Privacy policy

This policy describes how your personal data is collected and processed when you use the getnobullshit.com website (“the Site”), create an account, place an order or subscribe to our newsletter.

It is established in accordance with Regulation (EU) 2016/679 (“GDPR”) and French Act No. 78-17 of January 6, 1978 as amended (“Data Protection Act”).

The controller of your personal data is:

FGRibreau SARL
Limited liability company with share capital of €2,000
Registered with the Trade and Companies Register of La Roche-sur-Yon under 850 824 350
Registered office: 3 rue de l’Aubépine, 85110 Chantonnay, France
Represented by François-Guillaume Ribreau, as manager

Contact (exercise of rights and any question about your data): fg@getnobullshit.com

Data Protection Officer (DPO): not appointed. Given the nature and volume of processing, appointing a DPO is not mandatory under Article 37.1 GDPR. For any question, write to the contact address above.

Depending on your use of the Site, we collect the following categories of data:

• Account creation — Email address, password (stored as an argon2 cryptographic hash, never in clear text). Mandatory, source: you.
• Order (DRM-free e-book, checklists, hardcover book, posters, team license) — First and last name, email, billing address and, for physical products, delivery address. Mandatory, source: you.
• Payment — Payment data processed directly by our payment provider (card, email) — we neither store nor see your card number. Mandatory, source: you via the provider.
• Newsletter — Email address, date and proof of consent (double opt-in). Mandatory, source: you.
• Browsing / audience measurement — Pages viewed, aggregated technical data (via Matomo, cookieless configuration — see §8). Source: automatic.

We collect no sensitive data within the meaning of Article 9 GDPR (health, opinions, etc.).

Without the data marked as mandatory, we cannot process your order or create/manage your account.

Nominative stamp: your name and email are affixed (watermarked) to the digital book file to prevent unauthorized sharing (basis: contract performance art. 6.1.b and legitimate interest).

In accordance with Article 13 GDPR, each processing operation relies on a specific legal basis and a defined retention period:

• Processing and execution of your order — Basis: contract performance (art. 6.1.b). Period: for the duration of the contractual relationship, then archived for evidentiary purposes and to meet accounting obligations (up to 10 years — art. L123-22 Commercial Code).
• Management of your customer account — Basis: contract performance (art. 6.1.b). Period: for the lifetime of the account; deleted on request (subject to accounting obligations below); an inactive account is deleted or anonymized no later than 3 years after your last login.
• Accounting and tax obligations — Basis: legal obligation (art. 6.1.c). Period: 10 years from the close of the financial year (art. L.123-22 Commercial Code).
• Newsletter — Basis: consent (art. 6.1.a, double opt-in). Period: until you withdraw consent (unsubscribe).
• Commercial prospecting of customers and prospects — Basis: legitimate interest / consent as applicable (see §7). Period: 3 years from your last contact (CNIL recommendation).
• Site audience measurement — Basis: legitimate interest (art. 6.1.f). Period: 25 months.
• Site security and fraud prevention (connection logs) — Basis: legitimate interest (art. 6.1.f). Period: 1 year (art. 6 II of the LCEN for connection logs).

Where processing relies on legitimate interest (art. 6.1.f), our interest is to measure audience in aggregate, secure the Site and, where relevant, inform our customers of similar products. This interest has been balanced against your rights and freedoms; you have a right to object (see §7).

Your data is only accessible to authorized staff of FGRibreau SARL and to our processors, acting on our documented instructions under a processing agreement compliant with Article 28 GDPR:

• Stripe Payments Europe, Ltd. (Ireland, European Union) — Card payment processing. An onward transfer to Stripe, Inc. (United States) may occur (see §5).
• France Nuage SAS (Kubernetes cluster) — Site hosting: pages and application back-end (accounts, orders). France.
• Brevo (Sendinblue SAS, a French company headquartered in Paris) — Delivery of transactional emails and the newsletter. Servers located in the European Union.
• Matomo (self-hosted) — Audience measurement. France.

We neither sell nor rent your data to third parties. Your data may be disclosed to administrative or judicial authorities where the law requires it.

Our contracting payment provider, Stripe Payments Europe, Ltd., is established in Ireland, in the European Union. Accordingly, the processing of your payments takes place within the European Union.

This provider may nonetheless carry out an onward (intra-group) transfer of certain data to its US parent company, Stripe, Inc. This onward transfer is framed by:

• the EU–US Data Privacy Framework (DPF), subject to the European Commission adequacy decision of July 10, 2023 (Article 45 GDPR); and/or
• the Standard Contractual Clauses adopted by the European Commission on June 4, 2021 (Article 46.2.c GDPR), with supplementary measures where appropriate.

The other processors (France Nuage, Matomo, SMTP provider) host data within the EU. You may obtain a copy of the applicable safeguards by writing to fg@getnobullshit.com.

We implement appropriate technical and organizational measures to protect your data against destruction, loss, alteration or unauthorized access. Account passwords are stored as cryptographic hashes (argon2 algorithm) and never kept in clear text. Exchanges with the Site are encrypted (HTTPS).

In accordance with Articles 15 to 22 GDPR, you have the following rights over your data:

• Right of access (art. 15);
• Right to rectification (art. 16);
• Right to erasure (art. 17), subject to data we must keep under a legal obligation (notably accounting);
• Right to restriction (art. 18);
• Right to portability (art. 20);
• Right to object (art. 21) — see box below;
• Right not to be subject to automated decision-making (art. 22);
• Right to withdraw consent (art. 7.3) at any time, without affecting the lawfulness of prior processing.

RIGHT TO OBJECT — You may object at any time, on grounds relating to your particular situation, to processing of your data based on our legitimate interest (Article 6.1.f GDPR). Where your data is processed for commercial prospecting, you may object at any time without giving a reason.

How to exercise. To exercise your rights, write to fg@getnobullshit.com. We may ask for proof of identity if there is reasonable doubt. We respond within one month, extendable by two months for complex or numerous requests.

Complaint to the CNIL. If you believe, after contacting us, that your rights are not respected: CNIL — 3 Place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07 — www.cnil.fr/fr/plaintes.

The Site uses Matomo, an audience-measurement solution self-hosted in France, configured in cookieless mode (disableCookies): no tracking cookie is placed on your device for audience measurement. The “Do Not Track” signal (setDoNotTrack) sent by your browser is respected: if enabled, your browsing is not counted.

In this configuration, and in line with CNIL guidelines, this audience measurement is exempt from consent and relies on our legitimate interest (art. 6.1.f GDPR). No cookie banner is therefore required. See our cookie policy for details.

No non-essential cookie is placed: no advertising pixel, no tracking third-party widget, no tracking CDN. Only a strictly necessary session cookie (nbtl_session) is used while you are logged in to your account; it is exempt from consent (art. 82(2)).

We may amend this policy to reflect changes to the Site or regulations. The applicable version is the one published on the Site, identified by its last-updated date shown at the top of the document.

For any question about this policy or the processing of your data:

FGRibreau SARL — 3 rue de l’Aubépine, 85110 Chantonnay, France
Email: fg@getnobullshit.com