Privacy

This policy explains what personal data Diffusion collects, why, how long it is kept and what your rights are. It applies to the website and to every account on it, and follows the EU General Data Protection Regulation (GDPR) and the French Loi Informatique et Libertés.

Who is responsible

The data controller is Jean Exemple, Entrepreneur individuel (EI), trading as Diffusion Creatives, 10 rue de l'Exemple, 75001 Paris, France, SIRET 000 000 000 00000. For any question about your data, write to legal@diffusion.example.

What we collect

• Account data: name, email address and profile picture, managed through our sign-in provider (Clerk), plus your role on the platform.
• Member profiles: bio, images, portfolio, credits and rates that members choose to publish.
• Projects and applications: the projects you open (brief, moodboard images, roles, dates, place, pay, the members you invite), the notes you send when applying, the decisions on them and the members you suggest.
• Team chat messages: the text messages exchanged in a project's team chat, with their time, whether you have read them, the reports you make and your email notification preference.
• Technical data: IP address, browser and request logs kept by our host for security, and the session cookies described below.
• Audience statistics: the pages visited, the referring site, the country, and the device and browser type, measured by Vercel Web Analytics without cookies. Visitors are counted through a hash of the request that is discarded after 24 hours, so you cannot be recognised across days or sites.

We do not collect payment data: any payment is agreed and made directly between members.

Why we use it and on what legal basis

• To create and run your account, publish profiles and projects, pass applications and contacts between the members of a project, and email you about the projects that concern you: performance of our contract with you (Art. 6(1)(b) GDPR).
• To review requests to join, curate the network, moderate projects and keep the platform secure: our legitimate interest in running a trusted, curated network (Art. 6(1)(f) GDPR).
• To measure the site's audience in aggregate and improve it: our legitimate interest (Art. 6(1)(f) GDPR).
• To answer requests from authorities and keep records the law requires: legal obligation (Art. 6(1)(c) GDPR).

We do not sell your data, use it for advertising or make automated decisions about you.

Who can see it

• Published profiles, portfolios and open projects are public and may be indexed by search engines.
• Invite-only projects are visible only to their owner, the members invited and the Diffusion team.
• When you apply to a project, its owner receives your note and your contacts (email, Instagram, profile) by email. When the owner accepts you, you receive theirs. Your email is never shown on the site.
• The Diffusion team can see projects and applications to moderate the platform.
• A project's team chat is visible only to its owner and the members accepted on it. The Diffusion team does not read team chats: it sees a message only when a participant reports it, or when the law requires it.

Service providers

We rely on processors bound by data processing agreements:

• Vercel Inc. (hosting, image storage, audience statistics), United States
• Neon Inc. (database), United States
• Clerk Inc. (accounts and sign-in), United States
• Resend (transactional email), United States

Where data is transferred outside the European Economic Area, it is protected by the EU–US Data Privacy Framework when the provider is certified, or by the European Commission's Standard Contractual Clauses.

How long we keep it

• Account and profile data: while your account is open, deleted within 30 days of its closure.
• Declined applications to join: 12 months after the decision.
• Projects and applications: 3 years after the last activity on the project, then deleted.
• Team chat messages: with their project, so 3 years after the last activity on it; deleted earlier with the project or with the sender's account. Reports are deleted once reviewed.
• Security logs: according to our host's retention, no longer than 12 months.

Cookies

We only use cookies that are strictly necessary for the site to work: the session cookies set by Clerk to keep you signed in and protect your account. They are exempt from consent under French and EU rules. Our audience statistics use no cookies and store nothing on your device. We do not use advertising or social media tracking cookies. If this changes, we will ask for your consent first.

Your rights

You can access, correct, delete or export your data, restrict or object to its processing, and give instructions on what should happen to it after your death. Write to legal@diffusion.example; we answer within one month. You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or the authority of the EU country where you live.

Security

Data is encrypted in transit, access is limited by role, and sign-in is handled by a dedicated provider. No system is perfectly secure; if a breach affects your data, we will notify you and the CNIL as the law requires.

Age

Diffusion is for professionals aged 18 or over. We do not knowingly collect data from minors.

Changes

We will update this page when our practices change and tell you by email of any significant change. See also our Terms and Legal notice.