Privacy Policy

Vinteuil (www.vinteuil.com) is operated by MARCANT SAS, 60 rue François 1er, 75008 Paris, France, registered in Paris under number 933 121 857 (“we”, “us”). We are the controller of the personal data described in this policy (the “business” for the purposes of California law).

For any privacy question or request, contact us at contact@vinteuil.com. We have not appointed a data protection officer, as this is not required for our activities.

We collect only what we need to run the Service:

• Account data: your email address and, if you sign in with Google or another supported provider, the identifier and basic profile information (such as name and email) that the provider shares with us with your permission. We never receive your passwords for those services.
• Subscription and purchase data: your plan, subscription status, trial and renewal dates, the books you have bought, and the customer, subscription and payment identifiers issued by our payment provider, Stripe. Card details are collected and processed directly by Stripe; we never see or store your full card number.
• Reading data: the books in your library, your reading progress and position, and the ratings you give.
• Consent choices: your cookie preferences and, where applicable, your email preferences and your acceptance of our Terms at sign-up or checkout.
• Support messages: what you send us when you contact us, and our replies.
• Technical and usage data: server logs (such as IP address, browser type, pages requested, date and time, errors), your approximate country (derived from your IP address, for example to show prices in the right currency and apply the right catalog), and usage events (such as pages viewed, books opened, preview reached, checkout started).

We do not ask for sensitive personal data. Please do not include any in your support messages.

For people in the EEA and the UK, the law requires us to state a legal basis for each use of personal data. We use your data:

• To provide the Service (create and secure your account, sign you in, show your library and reading progress, give access to the books you are entitled to read). Legal basis: performance of our contract with you.
• To manage subscriptions, purchases and payments (checkout, free trials, renewals, cancellations, refunds, and fraud prevention). Legal basis: performance of our contract; our legitimate interest in preventing fraud and abuse.
• To send service emails (sign-in codes, a welcome message, order and trial confirmations, renewal or price-change notices, important changes to our Terms). Legal basis: performance of our contract; legal obligation where a notice is required by law.
• To answer your requests and provide support. Legal basis: performance of our contract; our legitimate interest in helping our users.
• To measure and improve the Service using aggregate audience statistics and first-party usage events. Legal basis: our legitimate interest in understanding how the Service is used and improving it.
• To measure our advertising with Google tags, only if you accept these cookies. Legal basis: your consent, which you can withdraw at any time.
• To send you news or recommendations by email, only if you have opted in (or, where the law allows, if you are a customer and did not object), with an unsubscribe link in every message. Legal basis: consent or legitimate interest, as applicable.
• To meet our legal obligations and protect our rights (accounting and tax records, responding to lawful requests, handling disputes). Legal basis: legal obligation; our legitimate interest in establishing or defending legal claims.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

We use three kinds of technologies:

• Strictly necessary cookies and local storage, for example to keep you signed in, remember your reading position, your currency and your cookie choices, and secure checkout. These do not require consent.
• Cookie-free audience measurement with Vercel Web Analytics and our own first-party events, which give us aggregate statistics without placing cookies for that purpose.
• Google tag (Google Analytics and Google Ads), which we load only after you accept it in our cookie banner. It helps us measure visits and the effectiveness of our ads. If you decline, these tags are not loaded.

You can change your choice at any time using the “Manage cookies” link at the bottom of every page. Advertising and analytics cookies are kept for no more than 13 months.

We do not sell your personal data. We share it only with service providers that process it on our behalf and under our instructions, bound by contractual confidentiality and data protection obligations:

• Vercel Inc. (United States): website hosting, server logs, and cookie-free analytics.
• Supabase Inc.: database, authentication, and file storage.
• Stripe (Stripe Payments Europe Ltd. and Stripe, Inc.): payment processing and the subscription management portal. Stripe also acts as an independent controller for some purposes, such as fraud prevention and its legal obligations; see Stripe’s privacy policy.
• Resend: sending transactional emails, such as sign-in codes and receipts.
• Google (and, where offered, Meta or Apple): if you choose to sign in with them, they confirm your identity to us. Google also receives data through the Google tag if you accept it.

We may also disclose data if required by law or a valid order from a public authority, to protect our rights or the safety of others, or to a successor in the event of a merger, acquisition, or sale of assets, in which case this policy will continue to protect your data.

We are based in France, and some of our providers are located, or may access data, outside the European Economic Area (EEA) and the UK, in particular in the United States. Where this happens, we rely on an adequacy decision (such as the EU-US Data Privacy Framework, for providers certified under it) or on the European Commission’s standard contractual clauses and, for UK data, the UK International Data Transfer Addendum, together with appropriate additional safeguards. You can ask us for more information about these safeguards at contact@vinteuil.com.

• Account and reading data: for as long as your account is open. Deletion from vinteuil.com covers its reading data, purchases and subscription. Your shared Vinteuil sign-in identity is retained for access to other Vinteuil services; contact us to request deletion of that identity. We delete or anonymize the requested data within 30 days, except copies in encrypted backups, which are overwritten in the normal backup cycle.
• Inactive accounts: if an account without an active subscription is not used for 3 years, we may delete it after giving notice by email.
• Billing and transaction records: for 10 years, as required by French accounting law.
• Support messages: up to 3 years after our last exchange.
• Technical logs: generally no more than 12 months.
• Cookie consent choices: we ask you again at least every 13 months, and keep a record of your choice for as long as needed to prove it.
• Marketing emails: until you unsubscribe, or 3 years after your last interaction with us.

We may keep data longer where necessary to comply with a legal obligation or to establish, exercise, or defend legal claims.

Depending on where you live, you may have the right to access your personal data, correct it, delete it, receive a portable copy, restrict or object to certain uses, and withdraw your consent at any time (without affecting prior processing). You can:

• delete your account yourself from your Account page (“Delete my account”);
• change your cookie choices with the “Manage cookies” link at the bottom of every page;
• unsubscribe from marketing emails using the link in each email;
• send any other request to contact@vinteuil.com or through our Support page.

We will respond within one month (which may be extended where the law allows), or within the time limit set by the law that applies to you. We may need to verify your identity, usually by asking you to confirm the request from the email address linked to your account. You may use an authorized agent where the law permits; we may ask for proof of their authorization.

If you are in the EEA, the EU General Data Protection Regulation (GDPR) applies; if you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply. In addition to the rights above, you have the right to object at any time to processing based on our legitimate interests, and to object to direct marketing.

If you are not satisfied with our response, you can lodge a complaint with a data protection authority, in particular in the country where you live or work. Our lead supervisory authority is the French data protection authority, the CNIL. In the UK, you can complain to the Information Commissioner’s Office (ICO). We would appreciate the chance to address your concern first.

To the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”), applies to us, this section gives California residents the required information. It also reflects our approach for residents of other US states with similar laws.

Categories of personal information we collect

In the past 12 months we have collected: identifiers (email address, account and sign-in identifiers, IP address); commercial information (subscription plan, purchases and history); internet or other electronic network activity (reading activity, usage events, logs); and approximate geolocation (country derived from IP address). We collect them from you, your device, and the sign-in and payment providers you use, for the purposes described in “How we use your data”, and keep them for the periods described in “How long we keep your data”. We do not collect sensitive personal information as defined by the CCPA, other than account sign-in credentials used only to give you access to your account.

Selling and sharing

We do not sell personal information, and we do not knowingly sell or share the personal information of consumers under 16. We only use Google advertising tags, which may count as “sharing” for cross-context behavioral advertising under the CCPA, if you accept them in our cookie banner. You can opt out at any time using the “Manage cookies” link at the bottom of every page. We also treat a Global Privacy Control (GPC) signal sent by your browser as a request to opt out of such sharing for that browser.

Your rights

You have the right to know what personal information we collect, use, and disclose; to access it; to request its deletion; to correct inaccurate information; to opt out of sale or sharing; and to limit the use of sensitive personal information (which we do not use beyond what is permitted). To exercise these rights, email contact@vinteuil.com or use our Support page. We will verify your request as described above.

We will not discriminate against you for exercising any of these rights, for example by denying you the Service or charging you a different price.

The Service is not directed to children under 13, and you must be at least 13 to create an account. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has given us personal data, please contact us at contact@vinteuil.com and we will delete it. In the EEA, where local law sets a higher age for consenting to online services, a parent or guardian must give or authorize consent where required.

We use appropriate technical and organizational measures to protect your data, including encrypted connections (HTTPS), passwordless sign-in, access controls, and reputable providers. No online service can be completely secure, however. If a data breach is likely to put your rights at high risk, we will notify you and the relevant authorities as required by law.

We may update this policy from time to time. The “Last updated” date at the top shows when it was last changed. If we make material changes, we will let you know by email or on the Service before they take effect.