Privacypolicy

bryancellier.fr is published by Bryan Cellier, software engineer, controller of the processing described here under the General Data Protection Regulation (GDPR) and the French Data Protection Act.

This policy covers the website and its Google application "Bryan Cellier", which connects it to Google Calendar for call bookings.

Contact: bryan.cellier.pro@gmail.com.

Only the data you enter, or that the website needs to work, is collected:

• Contact form: first name, last name, email address, subject and message.
• Call booking: name, email address, company (optional), topic, message, chosen slot, and the language and time zone of your browser.
• Client reviews, left on invitation: name, job or company, email address and photo (optional), review and rating.
• Audience measurement: page viewed, language, referring website (domain name only), campaign source, country, device type and browser, and an anonymous identifier that changes every day (see below).
• Security: an irreversible fingerprint of your IP address (hash) comes with messages and call requests to prevent abuse. The IP address itself is never stored.

• Answering your messages and call requests: steps taken at your request before a contract, or legitimate interest in answering you (GDPR article 6.1.b and f).
• Organising an accepted call (calendar invitation, video call link, confirmation email): performance of your request (article 6.1.b).
• Publishing your review: your consent (article 6.1.a), which you can withdraw at any time.
• Measuring the audience: legitimate interest (article 6.1.f), without prior consent since the measurement is anonymous and cookieless, as recommended by the CNIL.
• Protecting the website from spam: legitimate interest (article 6.1.f).

Your data is never used for profiling or advertising, and is never sold or rented.

The audience is measured by the website itself, with no cookie and no identifier stored on your device. Each visit is tied to an identifier computed from the current date, a secret key, your IP address and your browser, then hashed: it changes every day, and can neither follow you from one day to the next nor identify you.

Robots and the signed-in administrator are not counted. These statistics are deleted automatically after 13 months.

The website also uses Vercel Web Analytics and Speed Insights, which measure page traffic and performance in aggregate, without cookies.

No advertising or tracking cookie is set. The storage of your browser only keeps your preferences:

• the light or dark theme you picked;
• the settings of the music player (playback, volume);
• whether the animated intro has already played during your visit.

The only cookies of the website are those of the administration area session, reserved for the publisher. None of these requires your consent, so the website shows no banner.

For call bookings, the website connects to one Google account only: the publisher's own. Visitors never sign in with Google and no data from their Google account is accessed.

• Data accessed: through the Google Calendar API, with two permissions: calendar.freebusy, the busy times of the publisher's calendars, and calendar.events, creating and deleting the events of the calls he accepts. The content of existing events is never read. The email address of the connected Google account is also kept to show it in the settings.
• How it is used: the busy times hide the slots when the publisher is not available. The events place an accepted call in his calendar, invite you (your name and email address are sent to Google so that it can email you the invitation) and generate a Google Meet link. This data is used for nothing else.
• Storage: the busy times are only used to compute the free slots, cached for one hour at most, and are never stored in the database. Only the identifier of the created event and its Meet link are kept with the booking, along with the access token, encrypted (AES-256-GCM), in the database hosted in the European Union.
• Protection: the access token is encrypted (AES-256-GCM) with a key of the server, exchanges with Google are encrypted (HTTPS) and only the processing described here can use it, from the server of the website.
• Sharing and limited use: Google user data is only used for the call bookings described here. It is never sold, never transferred to data brokers or information resellers, never used for advertising (targeted, personalised or not), to determine creditworthiness or for lending, and never used to develop, improve or train artificial intelligence or machine learning models. It is shared with no third party, apart from the hosting and database providers listed below, which store it on the publisher's behalf.
• Retention and deletion: the identifier of an event is kept with its booking (at most 3 years after the last exchange) and deleted with it, and the Google event is deleted when the call is declined or cancelled. You can ask at any time for this data to be deleted by writing to bryan.cellier.pro@gmail.com. Disconnecting Google from the settings of the website revokes the access with Google and deletes the token and the account address; access can also be removed from the Google Account permissions page.

The use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your data is only accessible to the publisher. It is processed on his behalf by the following technical providers:

• Vercel Inc. (United States): hosting of the website and aggregate statistics;
• Neon: database, hosted in the European Union (Frankfurt);
• Resend (United States): sending of the emails;
• Cloudinary (United States): storage of the images, including the photos of the reviews;
• Google (United States): calendar and video call of accepted calls;
• MiroTalk: alternative peer-to-peer video call room.

Transfers outside the European Union are covered by the EU-US Data Privacy Framework or by the standard contractual clauses of the European Commission.

• Messages and call requests: while they are handled, then at most 3 years after the last exchange.
• Reviews: as long as they are published, or until you ask for their removal.
• Audience statistics: 13 months, deleted automatically.
• IP address fingerprints: kept with the message or request they come with.

You have the right to access, rectify, erase, restrict, object to the processing of and port your data, the right to withdraw your consent at any time, and the right to set guidelines for what happens to it after your death.

To exercise them, write to bryan.cellier.pro@gmail.com: you will get an answer within a month. If you consider that your rights are not respected, you can lodge a complaint with the CNIL (French data protection authority).

Exchanges are encrypted (HTTPS), the administration area is reserved for the publisher and protected by authentication, access tokens are encrypted, IP addresses are only kept as fingerprints and the forms are protected against abusive submissions.

This policy may change with the website. The date of the last update is shown at the top of the page.