In this document
Storage, emails, and providers
| Provider | Role | Geographic information and status |
|---|---|---|
| PostHog | Optional journey and usage measurement | Projet Cloud aux États-Unis ; événements autorisés uniquement, sans contenu de formulaire ni coordonnées. |
| Supabase | Authentication, database, and private storage | Authentication, database, and private storage in the Frankfurt region. Supabase agreement |
| Vercel | Hosting, functions, logs, and job transport | Functions configured in Frankfurt; the CDN and logs may involve other regions. Vercel agreement |
| Brevo | Notifications and authentication emails | Notifications and authentication messages according to service settings. Brevo terms |
| Stripe | Payments, subscriptions, and customer portal | Payments, subscriptions, and billing information; card details are processed by Stripe. Stripe agreement |
| OpenAI | Optional AI replies when configured | Sharing according to settings; provider and transfers to verify before activation. |
We promise neither hosting in France nor an absence of transfers outside the EU. Read the applicable agreements and provider list before commercial use.
What data is processed?
The service receives fields defined by the customer website, information needed for submission security, and any permitted files. Accounts, recipients, and billing details support providing and administering the service.
The website choosing the fields and purpose is responsible for its submissions. The service acts as processor for intake and storage. The publisher also manages its own account, billing, and security processing.
Retention and deletion
Messages are retained for 90 days by default, configurable per form. Deleting a message also schedules deletion of its files. Copies sent to a recipient’s mailbox are that recipient’s responsibility.
Private exports expire according to their configured duration. Security logs must not contain message text. This page does not confirm the availability of an independent backup or its purge schedule.
Rights and visitor information
For a submission to a customer website, contact that website first. For a service account, use the publisher contact in the legal notice. Customers must choose a legal basis and display information appropriate to their purpose.
The GDPR guide provides an editable example. It does not replace your policy or a review of your obligations.
Audience measurement
Navigation measurement is optional and remains inactive until you authorize it. It uses a random session identifier, page type, template, and journey events. It records no form fields, email addresses, or phone numbers.
Your choice is stored locally. Change it using “Audience measurement choices”. Navigation events are retained for 90 days; plan transitions for 365 days. A first-activation indicator remains attached to the form until deletion, without its content. Intake and delivery aggregates come from operational states and exclude tests and quarantine from activation.