Privacy policy
This policy describes the personal data processed by Théo Busson et Anaïs Bernard (“we”) in connection with the insider-club.app website (the “Site”) and the Insider Club Shopify app (the “App”). It applies to visitors of the Site, to merchants who install the App (the “Merchant”) and, for the part that concerns them, to the Merchants’ customers who take part in a forum (the “Members”).
1. Data controller and contact
Théo Busson (sole trader, SIRET 883 400 913 00017) and Anaïs Bernard (sole trader, SIRET 883 597 676 00013), joint controllers, [business address to be completed], hello@insider-club.app.
For any question or request regarding your data, write to hello@insider-club.app with the subject line “Personal data”. We are not required to appoint a data protection officer; this address is your single point of contact.
2. Data processed on the Site
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Security and operation of the Site (Cloudflare hosting) | IP address, technical connection data | Legitimate interest: protecting the Site against attacks and abuse | Technical logs kept by Cloudflare for a limited period; we do not access them directly |
| Audience measurement (Cloudflare Web Analytics) | Pages viewed, browser, country, without cookies or persistent identifiers | Legitimate interest: knowing how much the Site is visited. This tool can neither track you from one site to another nor identify you | Aggregated statistics |
| Browsing behavior analysis (Microsoft Clarity) | Mouse movements, clicks, scrolling, pages viewed, device type, “_clck” and “_clsk” cookies | Consent, collected through the banner displayed on your first visit. Without your agreement, Clarity is not loaded | Cookies kept for a maximum of 13 months; recordings kept by Microsoft for 30 days, statistics for 13 months |
| Detailed audience measurement (Google Analytics 4) | Pages viewed, browsing path, visit source, device, country, visitor identifier in the “_ga” and “ga*” cookies | Consent, collected through the banner. Without consent, Google Analytics is not loaded | Cookies kept for 13 months; statistics kept by Google for 14 months |
| Live chat (Crisp) | Messages exchanged, name and email if you provide them, IP address, pages visited during the conversation, session and visitor-recognition cookies | Consent (banner) or your explicit request when you click “Chat with us” | Conversations kept for as long as needed to handle your request, for a maximum of three years |
| Appointment booking (Calendly) | Name, email, chosen time slot, information you enter | Pre-contractual measures taken at your request | For as long as needed to arrange the appointment, then for a maximum of three years |
| Videos (YouTube) | When you start a video, Google receives your IP address and technical data | Consent, given by clicking on the video. The player uses “privacy-enhanced” mode (youtube-nocookie.com) and is only loaded at that moment | According to Google’s policy |
| Measurement of our communication activities | Source of the visit, landing page, country, and the click on “Install on Shopify”. No IP address or personal identifier | Legitimate interest: knowing which channels lead to installing the App | 90 days at most in your browser’s local storage, then aggregated statistics on our servers |
| Free tools | Store address or values entered in the calculators | Performance of the requested service | Result cached for a maximum of 24 hours, with no link to you |
| Contact by email or form | Name, email, content of the message | Legitimate interest: responding to your request | For as long as needed to handle it, then for a maximum of three years |
| Job applications | Name, email, CV, message | Pre-contractual measures taken at your request | Two years after the last contact, unless deletion is requested earlier |
| Affiliate program | Identity, email, website or channel, payment details for commissions, referred stores | Performance of the partnership agreement; accounting obligations | Duration of the partnership, then ten years for accounting records |
| Newsletters and information about the App (Resend) | Email, name, store, opens and clicks in our emails | Consent for the newsletter; legitimate interest in informing Merchants who have installed the App of changes to the service | Until you unsubscribe (link included in every email), then for a maximum of three years |
| Commercial prospecting | For professionals in the Shopify ecosystem: name, business email, website, language, history of exchanges. Data collected from you or from publicly accessible sources (websites, directories, professional networks) | Legitimate interest: offering the App to the professionals it may concern. You may object at any time, by replying to our messages or by email | Three years after the last exchange; people who object are added to an exclusion list |
Your browser’s “Global Privacy Control” signal is honored: when it is enabled, we treat it as a refusal of the cookies that require consent.
3. Data processed in the App
Our roles
- For the Merchant’s data (account, store, billing, exchanges with our support), we are the data controller.
- For the data of Members who take part in a Merchant’s forum, we act as the Merchant’s processor, and the Merchant remains the data controller. The terms of this processing are set out in the data processing agreement appended to the terms.
Data processed
- Store data: name, domain, account email address, country, plan and subscription status, forum configuration preferences.
- Member data: display name, email address, Shopify customer ID, published content (topics, replies, reactions, polls, images and video links), publication dates, notification preferences, moderation decisions concerning them.
- Technical data required for operation and security: Shopify identifiers and tokens, access and error logs.
- Aggregated usage data (number of topics, replies and active members) used for the statistics shown to the Merchant and for improving the service.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the forum, displaying it on the store, managing Member accounts through Shopify customer accounts | Performance of the contract with the Merchant; for Members, the Merchant’s instructions |
| Enabling moderation, reporting and removal of content | Performance of the contract; legal obligations regarding unlawful content |
| Sending the notifications requested by Members (reply to a topic, mention) | Performance of the contract; Members can turn them off |
| Billing the subscription through Shopify | Performance of the contract; accounting obligations |
| Ensuring the security of the service, preventing abuse, keeping logs | Legitimate interest; legal obligations |
| Producing aggregated usage statistics and improving the App | Legitimate interest |
| Informing the Merchant of changes to the service | Legitimate interest |
Public pages and search engine indexing
When the Merchant enables public categories, the topics and replies published in those categories are visible to all visitors of their store and may be indexed by search engines, together with their author’s display name. Categories reserved for logged-in customers are not accessible to search engines. The Merchant informs their Members of this in their forum rules.
Minimum age
The forum is reserved for people aged 15 or over, the age from which a minor may consent alone to the processing of their data in France. The Merchant undertakes to state this in their forum rules. If we learn that an account belongs to a younger person, we delete it together with its content.
Retention period
Data is kept for as long as the App is installed on the store. After uninstallation:
- Shopify sends us, 48 hours after uninstallation, a request to erase the store’s data (“shop/redact”); we then delete all data of the store and of its Members.
- In any event, this data is deleted no later than 30 days after uninstallation, then purged from our backups within the following 30 days.
- Billing data required for our accounting obligations is kept for ten years through Shopify.
The Merchant can ask us at any time for a copy of all of their forum’s discussions.
Requests forwarded by Shopify
We respond automatically to the three mandatory data protection requests defined by Shopify:
- “customers/data_request”: when a customer asks a Merchant for access to their data, we provide the Merchant with the data we hold about that customer.
- “customers/redact”: when a Merchant requests the erasure of a customer’s data, we delete their personal data and anonymize or delete their content according to the Merchant’s instructions.
- “shop/redact”: when a store uninstalls the App, we delete all of its data as described above.
We comply with Shopify’s requirements regarding protected customer data: access limited to the data strictly necessary for the forum, encryption, access logging and deletion on request.
Processors and hosting
| Provider | Role | Location |
|---|---|---|
| Shopify International Limited (Ireland) and Shopify Inc. (Canada) | E-commerce platform, customer accounts, billing | European Union, Canada, United States |
| Cloudflare, Inc. | Hosting, database, image storage, security, Site audience measurement | Data centers located around the world, including the European Union; United States |
| Resend, Inc. | Email delivery (notifications, information about the App, newsletters) | United States |
| Microsoft Ireland Operations Limited (Clarity) | Browsing behavior analysis on the Site, with your consent | European Union, United States |
| Crisp IM SAS | Live chat on the Site, with your consent | European Union |
| Calendly LLC | Appointment booking | United States |
| Google Ireland Limited (YouTube, Google Analytics) | Playing the Site’s videos, at your request; Google Analytics audience measurement, with your consent | European Union, United States |
Transfers outside the European Union
Some of these providers process data in the United States or Canada. Depending on the provider, these transfers are based on an adequacy decision of the European Commission (Canada; companies certified under the EU–US Data Privacy Framework, which is the case for Cloudflare, Microsoft, Google and Calendly) or on the European Commission’s standard contractual clauses, supplemented by appropriate technical measures (encryption of exchanges and of stored data).
Security
Encryption of exchanges (TLS) and of stored data, access to data restricted to those who need it and protected by strong authentication, access logging, regular backups, updating of software components. In the event of a data breach likely to result in a risk to individuals, we notify the French data protection authority (Commission nationale de l’informatique et des libertés, CNIL) within 72 hours and the Merchant concerned without undue delay.
4. Your rights
In accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés), you have the following rights:
- access to your data, rectification, erasure;
- restriction of processing and objection, in particular to commercial prospecting, without having to give a reason;
- portability of the data you have provided to us;
- withdrawal of your consent at any time, for processing based on consent, without affecting the lawfulness of the processing carried out beforehand;
- the right to set out instructions regarding the fate of your data after your death.
To exercise them, write to hello@insider-club.app (subject line “Personal data”). We respond within one month, which may be extended by two months for complex requests; we may ask you for proof of identity in case of reasonable doubt. If you are a Member of a Merchant’s forum, contact that Merchant first, as the controller of your data; we help them respond to you, and you may also write to us directly.
You may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.
5. Cookies and trackers
| Name | Issuer | Purpose | Duration | Consent |
|---|---|---|---|---|
| ic-consent (local storage) | Insider Club | Remembering your choice regarding cookies | 6 months | Not required (necessary to honor your choice) |
| Display preferences and measurement of our communication activities (local storage) | Insider Club | Remembering your preferences, knowing which channel led to the installation | 90 days at most | Not required (operation of the Site, measurement without identifiers) |
| _clck, _clsk, CLID, ANONCHK, MR, MUID, SM | Microsoft Clarity | Browsing behavior analysis | From the session up to 13 months | Required |
| _ga, ga* | Google Analytics 4 | Detailed audience measurement | 13 months | Required |
| crisp-client/session/, crisp-client/socket/ | Crisp | Operation of the chat, recognizing the visitor from one visit to the next | From the session up to 6 months | Required, or explicit request to open the chat |
| YouTube cookies (youtube-nocookie.com) | Video playback | According to Google | Set only after a video is started |
Cloudflare Web Analytics sets no cookies. On your first visit, a banner invites you to accept or refuse the cookies that require consent; both choices are equally simple, and refusing does not limit your browsing. Your choice is kept for six months, after which you are asked again. You can change it at any time using the “Manage cookies” link at the bottom of each page, or delete the cookies in your browser settings.
6. Changes
This policy may change, in particular when we add a provider or a feature. The date of the last update appears at the top of the page; in the event of a significant change for Merchants, we inform them by email or in the App. In the event of any discrepancy between the French version and its translations, the French version prevails.
Install on Shopify