Privacy Policy

Association FreshPerf, with registered office at 398 Avenue Lucien Cohen, 13430 Eyguières, France, is the controller for the processing described in this policy.

• Data protection contact: [email protected]

This policy covers freshperf.fr, the client area and the related hosting services. It does not cover the data you choose to process on your own servers: there, you are the controller and we act as a processor (see section 9).

Account and identification data

Email address, first and last name, phone number, postal address, and for a business customer the company name and EU VAT number. Passwords are never stored in clear text: only a cryptographic hash is kept. If you enable two-factor authentication, the corresponding secret is stored encrypted.

If you sign in with GitHub, Google or Discord, we receive your technical identifier and email address from that service, solely to create or link your account. We receive neither your password nor your contacts.

Order and billing data

Orders, subscribed services, invoices, credit notes, payments, account balance movements and promotional code usage. When you save a payment method, we keep only a token reference provided by our payment provider, the brand, the last four digits and the expiry date. Your full card number never transits through, and is never stored on, our servers.

Service-related technical data

Instance identifiers, assigned IP addresses, hostnames, subdomains, the public SSH keys you upload, console sessions and administration operation logs (start, stop, backup, reinstall).

Support data

Ticket content, the attachments you send and the history of your exchanges with our teams.

Security and connection data

Connection IP addresses, user agent, dates and outcomes of authentication attempts, active sessions, audit logs of sensitive actions, and infrastructure technical logs.

Communication data

A log of transactional emails sent and their delivery status, client-area notifications, and your communication preferences.

Referral programme data

Referral code, the link between referrer and referee, commissions and, when you request a cash withdrawal, the payout details you provide (IBAN or PayPal email address). These details are used to execute the transfer and retained under accounting obligations.

We do not sell or rent your personal data. We do not share it with data brokers or advertising networks, and we carry out no solely automated decision-making producing legal effects concerning you.

We do not inspect the content of your servers or of your databases. Technical access only occurs in the limited cases described in section 5 of the Terms of Service: necessity for delivering the service, your own request as part of support, a request from an authority, or a security incident.

Our administrative teams may temporarily access your client area for support purposes, in a traceable way. Every such access is logged.

Your data is accessible to authorised members of our teams, within the limits of their duties. It may be disclosed to the following categories of recipients:

The sign-up, sign-in, password reset and contact forms, as well as the offer recommendation assistant, are protected by Cloudflare Turnstile. The check runs in invisible mode: no checkbox and no image puzzle is shown to you, and the verification happens in the background as you use the form. On that occasion Cloudflare processes technical signals (IP address, TLS fingerprint, User-Agent header, site key and originating domain) for the sole purpose of telling a visitor apart from a bot, with no profiling and no advertising targeting. That processing is described in Cloudflare's Turnstile Privacy Addendum, which supplements Cloudflare's privacy policy.

Data hosting, document storage (invoices, attachments) and technical monitoring are carried out on our own infrastructure, without relying on a third-party cloud provider.

Your data is hosted and processed within the European Union. Some of our processors - in particular the payment provider, Cloudflare and, if you use it, the third-party authentication provider - belong to international groups that may carry out processing outside the European Union. Such transfers are framed by the European Commission's standard contractual clauses or by an adequacy decision, with supplementary measures where necessary. A copy of the applicable safeguards can be obtained at [email protected].

Once these periods expire, data is deleted or anonymised. Some data may be kept longer, with restricted access, where necessary for the establishment, exercise or defence of legal claims, or to comply with a legal obligation.

We implement appropriate technical and organisational measures: encryption of data in transit, encryption of sensitive secrets at rest, cryptographic hashes for passwords, two-factor authentication available on every account, environment segregation, access control and logging of administration actions.

As no system is infallible, it is also up to you to protect your credentials, enable two-factor authentication and secure the systems you deploy. In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you as provided for by the GDPR.

When you run a server - a game server in particular - and process data about your players or users on it (nicknames, IP addresses, connection logs, messages), you are the controller for that processing. We then act only as a processor within the meaning of Article 28 GDPR, for the sole provision of the infrastructure.

It is your responsibility, in particular:

• to have a legal basis for that processing;
• to inform your users and answer their requests to exercise rights;
• to define your own retention periods and your own application-level security measures;
• to obtain, where relevant, the consent of minors on the terms provided by applicable law.

A data processing agreement compliant with Article 28 GDPR is available on request at [email protected].

Under the General Data Protection Regulation and the French Data Protection Act, you have the following rights:

• Access: obtain confirmation that your data is processed and receive a copy of it.
• Rectification: correct inaccurate or incomplete data - most of it can be edited directly from your client area.
• Erasure: request deletion of your data, subject to our legal retention obligations.
• Restriction: request the temporary freezing of a contested processing operation.
• Objection: object to processing based on our legitimate interest, on grounds relating to your particular situation.
• Portability: receive, in a structured format, the data you provided to us.
• Withdrawal of consent: at any time, for processing that depends on it, without affecting the lawfulness of prior processing.
• Post-mortem directives: define directives on what happens to your data after your death.

These rights can be exercised at [email protected]. We may ask for proof of identity in case of reasonable doubt. We respond within one month, extendable by two months for complex requests.

If you consider that your rights are not respected, you may lodge a complaint with the French data protection authority, cnil.fr.

Our use of cookies and local storage technologies is described in our Cookie Policy. You can change your choices at any time from the cookie management button at the bottom of every page.

With your agreement, we measure site usage with PostHog (PostHog Cloud EU, hosted in Frankfurt): pages viewed, customer-journey steps (cart, checkout, sign-up, email verification, payment, renewal, refund, support requests), the channel a visit came from (a normalised category — the referring site's address is never sent), rendering performance (Core Web Vitals) and the browser's technical identification string (user agent), the latter used solely to tell human visits apart from automated traffic. Measurements are attached to a pseudonymous identifier computed by our servers — never to your email or your order number — and are kept for at most 12 months. We enable no session recording, no advertising and no data resale there, and the content of your forms, tickets and messages is never sent. Your choice lasts six months, after which we ask again. The detail is in the cookie policy, section 3.

Our services are not intended for people under 15 and subscribing requires legal capacity. If you become aware that a minor has provided us with data without the authorisation of the holder of parental responsibility, report it to [email protected]: we will delete the account and the associated data.

We may update this policy to reflect legal or technical developments or changes in our processing. Any material change is notified to you by email or in your client area before it takes effect. The date of the last update is shown at the top of this page.