Privacy Policy

Filomy (filomy.com) — published by CMA Consulting Contact: bonjour@filomy.com For any question regarding the processing of your personal data, you can contact us at the address above.

Filomy collects the following personal data: — Email address: provided when creating an account or filling in an order form. Required to access the service. — First name: used to personalise the messages and e-cards that are sent. — Loved ones' birth dates: entered in the birthday reminders module, for the automatic sending of reminders and e-cards. — Content created by the user: texts (messages, descriptions), photos, audio messages, videos — uploaded to memory spaces, memory books, time capsules and surveys (questionnaire responses). — Phone number (optional): entered in the birthdays module to allow an SMS to be sent on the day. — Order data: name, email, delivery address, phone, type of product ordered — collected at the time of a purchase. — Print data (only for physical-product orders placed before these products were discontinued): first name, last name, delivery address, email, phone, and depending on the product: title, professional contact details, photo, logo, colours — transmitted to Gelato to fulfil those pre-existing orders. Filomy no longer sells new physical products via Gelato.

Each processing operation is based on a distinct legal basis: Account creation and management (basis: performance of the contract) Your email and first name are necessary to create your account, authenticate you and send you access links. Sending birthday reminders and e-cards (basis: performance of the contract) The recipient's birth dates and first name allow the automatic sending of reminders (D-7, D-1) and e-cards on the day. Sending an SMS on the day (basis: consent) If you provide a phone number in the birthdays module, you consent to a reminder SMS being sent on the day. This field is optional; you can delete it at any time from your space. Processing orders and payments (basis: performance of the contract) Your contact details and order data are necessary to prepare and send your order, as well as for invoicing. Manufacturing and shipping of physical products — pre-existing orders only (basis: performance of the contract) Filomy no longer sells new physical products. For orders placed before these products were discontinued, the profile data (name, title, contact details, photo, logo, colours) and the delivery address were transmitted to Gelato to produce the PDF file and ship them. This processing is strictly limited to fulfilling those pre-existing orders. Hosting of user content (basis: performance of the contract) The content you upload (photos, messages, audio) is hosted to allow invited people to view your memory spaces, memory books, capsules and surveys.

Filomy uses the following subprocessors, each of which is contractually bound to respect the confidentiality and security of your data: Supabase (database and file storage) AWS infrastructure — Europe region (Frankfurt, Germany) Data hosted within the European Union. Vercel (web application hosting) Head office in the United States. Transfer governed by Standard Contractual Clauses (SCCs) approved by the European Commission. Resend (sending of transactional emails) Head office in the United States. Transfer governed by Standard Contractual Clauses (SCCs) approved by the European Commission. Brevo SMS (sending of transactional SMS) Head office in France, hosting within the European Union. GDPR-compliant. Stripe (payment processing) Head office in the United States, European entity (Stripe Payments Europe, Ltd., Ireland). PCI-DSS Level 1 certified. No banking data is transmitted or stored by Filomy. Anthropic (AI-assisted writing) Head office in the United States. Used for writing-assistance features: message suggestions, photo captions, chapter structuring, profile analysis to pre-fill a business card. Only the texts explicitly entered in these fields are transmitted; no identifying personal data is sent without a deliberate action by the user. Transfer governed by Standard Contractual Clauses (SCCs) approved by the European Commission. Gelato AS (manufacturing and shipping of physical printed products — pre-existing orders only) Head office: Munkedamsveien 35, 0250 Oslo, Norway. Norway is a member of the European Economic Area (EEA) and applies a data protection framework equivalent to the GDPR; no additional transfer mechanism is required. Used only to fulfil physical-product orders placed before these products were discontinued; Filomy no longer sells new physical products via Gelato. Data transmitted when placing a print order: first name, last name, delivery address, email, phone, and the PDF file of the product ordered. This data is used exclusively for manufacturing and shipping and is not kept by Gelato beyond the processing of the order. Meta Platforms Ireland Ltd. (measuring the effectiveness of our advertising campaigns) Registered office in Ireland (European Union). Used only through the Conversions API (server-side) to measure conversions (purchases and account creations) resulting from our Meta/Instagram ads. Data sent: hashed email (SHA-256, non-reversible) and, for a purchase, the order amount, date and ID; for an account creation, the hashed email only. No data is sent from your browser (no pixel or advertising cookie), and no content or profile is shared. Legal basis: legitimate interest (measuring and improving our campaigns); you may object at any time (see article 6). Filomy does not use any other subprocessors to process your personal data.

Account data and user content: kept for the entire period during which the account is active. Prolonged inactivity (GDPR — CNIL recommendation): any account inactive for 3 years (no login) receives a warning email 2 months before automatic deletion. If no login occurs within that period, the account and all its data are automatically deleted. Deletion on request: the user can delete their account at any time from their dashboard (Profile tab) or by writing to bonjour@filomy.com. Deletion is immediate and permanent. Order data: when the account is deleted, the identifying data (name, email, address, phone) is anonymised. The order amount and date are kept for 10 years in accordance with accounting and tax obligations (Article L. 123-22 of the French Commercial Code).

In accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679), you have the following rights: — Right of access: obtain confirmation that your data is being processed and receive a copy of it. — Right to rectification: correct inaccurate or incomplete data. — Right to erasure: request the deletion of your data in the cases provided for by the GDPR. — Right to portability: receive your data in a structured, machine-readable format. — Right to object: object to processing based on legitimate interest. — Right to withdraw consent: withdraw at any time a consent previously given (e.g. phone field for SMS). To exercise these rights, send your request to bonjour@filomy.com, stating the email address associated with your account. We undertake to respond within one month. If the response is unsatisfactory, you may lodge a complaint with the CNIL (the French data protection authority) — cnil.fr.

Filomy only uses cookies that are strictly necessary for the service to function, benefiting from the CNIL consent exemption: sb-* cookie (Supabase): authentication cookie that keeps your session open. Without this cookie, you would be logged out on every page. NEXT_LOCALE cookie: remembers the display language you chose. Filomy does not use any advertising cookie or tracking pixel in your browser (no browser-side Meta Pixel or equivalent). To measure the effectiveness of our own Meta/Instagram campaigns, a limited conversion signal (purchase or account creation: hashed email, and for a purchase the amount and date) is sent to Meta server-side through its Conversions API — with no cookie and no browsing tracking (see subprocessors in article 4 and your right to object in article 6). Audience measurement: site traffic is measured with Vercel Web Analytics, a cookieless solution with no advertising identifier that does not track visitors across other sites. In line with the CNIL's recommendations on exempt audience-measurement solutions, this tool does not require consent.