Privacy and personal data

Data controller

The controller for the processing described on this page is:

• Benjamin CHOLLET, Entrepreneur individuel (EI)
• SIREN: 105 882 054
• Paris, France

For any question about your data, or to exercise your rights:

contact@naniplayer.com

Data processed when you sign up for the beta

Only your email is required. You can also share your country, household size, devices and free-text feedback. These optional answers help us prepare the beta.

• your email address, normalised (trimmed and lowercased);
• your country, if supplied, or the country code provided by the host;
• the date and time of the signup (UTC timestamp);
• a stable internal identifier used as the technical key of your signup;
• the date and time your address was confirmed; until you click the confirmation link this stays empty and your signup is not confirmed;
• two random tokens, unrelated to your identity: one validates your signup, the other unsubscribes you in one click from any email;
• the date and time the confirmation email was last sent.
• optional household and device answers, free-text feedback and a random receipt that allows one feedback submission within 24 hours;

The form includes a hidden field used to detect automated submissions. Its value is never stored.

What is not collected

When you visit the site or sign up, Nani neither collects nor keeps, in its own application files and logs:

• any IP address in the clear;
• any UTM parameter, browser language, locale or User-Agent;
• any cookie, tracker or tracking pixel; the cookieless audience measurement described below is the only exception;
• any persistent identifier that would let us follow you from one visit to the next;
• any profiling, or fully automated decision producing legal effects concerning you.

Form security and abuse prevention

Your IP address is never recorded in our files, nor written to our logs.

To prevent automated form submissions, it is hashed on the fly using a random salt specific to the server process. That identifier stays in memory only, is never written to disk or sent to a third party, changes on every server restart, and is automatically deleted 15 minutes after its last use.

The website’s hosting provider technically processes your IP address to route your request and may keep it briefly in its own logs, under its own responsibility and retention policy. Nani does not use those logs to identify or track visitors.

On most hosting platforms the country code is supplied directly by a technical header and no further data is processed. When that information is unavailable and the corresponding option is enabled, your IP address may be sent once to the ipapi.co service for the sole purpose of deriving the country code; it is then neither stored nor logged by Nani.

For a given address, a confirmation email is sent at most once every fifteen minutes: the form cannot be used to flood someone else’s mailbox.

Purposes and legal bases

Your data is processed for the following purposes, and for no other:

• managing your signup to the Nani beta, on the legal basis of steps taken at your request prior to entering into a contract under GDPR art. 6(1)(b), since signing up is a step you take yourself in order to access the service;
• checking that the address entered is really yours: a confirmation email is sent and only a confirmed address counts as signed up (double opt-in), on the legal basis of those same pre-contractual steps and of our legitimate interest in not writing to someone who asked for nothing;
• telling you when the beta opens or becomes available and sending you the information needed to access it, on the legal basis of those same pre-contractual steps, as these messages answer the request you made;
• producing aggregated geographical statistics from the country code alone, on the legal basis of our legitimate interest in knowing where the people interested in Nani are;
• keeping the form secure and preventing automated submissions and duplicate signups, on the legal basis of our legitimate interest in protecting the service against abuse.
• preparing the beta using your optional answers, based on your consent; these answers are deleted along with your signup, including when you unsubscribe;

Recipients

Your data is processed by Benjamin Chollet, the publisher of Nani.

Signups are recorded in a PostgreSQL database provided by Supabase, hosted in a region inside the European Union: Supabase Pte. Ltd acts here as a processor within the meaning of article 28 GDPR, for the sole purpose of holding that data. The site is hosted by Vercel Inc., which processes the data solely for the technical hosting and delivery of the site, and for the audience measurement described below.

The confirmation email, and the emails you receive later about the beta, are delivered by Resend (Resend, Inc.), a transactional email provider acting as a processor within the meaning of article 28 GDPR. It receives your email address and the content of the message for the sole purpose of delivering it. Resend, Inc. is established in the United States: sending those emails therefore transfers your address outside the European Union.

No other recipient is planned. Your data is not sold, rented or passed on to commercial partners.

Your signup data is stored in the European Union. The Supabase group is nevertheless established outside the European Union, in Singapore and in the United States: the technical administration of the database may involve access to your data from those countries. Those transfers are covered by the European Commission’s standard contractual clauses, incorporated into Supabase Pte. Ltd’s data processing agreement.

Hosting of the site by Vercel Inc., a company established in the United States, may likewise involve processing of technical data outside the European Union. You can write to the address above with any question about those transfers.

Retention periods

Each category of data is kept only as long as its purpose requires:

• signup data (email address, country, timestamp, internal identifier): kept for the duration of the Nani beta phase, then deleted once it is no longer necessary for that purpose; you can ask for its deletion at any time;
• hashed abuse-prevention identifier: held in memory only, and automatically deleted 15 minutes after its last use.
• confirmation and unsubscribe tokens: kept for as long as your signup, of which they are the technical key;
• unconfirmed signup: the confirmation link stops working thirty days after it was last sent; the signup then has no effect and can be deleted at your request.

Should your address ever be used for another purpose, in particular marketing, you would be informed beforehand and the retention periods applicable to that processing would be respected.

Your rights

Under the General Data Protection Regulation, you have the following rights:

• right of access: obtain confirmation that your data is processed and receive a copy of it;
• right to rectification: have an inaccurate or incomplete email address corrected;
• right to erasure: ask for your signup to be deleted;
• right to restriction of processing, where the conditions set by the GDPR are met;
• right to object, where the processing relies on our legitimate interest;
• right to data portability: receive your data in a structured, commonly used format.

To exercise these rights, write to the address below, stating the email address concerned. We may ask for something that lets us check it is indeed yours. You will receive an answer within one month, extendable under the conditions set by the GDPR.

contact@naniplayer.com

Complaint to the CNIL

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at www.cnil.fr.

The emails you will receive

After you sign up, a confirmation email is sent to check that the address is really yours. Until you click the link it contains, your signup is not confirmed and you will receive no other message from us.

The address you provide is used to tell you when the beta opens and to send you the information needed to access it. Those messages relate directly to the request you made by signing up.

Signing up does not amount to agreeing to receive marketing, a newsletter or promotional offers. Should such communications ever exist, your consent would be collected separately beforehand, and you could withdraw it at any time.

Every email we send you carries an unsubscribe link. One click is enough: your signup is deleted immediately, with nothing to write and nothing to justify.

Cookies and audience measurement

The site sets no cookie at all, whether for audience measurement, advertising or tracking. Nothing is stored in your browser to follow you from one page or visit to the next, and no tracking pixel is used.

Audience measurement is disabled while we choose between Plausible and Umami. No analytics script is loaded.

Fonts are served from Nani's own domain: displaying them triggers no request to a third-party service.

Changes

This page may be updated to reflect a change in the service or in the processing described. The date of the last update appears at the top of the page.

Information about the publisher of the site is on the dedicated page. See the legal notice