Privacy policy

The data controller is Eco Pulse, a simplified joint-stock company with a single shareholder registered under number 105 648 158 R.C.S. Montpellier, whose registered office is at 667 Avenue du Docteur Jacques Fourcade, 34070 Montpellier, France.

Requests about personal data can be sent to contact@envynest.fr, with a reply within one month at most.

Depending on how the service is used, Envy may process the following data:

• account data, such as email address, technical identifiers and login information;
• profile and list data, such as wishes added, descriptions, links, images, approximate prices, sharing preferences and chosen language;
• guest-related data, such as gift bookings or information needed to coordinate a list;
• browsing data, such as pages viewed, usage events, truncated IP address or technical identifiers depending on the tools enabled;
• data exchanged with support, when the user contacts Envy.

The data needed to create an account, authenticate, create lists and book gifts is required to provide the service. Information freely added to lists, exchanges with support and non-essential trackers are optional. Declining non-essential trackers does not prevent access to the website.

Data is processed for the following purposes:

• creating and managing the account: performance of the contract or pre-contractual measures;
• creating, sharing and viewing wish lists: performance of the requested service;
• security, abuse prevention and maintenance of the service: legitimate interest;
• anonymous audience measurement, without cookies or identification, and service usage statistics counted by our servers: legitimate interest in understanding and improving the service, with a right to object described below;
• detailed audience measurement with PostHog, linked to the account and setting a cookie: user consent;
• chat support with Crisp, available on every page: performance of the service and legitimate interest in being able to answer users;
• affiliate tracking with Impact: user consent;
• compliance with applicable legal obligations.

Data may be shared with the providers strictly necessary to run the website and the app, within the limits of their tasks.

• Supabase, for authentication, the database and hosting some app data.
• PostHog, for audience measurement and product analytics: anonymously and without cookies by default, in detail and linked to the account after consent.
• Crisp, for chat support, available on every page.
• Impact, for affiliate tracking after consent.
• Vercel, for hosting the website and some app redirects.
• Hosting, security, maintenance and deployment providers of the website.

Data is kept for as long as needed for the purposes described above. Account and list data is kept while the account is active, then deleted or anonymized within a reasonable time after a deletion request, unless a legal obligation or need for proof applies. Audience measurement, support and affiliate data, and cookie choices, follow the periods given in the cookie policy.

Some providers may process data outside the European Union. When that is the case, Envy ensures appropriate safeguards are in place, in particular standard contractual clauses or any mechanism recognized by applicable regulations.

Audience measurement data is processed by PostHog on its European infrastructure. It goes through the subdomain io.envynest.fr, a technical relay pointing to PostHog: it reduces measurement loss caused by blockers, without changing the recipient of the data or the need for consent.

Under the GDPR and the French Data Protection Act, users may request access, rectification, erasure, restriction, objection to processing or portability of their data where these rights apply. They may also withdraw consent at any time for processing based on consent. Requests can be sent to contact@envynest.fr. A complaint may be filed with the CNIL, the French data protection authority, at cnil.fr.

Two processing operations rely on legitimate interest and can therefore be objected to directly in the interface, without writing to us: anonymous audience measurement, through the matching section of the privacy preferences panel, available from the footer; and usage statistics counted by our servers, through the same panel in the app once signed in. The objection takes effect immediately.

Envy implements reasonable technical and organizational measures to protect personal data against unauthorized access, loss, alteration or disclosure. No system can however guarantee absolute security.