Privacy and personal data

Data controller

The controller for the processing described on this page is:

• Benjamin CHOLLET, Entrepreneur individuel (EI)
• SIREN: 105 882 054
• Paris, France

For any question about your data, or to exercise your rights:

contact@naniplayer.com

Data processed when you sign up for the beta

The beta signup form asks for one thing only: your email address. From that submission, the following data is recorded:

• your email address, normalised (trimmed and lowercased);
• the two-letter country code matching your connection, used for statistics only;
• the date and time of the signup (UTC timestamp);
• a stable internal identifier used as the technical key of your signup.

The form includes a hidden field used to detect automated submissions. Its value is never stored.

What is not collected

When you visit the site or sign up, Nani neither collects nor keeps, in its own application files and logs:

• any IP address in the clear;
• any UTM parameter, referrer, source page, browser language, locale or User-Agent;
• any cookie, tracker, pixel or audience measurement tool;
• any persistent identifier that would let us follow you from one visit to the next;
• any profiling, or fully automated decision producing legal effects concerning you.

Form security and abuse prevention

Your IP address is never recorded in our files, nor written to our logs.

To prevent automated form submissions, it is hashed on the fly using a random salt specific to the server process. That identifier stays in memory only, is never written to disk or sent to a third party, changes on every server restart, and is automatically deleted 15 minutes after its last use.

The website’s hosting provider technically processes your IP address to route your request and may keep it briefly in its own logs, under its own responsibility and retention policy. Nani does not use those logs to identify or track visitors.

On most hosting platforms the country code is supplied directly by a technical header and no further data is processed. When that information is unavailable and the corresponding option is enabled, your IP address may be sent once to the ipapi.co service for the sole purpose of deriving the country code; it is then neither stored nor logged by Nani.

Purposes and legal bases

Your data is processed for the following purposes, and for no other:

• managing your signup to the Nani beta, on the legal basis of steps taken at your request prior to entering into a contract under GDPR art. 6(1)(b), since signing up is a step you take yourself in order to access the service;
• telling you when the beta opens or becomes available and sending you the information needed to access it, on the legal basis of those same pre-contractual steps, as these messages answer the request you made;
• producing aggregated geographical statistics from the country code alone, on the legal basis of our legitimate interest in knowing where the people interested in Nani are;
• keeping the form secure and preventing automated submissions and duplicate signups, on the legal basis of our legitimate interest in protecting the service against abuse.

Recipients

Your data is processed by Benjamin Chollet, the publisher of Nani.

Signups are recorded in a PostgreSQL database provided by Supabase, hosted in a region inside the European Union: Supabase Pte. Ltd acts here as a processor within the meaning of article 28 GDPR, for the sole purpose of holding that data. The site is hosted by Vercel Inc., which processes the data solely for the technical hosting and delivery of the site, and for the audience measurement described below.

No other recipient is planned. Your data is not sold, rented or passed on to commercial partners.

Your signup data is stored in the European Union. The Supabase group is nevertheless established outside the European Union, in Singapore and in the United States: the technical administration of the database may involve access to your data from those countries. Those transfers are covered by the European Commission’s standard contractual clauses, incorporated into Supabase Pte. Ltd’s data processing agreement.

Hosting of the site by Vercel Inc., a company established in the United States, may likewise involve processing of technical data outside the European Union. You can write to the address above with any question about those transfers.

Retention periods

Each category of data is kept only as long as its purpose requires:

• signup data (email address, country, timestamp, internal identifier): kept for the duration of the Nani beta phase, then deleted once it is no longer necessary for that purpose; you can ask for its deletion at any time;
• hashed abuse-prevention identifier: held in memory only, and automatically deleted 15 minutes after its last use.

Should your address ever be used for another purpose, in particular marketing, you would be informed beforehand and the retention periods applicable to that processing would be respected.

Your rights

Under the General Data Protection Regulation, you have the following rights:

• right of access: obtain confirmation that your data is processed and receive a copy of it;
• right to rectification: have an inaccurate or incomplete email address corrected;
• right to erasure: ask for your signup to be deleted;
• right to restriction of processing, where the conditions set by the GDPR are met;
• right to object, where the processing relies on our legitimate interest;
• right to data portability: receive your data in a structured, commonly used format.

To exercise these rights, write to the address below, stating the email address concerned. We may ask for something that lets us check it is indeed yours. You will receive an answer within one month, extendable under the conditions set by the GDPR.

contact@naniplayer.com

Complaint to the CNIL

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at www.cnil.fr.

The emails you will receive

The address you provide is used to tell you when the beta opens and to send you the information needed to access it. Those messages relate directly to the request you made by signing up.

Signing up does not amount to agreeing to receive marketing, a newsletter or promotional offers. Should such communications ever exist, your consent would be collected separately beforehand, and you could withdraw it at any time.

Cookies and audience measurement

The site sets no cookie at all, whether for audience measurement, advertising or tracking. Nothing is stored in your browser to follow you from one page or visit to the next, and no tracking pixel is used.

The site uses Vercel Web Analytics, the audience measurement tool provided by its host. For each page viewed it records the page address, the referring page, the country, the operating system, the browser and the device type. Your IP address is not kept: it is only used to compute a technical identifier, renewed every day, that avoids counting the same visitor twice within a single day. No cross-site tracking takes place.

The sole purpose of this measurement is to produce anonymous traffic statistics in order to improve the site, on the legal basis of our legitimate interest. Its scope is limited to this site alone; the data is neither sold, nor cross-referenced with other processing, nor passed on to third parties. It therefore falls under the consent exemption recognised by the CNIL, which is why there is no cookie banner.

Fonts are served from Nani's own domain: displaying them triggers no request to a third-party service.

Changes

This page may be updated to reflect a change in the service or in the processing described. The date of the last update appears at the top of the page.

Information about the publisher of the site is on the dedicated page. See the legal notice