Privacy
One form, and a count of who read the page. This page says what happens to both.
Last updated :
Controller
Guillaume Rivalan, 110 rue du Cygne, 38070 Saint-Quentin-Fallavier, France.
Write to guillaume@obsign.tech.
What is collected
Only what the contact form asks for: your name, your e-mail address, and your message; your company and role if you fill them in. The server also records the IP address the message came from and the time it arrived, to stop the form being used as a relay.
Why, and on what basis
To answer you. Article 6(1)(b) of the GDPR covers it: steps taken at your request before entering into a contract. The IP address falls under 6(1)(f), since keeping a public form usable is a legitimate interest.
Where it goes
The message is written to a file on the server that serves this page, hosted by Hetzner Online GmbH in Germany (EU). A copy is e-mailed to us through our mail host so that we see it. There is no form provider, no CRM, and no third party in that path.
How long it is kept
Your message: for as long as the exchange is live, and afterwards only if it became a commercial relationship. Ask and it is deleted, without conditions — removed from the file, not hidden from a screen. The measurement below: thirteen months in detail, after which only daily counts survive — a number of pages and a number of readers, with nothing left pointing at anyone.
Cookies
None, and no tracker either. This site stores nothing on your device — no cookie, no local storage, no identifier that outlives the tab — and loads no third-party script. Your browser’s network tab is enough to check: apart from the assistant below, which sends nothing until you type into it, a page talks to no server but this one.
How the audience is counted
On our own server, and it is worth saying plainly rather than burying. Each page tells this server which page was opened, how long it stayed visible, which parts of it were actually on screen and for how long, the language it was read in, the site that linked to it, and which button was pressed. Your IP address is used for four things and stored for none of them: deriving a country, deriving a town for visitors in France, deriving the organisation the address is registered to, and computing the hash that tells one reader from another. All three lookups use tables held on this server, so none of them reaches anybody else. The hash is salted with a secret regenerated every night and destroyed two days later, so nobody — us included — can follow you from one day to the next, or work backwards from the stored value to your address. Within a single day that hash does join your pages into one visit, which is what lets us see that a reader went from the home page to this one; the next day it joins nothing, because the secret behind it no longer exists. Nothing is shared, sold or sent anywhere.
The organisation
An IP address is registered to an operator or a company, and that registration is public. So a visit carries a name — an internet provider for most readers, and for someone reading from an office, often their employer. It is a fact about an organisation, not about a person, and it is the reason we do not need to keep your address: knowing that a bank read the security page is the useful part, and knowing which desk it came from is neither useful nor kept.
The town, and what it is not
A visit from France is filed under a town. The coordinates kept with it are the town’s, taken from a published table — every reader in Lyon is stored with the same pair of numbers, and that pair is the middle of Lyon rather than anywhere either of you has been. It is not a position, it is a label, and it is as precise as the table that produced it: reliable for a city, approximate for a village, and occasionally simply wrong, because it describes where a network is registered rather than where a person is. Two honest consequences: from a large town the figure says nothing about you in particular, and from a small one, on a site this quiet, it may amount to saying that somebody there read a page. Ask and it is deleted.
Why there is no cookie banner
Because measurement built this way does not need one. The CNIL exempts audience measurement from consent where it is strictly first-party, used for nothing but audience measurement, never cross-referenced with other data, never shared, and kept no longer than thirteen months. Those five are properties of the code, not promises in a policy — which is the standard the rest of this site is held to.
One third party: the assistant
The chat panel in the corner is the only place on this site where anything leaves it. What you type there goes to two places. To Voyage AI (United States), which turns the question into the list of numbers the server uses to find the pages that answer it. And to OpenRouter (OpenRouter, Inc., United States), with those pages, which hands both to whichever model provider serves the request; the answer comes back the same way. Nothing else goes with it: no identifier, no history from another visit, nothing about you but the address the connection itself carries. What you write is not written down anywhere here — not the question, not the answer; the exchange lives in the tab and ends with it. What the measurement keeps of it holds none of your words: that a question was asked and from which of our pages, how long the answer took, a count of tokens, and which of our own sections the search picked to answer from. The basis is Article 6(1)(f), our interest in answering a question at the moment it is asked, and in knowing whether the assistant answers it. Do not paste logs, keys or hostnames into it: the contact form is the path for anything of yours that matters, and it reaches a person.
Your rights
Access, rectification, erasure, restriction, objection and portability, by writing to guillaume@obsign.tech. If the answer does not satisfy you, you may complain to the CNIL, the French supervisory authority.