Privacy Policy
The French version of this document is the authoritative version. This English translation is provided for convenience only.
This document has been prepared with care but does not constitute legal advice — review by a qualified legal professional is recommended before going live.
1. Who we are
The service “Subtraq” is published by AGENCE GUDDELMONI, a French simplified joint-stock company (SASU) with share capital of €1,000, registered with the RCS Ajaccio under number 100 677 855, registered office at Cuparchiata, 20110 Viggianello, France.
Contact for data questions: [email protected].
This policy describes what data we process, why, with whom it flows, how long we keep it, and your rights under the GDPR and French data protection law.
2. Our two roles — an essential point
Subtraq processes personal data in two distinct contexts with two different legal qualifications under the GDPR.
2.1 Data controller — for your account data
For your account data (authentication email, interface preferences, billing data, API keys): AGENCE GUDDELMONI acts as data controller.
2.2 Data processor — for your clients’ campaign clicks
For the clicks, leads and sales collected on behalf of your agency for your clients’ campaigns: your agency acts as data controller towards your own visitors, and AGENCE GUDDELMONI acts as data processor under Article 28 of the GDPR.
As an agency using Subtraq, you are responsible for informing your own visitors about tracking and complying with the GDPR on their behalf. A data processing agreement (DPA) is available on request at [email protected].
3. Data we collect — category by category
3.1 Account data (Subtraq as controller)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address | OTP sign-in, service communications | Contract performance | Account lifetime |
| Language preference | Interface display | Legitimate interest | Account lifetime |
| Session token | Maintaining sign-in | Contract performance | Session duration |
| Billing data (via Stripe) | Payment, accounting | Legal obligation + contract | 10 years |
| API keys (hash only) | Machine access to the API | Contract performance | Until revoked |
3.2 Click data (Subtraq as processor for your agency)
On each click on a Subtraq link, we record:
| Data | Source | Retention |
|---|---|---|
| Link identifier | Resolved from the slug in the URL | 13 months |
| Timestamp | Server | 13 months |
| Country | Derived from IP address in memory only — IP is never written | 13 months |
| Device type | Derived from User-Agent (mobile / desktop / tablet) | 13 months |
| Referrer hostname | Extracted from HTTP Referer — full path never stored | 13 months |
| UTM parameters | Present in the link URL | 13 months |
| Bot flag | Derived from User-Agent and HTTP method | 13 months |
Statistical aggregates (daily totals by country, device, etc.) are retained indefinitely.
3.3 Data processed by the subtraq.js SDK
The SDK placed on the end client’s site stores only the click identifier (st_id) in the client’s domain localStorage (first-party storage, key: subtraq.click). No third-party cookies are used.
When a visitor becomes a lead or identified customer, your application code calls lead(email) or identify(userId). That data is your responsibility as data controller.
4. What we do not collect
We explicitly list what we have chosen not to collect. These are deliberate design decisions, not technical limitations.
- IP addresses are never stored. They are read in memory only to determine country and detect bots, then immediately discarded. No IP is ever written to the database.
- No device fingerprinting. We do not combine browser characteristics to create persistent identifiers. This is forbidden by the product design, not just discouraged.
- No cross-device tracking beyond what you explicitly identify via
identify(). - No third-party cookies. The SDK uses the client domain’s localStorage.
- The full referrer URL is never stored. Only the hostname is kept (e.g. instagram.com, not instagram.com/p/private-identifier…). The full path can contain personal data; we don’t take it.
5. Our processors
| Provider | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Server and database hosting | Germany (EU) |
| Cloudflare Inc. | Edge redirect network, DDoS protection, KV | Global (incl. outside EU) |
| Stripe | Payments and billing | EU / US (SCCs) |
| Resend | Transactional email delivery | European Union |
| OAuth authentication (if enabled) | See Google policy |
6. Transfers outside the EU
Cloudflare processes each HTTP request at the nearest point of presence, which may be outside the European Union. Data transmitted to Cloudflare is limited to what is present in the standard HTTP request (headers, link URL). The link directory replicated in Cloudflare KV contains no personally identifiable data (no email, no IP).
Stripe transfers billing data between the EU and the US under standard contractual clauses (SCCs) approved by the European Commission.
Google: if Google OAuth is enabled, authentication data flows to Google servers. See Google’s privacy policy for the applicable framework.
7. Your rights
For data for which AGENCE GUDDELMONI acts as data controller (your account data), you have the rights of access, rectification, erasure, restriction, objection and portability.
To exercise these rights: [email protected] — we respond within one month.
You can delete your account and all associated data yourself from your settings.
If you believe your rights are not being respected, you can contact the French data protection authority, CNIL (www.cnil.fr).
For click data (Subtraq as processor): rights are exercised with the agency data controller, not directly with Subtraq.
9. Bot policy
Every click is analysed on receipt. Bots are identified by their User-Agent (crawlers, headless browsers, SEO tools, monitoring tools, programmable HTTP clients) or by HTTP method (a HEAD request is never a real human click).
We never delete bot clicks. We record and label them (flag isBot = true). Dashboards show human clicks by default, with a toggle to show bots. The full list of detection rules is published in our documentation. No silent filtering. Bot clicks do not count towards the monthly quota.
10. Security
- All communications are encrypted in transit (HTTPS/TLS).
- Sessions are stored in httpOnly cookies, inaccessible from JavaScript.
- API keys are never stored in plain text — only their SHA-256 hash is kept.
- The database is dedicated, not publicly exposed, with encrypted daily backups.
- Server access is restricted by SSH with a dedicated key.
In the event of a data breach likely to result in a high risk to your rights, you would be notified as soon as possible, in accordance with Article 34 of the GDPR.
11. Changes
Any material change to this policy will be notified by email or in the application before it takes effect.