Privacy policy

This policy explains how MENDING processes personal data in connection with the Embarq service: data about its customers, about visitors to this website and to the public pages hosted by Embarq, and about people who request the deletion of their account through a customer's app. We collect the bare minimum and we set no cookies. This English version is provided for convenience; in case of discrepancy, the French version prevails.

1. Data controller

MENDING, SAS with a share capital of €1,000, 60 rue François 1er, 75008 Paris, France, RCS Paris 992364364, represented by Maxime Vaugoyeau and Romain Vrebos. Contact for any question about your data: [email protected].

MENDING acts as controller for its customers' data and for audience measurement on its own websites, and as processor on behalf of app publishers (its customers) for account deletion requests and the statistics it provides to them.

2. Customer data

Card details are entered directly with Stripe and never pass through our servers. We only keep the information needed to follow up on payments (for example the last four digits and expiry date shown in your dashboard).

We do not use your data for advertising and never sell it.

3. Visitors to this website and to public pages

Public pages include this website (embarq.mending.fr) and the pages hosted for our customers' apps: single link, QR code page and legal pages.

• No cookies, no local storage and no advertising trackers are used. No consent banner is therefore needed.
• Your IP address is never stored in clear text. It is used transiently to deliver the page, infer the country and compute an anonymous fingerprint, and is then discarded.
• To count unique visitors without identifying them, we compute a hashed fingerprint from the IP address, the browser and a secret salt rotated every day. This fingerprint cannot recognise you from one day to the next, nor be traced back to your IP address.
• The measurement data kept is: the page viewed, the referrer, the country, the device type, the operating system and browser and, for the single link, the store the visitor was redirected to.
• Measurement is performed with Vigie, MENDING's cookieless audience measurement tool, self-hosted by MENDING: no data is sent to a third-party analytics tool.

Purposes: produce aggregated statistics for us and for the publisher of the app concerned, calculate billed usage, keep the service secure (preventing abuse and automated traffic). Legal basis: legitimate interest of MENDING and its customers, with minimal impact on your privacy. You may object by writing to us; you can also block the measurement script in your browser and the website will keep working.

4. Account deletion requests

Each customer app has a page that lets its users request the deletion of their account, as Google Play requires. The data entered in this form (account identifier or email address, optional message, date of the request) is sent to the publisher of the app concerned, by email and, where applicable, by webhook.

For this processing, Embarq acts as a processor on behalf of the app publisher, who is the controller and carries out the deletion. To exercise your rights over your account data in that app, contact its publisher, whose details appear on the app's support page. MENDING keeps a record of the request for 12 months so the publisher can demonstrate how it was handled.

5. Retention periods

6. Recipients and processors

Your data is only accessible to authorised MENDING staff and to our processors, within the limits of their tasks:

• Railway Corp. (USA): hosting of the application and databases, on infrastructure located in the European Union (europe-west4 region, Netherlands);
• Stripe, through ShopiLike, MENDING's payment and invoicing platform: payment processing, invoicing;
• our transactional email provider: service emails (sign-in, invoices, reminders, deletion requests);
• app publishers, for the account deletion requests that concern them and the aggregated statistics of their apps.

We may also disclose data to authorities where required by law.

7. Transfers outside the European Union

Data is hosted in the European Union. Some processors (Railway, Stripe) belong to groups established in the United States and may access it for support or security purposes. These transfers are governed by the European Commission's standard contractual clauses and, where applicable, by the provider's participation in the EU-US Data Privacy Framework.

8. Security

Encrypted connections (HTTPS), hashed passwords, revocable tokens, restricted access, logging, backups: we apply technical and organisational measures appropriate to the risks.

9. Your rights

Under the GDPR and the French Data Protection Act, you have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to set instructions for what happens to it after your death. To exercise them, write to [email protected]. We respond within one month. We may ask you to prove your identity if there is reasonable doubt.

If you believe your rights are not respected, you may lodge a complaint with the French data protection authority, the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr), or with the authority of your country of residence.

10. Minors

The Embarq service is intended for adults and businesses. It is not aimed at children under 15.

11. Changes

We may update this policy. The update date appears at the top of the page. In case of significant change, customers are notified by email.

12. Contact

MENDING, 60 rue François 1er, 75008 Paris, France. [email protected], +33 6 66 21 98 41.