Privacy policy
Last updated: 20 September 2026
1. Data controller
Autoentreprise HeartCO, represented by Anasse Ouarraa, 60 rue François 1er, 75008 Paris, France. Contact: support@heartco.fr.
No Data Protection Officer has been appointed given the size of the business, under Article 37 GDPR. The same email address is the contact for data questions, rights requests and complaints.
2. Data collected
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email provided at checkout | Delivery, support and invoicing | Contract performance, Article 6(1)(b) GDPR | 10 years for accounting records |
| GitHub username (checkout) | Invitation to the private repositories you bought | Contract performance, Article 6(1)(b) GDPR | Delivery tracking (with your email): 90 days. Also present in the Stripe order |
| Email (launch list or checklist sign-up) | Send the information you asked for: announcement, launch, checklist | Consent, Article 6(1)(a) GDPR | Until you withdraw consent (reply “STOP” to any email) |
| Audience measurement (anonymous identifier, page views, purchase-funnel steps) | Improve the site and measure the purchase journey | Consent, Article 6(1)(a) GDPR | Only after you accept. Details in the cookie policy |
| Payment data | Payment processing | Contract performance | Handled exclusively by Stripe. Card numbers are never stored on our servers. |
| IP address and user agent | Security and rate limiting | Legitimate interests, Article 6(1)(f) GDPR | 30 days |
| Consent preference | Remember cookie choices | Compliance with consent requirements | 13 months |
| Selected currency | Remember EUR/USD choice | Provide the requested preference | 12 months |
Payment processing is subject to Stripe’s privacy policy. Optional audience and performance measurement runs only after analytics consent, as described in the cookie policy.
3. Processors and transfers outside the EU
| Processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Stripe Inc. | Payments | United States | EU-US Data Privacy Framework |
| Vercel Inc. | Hosting and analytics | United States | EU-US Data Privacy Framework |
| GitHub (Microsoft) | Source-code delivery | United States | EU-US Data Privacy Framework |
| Resend | Sending emails: purchase confirmation, repository access, launch emails you asked for | See Resend’s privacy policy | |
| Upstash | Temporary storage: launch list, delivery tracking, rate limiting | See Upstash’s privacy policy | |
| PostHog | Audience measurement, only after consent | See PostHog’s privacy policy | |
4. Your rights
Under the GDPR, you may request access to your data, correction of inaccuracies, deletion subject to legal retention duties, portability in a structured format, objection to processing based on legitimate interests, and restriction of processing where applicable.
Contact support@heartco.fr to exercise these rights. Responses are provided within 30 days. You may also lodge a complaint with the CNIL.
5. Security
We use technical and organisational safeguards, including HTTPS encryption, CSP and HSTS security headers, and restricted data access.