Privacy policy
Last updated: 27 September 2026. Data controller: Nesti Studio, operator of GetPack (see the legal notice). Contact: contact@getpack.fr.
In short: we collect the minimum, we host in the European Union, we sell nothing, and you can erase everything from your personal area.
What we collect and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Account | E-mail, first name and field of study (optional), language, proof of declared age, creation and sign-in dates | Performance of the contract (providing your personal area) | Until the account is deleted, or 3 years without sign-in |
| AI digest (newsletter) | E-mail, proof of consent (date, text accepted) | Consent, withdrawable in one click | Until you unsubscribe |
| Sign-in links and sessions | Fingerprint (hash) of the link or session, never the link itself | Account security | 7 days for links, 90 days for sessions |
| Purchases | Product, amount, date, purchase e-mail, Stripe payment ID | Legal obligation (accounting) | 10 years, anonymised after the account is deleted |
| Connector keys | SHA-256 fingerprint of the key, entitlements, purchase e-mail | Performance of the contract | Duration of the access purchased |
| In-house audience measurement | Aggregated counters: page, referring site, country, device type. No cookies, no identifiers, no IP address stored | Legitimate interest (anonymous statistics) | Counters with no personal data |
| PostHog (with your consent) | Page views, clicks, journeys and, where applicable, session recording with inputs masked. IP address anonymised | Consent, withdrawable via "Manage cookies" | 13 months maximum |
| Connector calls | Counter per day, connector, tool, access type and country. Your questions are not stored | Legitimate interest (operation, quotas) | Counters with no personal data; IP address kept for 48 hours for the trial quota |
The account is restricted to people aged 18 and over: we collect no data from minors. We collect no health data; the health tools are for revision, never for a real patient.
Where the data is stored
- Accounts, purchases, statistics: Cloudflare D1 database whose jurisdiction is restricted to the European Union (Neon Postgres database in Frankfurt once it goes live).
- E-mails: Resend, sent from its European Union region (Ireland).
- Payment: Stripe (Stripe Payments Europe, Ireland). We never see your card number.
- Audience measurement with your consent: PostHog, hosted in the European Union (Frankfurt), IP addresses anonymised.
- Site and API: Vercel and Cloudflare (global networks). These US providers fall under the EU–US Data Privacy Framework and standard contractual clauses.
We neither sell nor rent any data, and we display no advertising.
Cookies and trackers
- Session cookie (gp_s): keeps you signed in, only if you sign in. Strictly necessary, no consent required.
- Local preferences (light or dark theme, cookie choices, sign-up window already seen): stored in your browser, never sent.
- In-house audience measurement: no cookies, no identifiers; aggregated counters only.
- PostHog: cookies and local storage set only if you accept. You can change your mind at any time via "Manage cookies" at the bottom of the page; your choice is kept for 6 months.
Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability (GDPR, articles 15 to 21), as well as the right to withdraw your consent at any time. From your personal area, you can edit your details, unsubscribe from the digest and delete your account. For any other request: contact@getpack.fr (reply within one month). You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr/fr/plaintes).
Security
Sign-in via single-use links, sessions and keys stored as fingerprints, HTTPS encryption everywhere, data access restricted to the operator.