Minimal data, stated purposes
Privacy Policy
Effective and last updated: August 16, 2026
1. Controller and contact
NOVARIA SASU, 60 rue François Ier, 75008 Paris, France, SIREN 993 976 323, is the controller for personal data described here. Contact us at info@novaria-france.fr or by mail at the registered-office address.
2. Data we handle
| Context | Data | Purpose and legal basis |
|---|---|---|
| Website and security | Request time, IP address, user agent, requested URL, security and error signals | Operate, secure and troubleshoot the service; legitimate interests |
| Checkout | Authorized contact name, business email, opaque order and Stripe Checkout Session references, amount, currency, payment status, limited payer/payment metadata returned by Stripe and campaign parameters present in the landing URL (such as UTM values or a Google click identifier) | Create a recoverable checkout record, contact you if a completed payment return is interrupted, reconcile payment and determine the source of an order; take steps to perform the contract, comply with accounting obligations and pursue our legitimate interest in measuring paid acquisition |
| Project intake and invoicing | Name, business email, legal business name, billing address and country, optional business tax ID, brand, event, audience, offer, proof point, CTA, dimensions, colors, asset links, notes and rights confirmations | Invoice, assess, produce and deliver the purchased service; perform the contract and comply with accounting obligations |
| Support | Your messages, contact details and relevant order history | Answer requests, resolve disputes and protect legal rights; contract and legitimate interests |
| Optional measurement | Consent state and, only after consent, Google advertising/measurement identifiers and interaction events | Measure and improve campaigns; consent |
Do not submit payment-card details, personal government identifiers such as an SSN, passwords, special-category data or personal data unrelated to the project. A business VAT or tax identifier may be supplied only when needed for invoicing. Asset intake uses HTTPS links; this site does not ask you to upload files directly.
3. Payment data
Before redirecting you, NOVARIA records the authorized contact name, business email, opaque order reference, your measurement-consent state at checkout and a minimized allow-list of campaign parameters through its transactional-email provider. This first-party recovery record may include a Google click identifier present in the landing URL even if optional Google measurement is rejected; it lets us reconnect a completed payment to you and its acquisition source if the browser return is interrupted. It is not automatically uploaded to Google. Stripe hosts the payment page and handles card data under its own security and legal obligations. NOVARIA receives Checkout Session and transaction identifiers, amount, currency and status needed to confirm the order, but this website does not receive or store your full card number or card security code.
4. Cookies and optional Google measurement
Strictly necessary browser and network functions may operate without consent to deliver and secure the website. Optional Google Ads measurement is blocked until you choose “Accept analytics & ads.” “Reject optional cookies” is presented at the same level, and rejection does not prevent access to the site or checkout.
Your choice is stored in your browser for up to six months. You can withdraw or change it at any time; withdrawal does not affect prior lawful processing. Rejecting or withdrawing blocks optional Google tags, interaction events and any Google upload based on this checkout record. It does not erase the limited first-party recovery record described above or prevent payment.
We do not intentionally use advertising identifiers for sensitive profiling, enhanced conversions are disabled in the site configuration and ad personalization remains disabled by this website. A click identifier in the protected recovery record is never treated by itself as permission to send data to Google.
5. Service providers and transfers
We use providers only for defined operational purposes:
- Cloudflare for website delivery, security and serverless functions;
- Hostinger for domain-registration or DNS services;
- Stripe for hosted payment processing, payer confirmation, receipts and transaction records;
- Resend for transactional intake and confirmation emails; and
- Google Ads for optional campaign measurement, only after consent.
Some providers may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, standard contractual clauses or another lawful safeguard. Providers also process certain data under their own legal duties, especially for payments, fraud prevention and network security.
6. Retention
- Contact details attached to a checkout that never becomes a captured order: normally up to 30 days for payment-recovery and abuse handling.
- Operational intake, working links and project copies: for active delivery and normally up to 90 days after final delivery, unless longer retention is needed for support, a dispute or your documented request.
- Contracts, invoices, transaction references and accounting evidence: for the periods required by French law, which can reach 10 years.
- Support messages: normally up to three years after the last substantive contact, longer only for a live dispute or legal requirement.
- Server and security logs: for the provider’s short operational/security window, subject to a longer period for an investigated incident.
- Consent choice: up to six months in your browser.
- Google measurement data: according to the configured Google account retention settings and applicable consent.
7. Who receives the data
Access is limited to NOVARIA personnel and processors who need the data to perform the service, operate the website, process payment, send transactional email, provide support or comply with law. We may disclose information to authorities, advisers or counterparties when legally required or necessary to establish, exercise or defend legal claims.
8. Your choices and rights
Subject to applicable law, you may ask for access, correction, deletion, restriction, portability or objection, and may withdraw consent at any time. Send your request to info@novaria-france.fr. We may request proportionate information to verify identity and authority.
You may also lodge a complaint with the French data-protection authority, the CNIL, or the competent supervisory authority where you live or work.
9. Security and responsibility for links
We use access controls, HTTPS, hosted card entry, data minimization and limited retention. No system is risk-free. You are responsible for configuring shared asset links so they expose only files needed for the order and for removing access when no longer required.
10. Marketing
Transactional messages about your order do not require marketing consent. We will not add the business contact to promotional email merely because they bought the plan. Any separate marketing choice is optional and can be withdrawn.
11. Changes
We may update this policy when providers, purposes or legal requirements change. The current version and effective date remain available on this page. Material changes affecting active customers will be communicated where required.