YnelysOur commitment
Protecting your privacy sits at the heart of what we build. At Ynelys, we treat personal data as something held in trust, not as an asset. We collect the minimum we need, for clearly stated purposes, and we give you real control over what we do with it.
Data controller
Until the company Ynelys SASU is registered with the French commercial register, the data controller within the meaning of Article 4.7 of the GDPR is:
- Yann Rozelot, operating the website under the trading name "Ynelys"
- 28 impasse des Frênes, 74800 Saint-Sixt, France
- Email: hello@ynelys.com
- Phone: +33 6 75 13 68 75
Once registration is effective, the data controller will become Ynelys SASU. This page will be updated accordingly.
Data Protection Officer (DPO)
Ynelys is not required to appoint a Data Protection Officer under Article 37 of the GDPR: it is neither a public authority, nor an entity performing large-scale processing, nor an entity processing sensitive data as a core activity. For any question regarding the protection of your data, please write to hello@ynelys.com.
What data we collect
When you join the waitlist
- Your email address (required)
- Your first name (optional, used to personalise our messages)
When you contact us
- Name, email, subject and content of your message
- Any attachments you choose to send
When you browse the site
- Minimal technical data (browser type, pages visited, session duration), collected in aggregated and anonymised form
- No advertising trackers, no profiling, no third-party resellers
Local storage on your device
The site saves two display preferences (ynelys.theme, ynelys.lang) in your browser; they are never sent to our servers. Details in our cookie policy.
Why we collect it
- Managing the waitlist and notifying you of the launch (legal basis: consent)
- Responding to inquiries (legal basis: pre-contractual measures)
- Improving the service through aggregated statistics (legal basis: legitimate interest)
- Meeting legal obligations (accounting, tax, where applicable)
How long we keep it
Forms are saved in durable Cloudflare storage before acknowledgement. Email notifications are retried after temporary failures. Your raw IP address is not stored with your request; a short-lived identifier derived from it limits attempts. Form archives are automatically removed at expiry. Correspondence copies and removal requests are handled by the operator at hello@ynelys.com.
- Waitlist: until you request removal, and no longer than 3 years after submission
- Contact messages: up to 3 years after each form submission
- Anonymised statistics: 25 months maximum
Who we share it with
We never sell, rent or trade personal data. We rely on the following technical processors, each bound to Ynelys by a data processing agreement compliant with Article 28 GDPR:
- Cloudflare, Inc. (Delaware, United States) — static hosting, CDN, application firewall, and Cloudflare Workers (active processing of form submissions: waitlist, contact). Workers run on the global Cloudflare edge network, which means form data may transit through any Cloudflare point of presence before reaching Resend for email delivery. EU entity: Cloudflare Germany GmbH (Munich, Germany).
- Cloudflare Web Analytics — visit and performance measurement, described in the cookie policy.
- Cloudflare Turnstile (part of Cloudflare) — cookieless anti-bot verification (invisible challenge).
- Resend (Resend Inc., United States) — transactional email delivery (notifications of signups and contact messages to Ynelys).
Typefaces (Manrope, Instrument Serif) are self-hosted on ynelys.com: no third-party CDN request, no data sent to Google Fonts.
Transfers outside the European Union
Cloudflare and Resend are US-incorporated companies and may process your data outside the EU. These transfers are covered by the EU Commission Standard Contractual Clauses (implementing decision 2021/914) and, where applicable, by the EU-US Data Privacy Framework (decision 2023/1795) when the processor is certified under it. No data is transferred outside the EU without a legal safeguard equivalent to the GDPR.
Your rights
Under the GDPR, you can at any time:
- Access all your personal data
- Correct any inaccurate information
- Delete your data ("right to be forgotten")
- Restrict processing
- Port your data in a readable format
- Object to processing on legitimate grounds
- Withdraw consent at any time
Security
We apply appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure or destruction: encryption in transit (HTTPS/TLS), encryption at rest, access control, logging, regular backups.
Cookies
See our cookie policy.
Changes
We may update this policy. Any substantial change will be notified by email to waitlist members at least 15 days before it takes effect.