Prélude

Privacy policy

Version 1.3 — Effective date 2026-08-19 — Status live — SHA-256 5233e4be38576a2455dec2219f8b16799b68e08a2e28c337cf2d45cb3fe8b4bb

Data controller

PLEROMIA, 170 bis rue de Saint-Guirec, 22700 Perros-Guirec, France. Contact: contact@pleromia.fr.

Data and purposes

  • Email and hashed password: account creation and security.
  • First name and birth details entered in the tunnel: local chart computation and reading preparation.
  • Derived chart, monthly context and reading text: service delivery.
  • Transaction references, billing snapshots, and local versioned consent proofs: credit-purchase and reading processing and audit duties.

Legal bases

  • Account, natal tunnel, chart computation, reading generation and storage: performance of the contract to which you are a party, Article 6(1)(b) GDPR.
  • Credit purchase, invoicing, and consent proofs attached to a purchase or a reading: performance of the contract, Article 6(1)(b).
  • Retention of accounting records: compliance with a legal obligation to which Prélude is subject, Article 6(1)(c).
  • Account security and rate limiting of the free preview: legitimate interest in protecting the service, Article 6(1)(f).

Storage and recipients

Natal tunnel state is kept in the tab sessionStorage under Prélude’s declared key. Ordered readings, their content, status, and a natal hash are stored in the database. Consent proofs record the server-derived account, purchase or reading parent, type, language, canonical version and hash, and server time; no IP address or user-agent is collected by default. New StripeEvent rows retain only a minimal technical projection without a complete payload, email, userId, or other direct identifier. Complete JSON payloads stored by earlier versions are not deleted by P2.10-B. Strictly necessary providers are Vercel for application hosting, Neon for the database holding accounts, readings and natal hashes, Stripe for payment, and OpenRouter for text generation. For one-time invoicing, the account email address is sent to Stripe and may be associated with a Stripe Customer so that an invoice can be created. The entered first name, derived chart, and a bounded monthly context are sent to OpenRouter to generate the reading. For password-reset emails, the recipient email address and the message content, including the reset link, are sent to Scaleway (Scaleway S.A.S., France), the transactional-email provider. The retention period of message content at this provider is not yet documented here, written confirmation being pending.

Transfers outside the European Union

Some strictly necessary providers are established in the United States. Application hosting is provided by Vercel Inc. and text generation by OpenRouter, Inc.: both transfers rely on the standard contractual clauses adopted by the European Commission under Article 46 GDPR. Payment is contracted with Stripe Payments Europe, Limited, established in Ireland; onward transfers to Stripe, Inc. rely on the standard contractual clauses and on the Data Privacy Framework certification. The database is operated by Neon (Neon, LLC, part of Databricks, Inc., United States) and hosted in the AWS eu-central-1 region (Frankfurt, European Union), the region selected at project creation. Transfers to the group’s U.S. entities rely on the 2021 standard contractual clauses incorporated into the Databricks data-processing addendum, and on Databricks, Inc.’s EU-U.S. Data Privacy Framework certification, whose official registry listing expressly covers Neon, LLC. Transactional email is provided by Scaleway S.A.S., established in France: the service runs from the French fr-par region, within the European Union, and its data-processing agreement (DPA of June 1st, 2024, Article 11) provides that no transfer outside the Union takes place without prior notice and that any such transfer relies on the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914).

Supervisory authority

You may lodge a complaint with the French data-protection authority, Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at www.cnil.fr. That route is open to you without contacting us first.

Retention

Session data ends with the tab session or browser controls. Account data is retained during the relationship and applicable legal periods. Accounting records are retained for the statutory period.

Retention honesty

No retention duration is presented here as an approved legal conclusion. The ten-year accounting rule may justify retaining qualifying invoices and accounting entries; it does not justify keeping profile fields, credentials, birth data, natal hashes, share tokens, or reading content. Withdrawal declarations, transitions, consent evidence, and deletion records require their own approved retention or restriction schedule; until that exists, no period is hard-coded as a legal conclusion.

Your rights

Requests for access, correction, erasure, restriction, portability or objection must be sent to contact@pleromia.fr. An autonomous account export is available to the authenticated account owner. That export is practical access to locally held data and is neither a complete legal response nor a portability finding. An account-deletion feature (local tombstone) is available to the authenticated account owner. Deletion is local: no external erasure is performed at Stripe, OpenRouter, an email provider, or logs outside the proved boundary. Email remains a complementary contact channel for exercising a right.

Account export and deletion

An autonomous account export is available to the authenticated account owner. That export is practical access to locally held data and is neither a complete legal response nor a portability finding. An account-deletion feature (local tombstone) is available to the authenticated account owner. Deletion is local: no external erasure is performed at Stripe, OpenRouter, an email provider, or logs outside the proved boundary.

Cookies and browser storage

Only necessary Auth.js cookies and sessionStorage are used. No analytics, advertising pixel or A/B testing is active. See the cookies policy.