← back

Privacy Policy

Last updated: March 24, 2026

This policy describes the personal data collected by Blaff, its purpose and your rights under the General Data Protection Regulation (GDPR — EU 2016/679).

Data controller

[COMPANY NAME] — [ADDRESS] — contact@blaff97.com

Data collected and purposes

User account

First name, email, password (bcrypt hashed). Purpose: authentication and account management. Legal basis: performance of the contract.

Orders

Items ordered, amounts, timestamps, QR code. Purpose: order processing, invoicing, dispute handling. Legal basis: performance of the contract and legal obligation.

Payment

Banking data is processed exclusively by Stripe (tokenization). Blaff does not store any card numbers. Legal basis: performance of the contract.

Geolocation

Approximate position (with your consent) to center the map on your location. Not stored in the database. Legal basis: consent.

Push notifications

Notification token (with your consent) to alert you about new stock. Legal basis: consent.

Email alerts

Email and selected species, for sending stock alerts. Legal basis: consent.

Technical logs

IP address, request timestamps. Purpose: security and fraud prevention. Retention: 30 days. Legal basis: legitimate interest.

Retention period

  • Account data: until account deletion + 1 year (accounting obligations).
  • Order data: 5 years (legal accounting retention requirement).
  • Technical logs: rolling 30 days.
  • Push tokens: until consent is withdrawn.

Data recipients

  • Stripe — payment processing (US / Ireland, EU standard contractual clauses).
  • Brevo — transactional email delivery (France/EU).
  • OVHcloud — hosting (France).

No data is sold to third parties or used for advertising purposes.

Your rights

Under the GDPR, you have the following rights:

  • Right to access your personal data.
  • Right to rectification.
  • Right to erasure ("right to be forgotten").
  • Right to data portability.
  • Right to object to processing.
  • Right to withdraw your consent at any time.

To exercise these rights: contact@blaff97.com

If your complaint remains unresolved, you may contact the CNIL (French data protection authority).

Cookies and similar technologies

Blaff only uses cookies strictly necessary for the site to function (session, CSRF security). No advertising or third-party tracking cookies are set.