handles client correspondence. Resend sends operator alerts and the reminder before your repository access expires. Better Stack receives minimal availability checks and worker and backup heartbeats, without buyer data, application logs or browser tracking. Client correspondence is not copied to personal or routine operator mailboxes.
Stripe, GitHub and Google also process account or transaction data for their own purposes. Some providers process data outside the EEA, including Render’s US processing operations and Resend’s US service-data storage. Choosing a European hosting region does not place every provider operation in the EEA.
Render’s data-processing terms provide the EU–US Data Privacy Framework for covered transfers and standard contractual clauses when it does not apply. Google Workspace uses that framework for covered US transfers and contractual clauses for other restricted transfers. Resend’s data-processing terms incorporate contractual clauses; OVHcloud’s terms provide them for relevant transfers from its EU services. Stripe/Link and GitHub describe adequacy and contractual safeguards in their linked privacy information. Better Stack processes the operator account and technical monitoring metadata under its privacy policy and describes adequacy decisions or contractual safeguards for transfers outside the EEA. These documents are linked below or available from us on request.
Retention
The encrypted browser sign-in record expires after ten minutes. Buyer sessions expire after seven days and are purged hourly by the worker. Signing out ends the active session. Short-lived sign-in request limits are held in memory and reset when the web service restarts. Recovery copies follow the backup rules below.
Audience counts are stored locally for twelve months. Purchase totals are calculated separately from order dates; they do not attribute a purchase to a visitor or source. No audience data is sent to an external analytics service.
Offers you do not accept are deleted thirty days after expiry. Accepted orders closed without payment are deleted thirty days after closure once payment is definitively excluded and operations are resolved. Operational contact and invitation details are removed within thirty days after access ends, once related operations are resolved. Completed task details are deleted after thirty days; unresolved operations remain until resolved.
Unnecessary request or export copies are removed within thirty days after verified resolution or handover; ordinary administrative messages within ninety days after closure. Minimized technical diagnostics are retained for at most fourteen days. Required accounting documents are exported from Stripe to Alto Brio’s restricted accounting records and retained for ten years after the end of the relevant financial year.
Necessary contract and delivery proof is retained for five years after the service ends or a relevant remedy is finally resolved, whichever is later. Minimal proof of the acquired licence remains while the acquired rights continue and, where needed for their defence, for five years after their legally established end. Dispute records follow the applicable claim period.
Recovery backups
Deleting active data does not immediately erase recovery copies. Render’s continuous recovery window on the selected workspace plan is three days. Independent encrypted PostgreSQL copies are made daily and become eligible for expiry in OVHcloud after seven days; provider deletion may take longer. Minimal erasure decisions are stored separately and become eligible for expiry thirty days after their last application attempt. They are applied before restored data returns to service. Temporary restored databases are removed after use.
Your rights
Send requests for access, correction, erasure or restriction of your personal data, or portability where applicable, to contact@altobrio.com. You may object to processing based on legitimate interests. Alto Brio seeks only the information needed to verify your identity and responds without undue delay and within one month. If complexity or the number of requests requires up to two further months, Alto Brio explains why within the first month. Alto Brio explains which records must remain and which provider or backup steps are outstanding. Refund and data erasure are separate requests. You may complain to the CNIL or another competent data-protection authority.