Privacy policy

Last updated : November 5, 2026

We keep it simple: this website is a showcase. It contains no user account, no analytics tool, no advertising and no social media button, and its only forms are there for you to write to us or to answer a project questionnaire we sent you. In accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act, this page explains which data may nevertheless be processed and what your rights are. The French version of this policy prevails.

Data controllers

Mathis Pilon (EI) and Olivia Rives (EI), trading together as WabiSabi, are joint controllers. Their addresses are given in the legal notice. Single point of contact: contact@webisabi.fr.

The data we process

1. When you write to us

If you contact us by email or through the contact form, we receive the information you choose to send us (name, email address, type of project, message, possibly phone number or company).

The form stores nothing on our servers: your message is forwarded to us by email through our sending provider Brevo (Sendinblue SAS), 106 boulevard Haussmann, 75008 Paris, France (brevo.com), acting on our behalf as a processor. To limit abuse, our host counts the number of messages sent from the same IP address for one minute, without storing it.

• Purpose: to reply to you and, where relevant, prepare a proposal.
• Legal basis: pre-contractual steps taken at your request (art. 6.1.b GDPR) or our legitimate interest in answering enquiries (art. 6.1.f).
• Retention: 3 years after our last exchange, then deletion. If a contract is signed, related data is kept for the legal period applicable to commercial documents.
• Email service used: Cloudflare Email Routing (Cloudflare, Inc.), avec transfert vers Gmail (Google Ireland Limited).

2. When you answer a project questionnaire

Before a project, we may send you a link to a questionnaire (brief). Your answers are stored in our database, hosted by Cloudflare, and can only be read by the studio team, from a password-protected area. If we send you this link by email, your name and email address are passed to our email provider Brevo (Sendinblue SAS), for that email only.

• Purpose: to understand your needs and prepare a proposal.
• Legal basis: pre-contractual steps taken at your request (art. 6.1.b GDPR).
• Retention: 3 years after our last exchange, then deletion; sooner on request.
• So that you can come back later, including on another device, your answers are saved as you go: in your browser (local storage, not a cookie) and in our database, linked to your questionnaire link. Before you send them, the studio only sees how many questions have been answered, not what you wrote. Once sent, this draft is erased and replaced by your final answers.

3. When you visit the website

To display the website and protect it against abuse (attacks, bots), our host Cloudflare automatically processes technical connection data: IP address, browser type, requested page, date and time.

• Purpose: to provide the website and keep it secure.
• Legal basis: our legitimate interest (art. 6.1.f GDPR).
• Retention: as long as strictly necessary, according to the host’s policy.

Fonts and images are hosted on our own servers: your browser does not contact any third-party service (Google Fonts or other) when you visit the website.

Cookies and trackers

This website sets no advertising, analytics or social media cookie and uses no tracker. That is why no consent banner is shown.

Our host may set cookies that are strictly necessary for the website’s security (for example to tell a visitor from a malicious bot). These cookies are exempt from consent (article 82 of the French Data Protection Act). If we ever add an analytics tool requiring your consent, this page will be updated and your consent will be requested beforehand.

Who has access to your data

• The WabiSabi team, only for the purposes above.
• Our technical providers, as processors: the host (Cloudflare) and our email service.

Your data is never sold or transferred for commercial purposes.

Transfers outside the European Union

Cloudflare, Inc. is a US company. Data transfers to the United States are covered by the EU–US Data Privacy Framework, to which Cloudflare adheres, and by the European Commission’s standard contractual clauses.

Security

The website is served over HTTPS only and applies security headers (content security policy, protection against embedding in other websites, etc.).

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, and to give instructions about its fate after your death. To exercise these rights, write to us at contact@webisabi.fr. We reply within one month.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (French data protection authority): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — cnil.fr.