Privacy policy

We only collect the data necessary for the account, security, subscriptions and alerts requested by the user.

Data controller

The data controller is the site publisher, identified in the Legal notice.

Data processed

Email, name, login session, notification preferences, subscription status and technical payment history.

Purposes and legal bases

Account, authentication and requested services are processed to deliver the service. Security and abuse prevention rely on legitimate interests. Accounting duties rely on law. Optional notifications rely on your choice and can be disabled.

Retention periods

Expired sessions and tokens are deleted after a maximum technical grace period of 7 days. An unverified free account is deleted after 30 days. A resolved or rejected support request is kept for at most 3 years. Financial records and audit logs are retained only for applicable legal periods.

Recipients and transfers

Data is limited to authorised staff and necessary processors: Vercel hosting, Supabase database and storage, Stripe payments, Resend email, and Expo or Web Push notifications. Some providers are outside the European Union and must protect transfers under GDPR requirements.

Audience measurement

Vercel Analytics and Speed Insights are not loaded until their GDPR information and governance have been validated. Marcelito does not install advertising cookies.

Payments

Payments are processed by Stripe. Marcelito does not store bank card numbers.

Rights

You may request access, correction, deletion, restriction, objection or portability through the secure Contact form and keep the supplied reference. You may also complain to the CNIL. The controller's contact details are given in the “Data controller” section.