Privacy policy
Governing language
This is a courtesy translation. In the event of any discrepancy, the French version governs.
What this document covers
It describes how ZephyrLab.io processes personal data: on the zephyrlab.io site, and in the commercial relationship with anyone who subscribes to one of the services it publishes — subscription, payment, invoicing, support.
Use of each application is covered instead by that application's own policy, which details the data it processes in order to work: met2pilot.com/confidentialite for Met2Pilot, dicteo.net for Dictéo. Where a discrepancy concerns a service, that service's policy prevails.
Contents
01Data controller
The data controller is Dimitry Petitprez EI, trading as ZephyrLab.io, SIREN 988 011 847, registered office 40A rue Centrale, 74940 Annecy, France.
Contact: support@zephyrlab.io.
Given the nature and volume of the processing, the business is not required to appoint a data protection officer. Requests are handled directly by the controller.
02What the site processes
zephyrlab.io is a presentation site: it offers no registration, no account and no form, and requires no personal data in order to be read.
| Reading the pages | Technical logs held by the host (IP address, timestamp, page requested, user
agent), for security and correct operation. Legal basis: legitimate interest — article 6(1)(f) GDPR. |
|---|---|
| Writing to a published address | The data contained in the message, used to reply and to keep a record of the
exchange. Legal basis: pre-contractual steps or legitimate interest. |
03Customers, subscriptions and payment
Subscriptions to a service published by ZephyrLab.io are taken out from that service's own site. They involve the processing below, for which ZephyrLab.io is the controller as publisher and seller.
| Subscription | Email address, and the identifying details needed to open access. Legal basis: performance of the contract — article 6(1)(b) GDPR. |
|---|---|
| Payment | The billing details entered at purchase, together with the technical identifier
of the subscription and its state (active, cancelled, unpaid). Legal basis: performance of the contract. |
| Invoicing and accounts | Invoices issued and the corresponding accounting records. Legal basis: legal obligation — article 6(1)(c) GDPR. |
| Support | Exchanges about a subscription, a technical difficulty or a complaint. Legal basis: performance of the contract. |
What the payment provider receives, and what we do not keep
Payment is handled by Stripe Payments Europe, Ltd. Card details never pass through our systems: they are entered in a form supplied by Stripe and sent directly to it.
We retain neither the card number, nor its expiry date, nor its security code — only the technical identifier of the subscription, its state, and the particulars the law requires an invoice to carry.
No data is sold, rented or transferred to third parties for commercial purposes. No profiling or automated decision-making is carried out. No marketing is sent to anyone who has not asked for it.
04Cookies
The zephyrlab.io site sets no cookies. No page contains a tracker, an audience measurement cookie, an advertising cookie or a social network cookie.
That is a decision, not an oversight: audience measurement existed on the articles pages until 20 September 2026, when it was removed. As there is nothing left to consent to, there is no consent banner either.
The pages load typefaces from the Google Fonts service. That request passes the visitor's IP address and the usual browser headers to Google, without setting a cookie. It is the only third-party call the site makes.
Any cookies or local storage used by the applications are described in their own policy.
05Recipients and processors
| Netlify, Inc. | Hosting and delivery of the zephyrlab.io site. United States, with distributed points of presence. |
|---|---|
| Stripe Payments Europe, Ltd. | Payment and subscription management. Ireland — parent company in the United States. |
| Google Ireland Ltd. | Supply of typefaces (Google Fonts), and nothing else. |
Email exchanges pass through the publisher's mail provider. The providers specific to each application — application hosting, database, service email — are named in that application's own policy.
Data may also be disclosed to the company's accountant, and to any administrative or judicial authority making a request in the form prescribed by law.
06Transfers outside the European Union
Hosting of the site and supply of the typefaces involve providers whose parent companies are established in the United States.
The payment provider contracts through its Irish subsidiary but belongs to a group established in the United States: access from the United States cannot be excluded.
These transfers are covered by the European Commission's standard contractual clauses and, where applicable, by the provider's certification under the EU–US Data Privacy Framework.
07Retention periods
| Technical logs | As set by the host's policy, for security and diagnostics; a short period, with no commercial exploitation. |
|---|---|
| Email exchanges | For as long as needed to handle the request, then archived for the applicable limitation periods. |
| Subscription data | For the duration of the contractual relationship, then three years from the end of the subscription. |
| Invoices and accounting records | Ten years, under article L. 123-22 of the French Commercial Code. |
| Cookies | Not applicable — the site sets none. |
08Security
The site is served over HTTPS only, with systematic redirection and strict transport security. It holds no database, no accounts and no administration area reachable from the public domain: its attack surface is deliberately small.
Access to the subscription management tools is personal and protected by two-factor authentication.
09Your rights
Under Regulation (EU) 2016/679 you have the rights of access, rectification, erasure, restriction of processing, objection and data portability, together with the right to withdraw your consent at any time where processing is based on it.
The right to erasure cannot, however, extend to records the law requires us to keep, in particular invoices.
You may also give directions as to what becomes of your data after your death.
These rights may be exercised at support@zephyrlab.io, or by post to the registered office. A reply is given within one month, extendable by two months where the request warrants it. Proof of identity may be requested in the event of reasonable doubt as to the identity of the person making the request.
You may lodge a complaint with the French data protection authority — CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr.
10Changes
This policy may be amended to reflect changes to the services or to the applicable rules. The version that applies is the one published on this page, with its effective date shown at the top. Any substantial change is notified to customers.
The terms of sale are published at zephyrlab.io/terms.