Document pending legal review. This document is preliminary information, to be reviewed by a lawyer before commercial release. Last updated: August 2026.

Only the French version of this document is legally binding. Translations are provided for your convenience.

Privacy Policy

ShadGramers is committed to processing your personal data rigorously, in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679).

Data controller

ShadGramers — contact@shadgramers.tech. Data Protection Officer (DPO): to be appointed before commercial launch (a GDPR requirement for large-scale processing — under assessment).

Data collected and processing purposes

Context	Data	Legal basis	Retention
Contact formPurpose : Answer your enquiry	Name, email, company, message, request context (offer viewed, headcount given), hashed IP fingerprint (SHA-256, never the raw IP), browser user agent and language	Legitimate interest	3 years after the request, unless you become a customer (then governed by the contractual regime)
Quotation or engagement form (/devis, /mission)Purpose : Draw up a quotation or qualify an engagement request	Name, email, company, phone (opt.), description of the project or engagement (Consulting, Development, Training), request context (offer, headcount, urgency and budget given), hashed IP fingerprint (SHA-256, never the raw IP), browser user agent and language	Pre-contractual steps at your request (Art. 6(1)(b) GDPR)	3 years after the request, unless you become a customer (then governed by the contractual regime)
Demo request (sandbox)Purpose : Create your temporary access to the portal demo and send it to you by email	Email, first name, company, country, phone (optional, with explicit consent to be called back), hashed IP fingerprint (SHA-256, never the raw IP), demo environment identifier, actions performed during the session (ticket created, alert acknowledged… — never the content you typed), logged in the platform's audit trail, archived when the demo environment is purged, then erased 30 days later	Pre-contractual steps at your request (Art. 6(1)(b) GDPR)	3 years after the request, unless you become a customer (then governed by the contractual regime)
Newsletter sign-upPurpose : Sending the newsletter (2 mailings per month at most)	Email address (name optional)	Consent (Art. 6(1)(a) GDPR), double opt-in	Until you unsubscribe, in one click from any email
Order (Stripe payment)Purpose : Processing the payment	Email, amount, service slug — processed by Stripe Inc.	Performance of the contract	Per Stripe's policy + 10-year statutory period
Customer portal (account)Purpose : Authentication and access to the service	Email, password hash (Keycloak), preferences	Performance of the contract	Duration of the contract, then 90 days from the effective termination (article 12 of the T&Cs) before permanent erasure
Server logsPurpose : Security, debugging, NIS2 audit	IP address, user agent, route	Legitimate interest (security)	90 days

Recipients and processors

The data collected is accessible only to the ShadGramers teams concerned by your request (Consulting, Development or Training division, or the sales team), on a least-privilege basis. It is never sold or rented to third parties.

ShadGramers uses processors (Article 28 GDPR) for hosting, transactional email and payment. The full, up-to-date list is published on our dedicated page: Processors (Article 28 GDPR).

Hosting and transfers outside the EU

All data processed by ShadGramers is hosted in the European Union. No transfer outside the EU takes place for operational data.

Stripe exception: payment processing involves Stripe Inc. (United States). The data transmitted is limited to the email address, the amount and the identifier of the service ordered. This exception is documented in our sovereignty commitments.

Data security and encryption

Data you entrust to us is encrypted at rest using an encryption key unique to your account. This key is itself locked twice: by a key derived from your password, and by a service key that ShadGramers retains.

This second key exists for two reasons: it lets processes that run in your absence (scheduled backups, provisioning, webhook delivery) keep working, and it prevents a lost password from causing the permanent loss of your data.

Assumed consequence: ShadGramers can technically restore access to your data without knowing your password. This capability is reserved for the service's automated processes and for the lost-password recovery procedure — it grants no permanent or discretionary access to your data.

Contractual detail is set out in Article 10 of the Terms of Sale.

Your rights

Under the GDPR (Articles 15 to 22), you have the following rights:

Right of access to your personal data
Right to rectification of inaccurate data
Right to erasure (the "right to be forgotten")
Right to data portability (export in an open format)
Right to object to processing
Right to restriction of processing
Right to withdraw your consent at any time, for the processing that relies on it (newsletter, analytics cookies) — without affecting the lawfulness of processing already carried out
Right to leave instructions on what happens to your data after your death (article 85 of the French Data Protection Act)

To exercise these rights: rgpd@shadgramers.tech. We reply within 30 days. If a dispute remains unresolved, you may lodge a complaint with the CNIL (cnil.fr) or with your own supervisory authority.

Cookies and analytics

This site uses functional cookies only, listed below. No advertising cookie, no third-party tracker and no US analytics tool (Google Analytics, Mixpanel) is deployed.

Cookie	Purpose	Duration	Basis
consent	Stores your cookie choice	6 months	Consent
shg_theme	Stores your display preference (light or dark theme)	1 year	Exempt — preference set by your explicit action
shg_audience	Stores the level of detail chosen for product pages (Essential or Technical)	1 year	Exempt — preference set by your explicit action
NEXT_LOCALE	Stores the display language	1 year	Exempt — strictly necessary

Analytics, when enabled, runs on self-hosted Plausible Analytics on our own infrastructure in the European Union: no data is sent to a third party and no advertising identifier is set. The script is loaded only after your explicit consent to the "Statistics" category. If no analytics instance is configured, the category is not offered and no script is loaded.

You can change your mind at any time, here or from the footer of any page:

Terms of Sale →Terms of Use →Legal notice →