Privacy Policy
In accordance with the General Data Protection Regulation (GDPR — EU 2016/679) and the French Data Protection Act (Loi Informatique et Libertés).
1. Data Controller
The data controller for personal data collected via looona.fr is:
- Company: Arnaud BLANCHARD CETOUTE
- Legal representative: Arnaud BLANCHARD CETOUTE
- Email: [email protected]
2. Data We Collect
We collect only the data necessary for the proper operation of the service.
looona.fr account (cloud platform)
Authentication on the looona.fr platform is handled exclusively through third-party OAuth providers (e.g. GitHub). Looona never stores passwords for platform access. We retain the information provided by your OAuth provider:
- Email address
- Display name and avatar (if provided by the provider)
- OAuth access tokens (encrypted, required for session)
Hosted workspace users
Each workspace hosted on looona.fr runs an instance of the Looona executable. This instance manages its own user database (reporters, dashboard users), including credentials and passwords stored in hashed form (one-way cryptographic hash function). This data is hosted on our infrastructure and is your responsibility as the workspace owner — you are the data controller for your end users.
Usage data (cloud plan)
- Workspace data (name, slug, configuration, instance status)
- Feedback reports submitted via the API (content determined by you and your end users)
- Usage logs (quotas, activity, errors)
Subscription and billing
Payments are handled entirely by our provider Dodo Payments. We never store your payment details or transaction amounts. We retain only the subscription metadata required to operate the service:
- Subscribed plan (Free, Starter, Pro)
- Subscription status
- Subscription identifiers provided by Dodo Payments
- Billing and cancellation dates
Analytics
We use PostHog to analyse website usage and improve the user experience. PostHog collects behavioural data (pages visited, clicks, session duration) only when you have accepted analytics cookies via our consent banner. Data is sent through our self-hosted proxy and no personally identifiable information is transmitted to third parties.
3. Purposes and Legal Bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide and manage your account | Performance of a contract (Art. 6.1.b) |
| Manage subscriptions and billing | Performance of a contract (Art. 6.1.b) |
| Send service notifications (quota alerts, updates) | Performance of a contract (Art. 6.1.b) |
| Comply with legal obligations (accounting, tax) | Legal obligation (Art. 6.1.c) |
| Analyse service usage (PostHog) | Legitimate interest (Art. 6.1.f) — opt-out available |
4. Data Retention
- Account data: retained for the duration of the active subscription, then deleted within 30 days of account closure upon request.
- Workspace data and reports: subject to the retention policy of your plan (7 days for Free, 30 days for Starter, unlimited for Pro). Data is deleted upon account closure.
- Subscription metadata: retained for 10 years in accordance with French accounting obligations.
- Technical logs: retained for a maximum of 12 months.
5. Sub-processors and Data Transfers
In the course of providing the service, your data may be shared with the following sub-processors in compliance with GDPR:
DigitalOcean, LLC
Infrastructure hosting (servers, databases, backups). Data hosted in Europe (AMS3 region — Amsterdam). Data Processing Agreement (DPA) in place.
Dodo Payments
Online payment processing. Your payment details are handled exclusively by Dodo Payments and never pass through our servers. See the Dodo Payments privacy policy.
PostHog
Product analytics. Data is routed through a self-hosted proxy. No personally identifiable data is transmitted. Analytics are only active when the user has accepted analytics cookies.
No data is sold or shared with third parties for advertising purposes.
6. Cookies
This website uses cookies strictly necessary for the service to function (authentication session management). These cookies do not require prior consent.
We also use analytics cookies (PostHog) to improve the user experience. These cookies are only set after you have given your consent via our cookie banner, in compliance with CNIL guidelines. You can change your preference at any time by clearing your browser storage.
You can configure your browser to refuse cookies. Refusing session cookies may prevent you from accessing the service.
7. Your Rights
Under GDPR, you have the following rights regarding your personal data:
- Right of access:Obtain a copy of your personal data.
- Right of rectification:Correct inaccurate or incomplete data.
- Right to erasure:Request deletion of your data ("right to be forgotten"), subject to legal retention obligations.
- Right to data portability:Receive your data in a structured, machine-readable format.
- Right to object:Object to processing based on legitimate interest (e.g. analytics).
- Right to restriction:Request temporary suspension of a processing activity.
To exercise your rights, contact us at [email protected]. We will respond within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the CNIL (French Data Protection Authority).
8. Data Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, disclosure, alteration, or destruction:
- Encrypted communications (HTTPS/TLS)
- OAuth tokens stored in encrypted form
- Workspace passwords stored using a one-way cryptographic hash function
- Restricted access to production data
- Automatic encrypted backups (Starter and Pro plans)
9. Changes to This Policy
We reserve the right to update this policy at any time. In the event of a material change, you will be notified by email or via an in-app notification. The date of the last update is shown below.
Last updated: July 2026