Privacy policy
This policy explains how Penra processes personal data in connection with Globatics. We act in two distinct roles: controller for our customers’ data (your accounts), and processor for the data of visitors to the sites that use Globatics.
Translation provided for convenience: the French version is legally binding and prevails.Lire en français
Contents
Who is responsible?
- Controller
- Penra, publisher of Globatics
- Privacy contact
- privacy@globatics.live
- Customer accounts (section 2): Penra is the controller.
- Visitors of customers’ sites (section 3): the customer who installs Globatics on their site is the controller; Penra acts as a processor, only on their instructions, under the data processing agreement.
We have not appointed a data protection officer (not mandatory for our activity): write to the address above with any question.
Our customers’ data
These activities concern people who create an account, subscribe, write to us or join the waitlist. Fields marked as required in forms are needed to provide the service.
Account
- Data
- E-mail address, name, password hash (scrypt, never the password), creation date, accepted terms version and acceptance time, preferences (theme, notifications).
- Purpose
- Create and manage your account, provide the service, send you service messages.
- Legal basis
- Performance of the contract (GDPR art. 6.1.b).
- Retention
- Until the account is deleted (immediately and permanently), then at most 30 days in technical backups.
Sign-in sessions and two-factor authentication
- Data
- Session token (stored hashed), sign-in and activity times, browser and OS, truncated IP network (IPv4 /24, IPv6 /48), country; encrypted two-factor secret and hashed recovery codes if you enable it.
- Purpose
- Keep you signed in, list your signed-in devices, secure access.
- Legal basis
- Performance of the contract (GDPR art. 6.1.b).
- Retention
- Session: 14 days of inactivity, 30 days at most after sign-in, or until you sign out; two-factor step: 5 minutes; secret and codes until you turn it off.
Sign-in with Google
- Data
- Google account identifier, verified e-mail address, name.
- Purpose
- Let you sign up and sign in with Google, at your request.
- Legal basis
- Performance of the contract (GDPR art. 6.1.b).
- Retention
- Until you disconnect Google or delete your account.
Security log
- Data
- Event type (successful or failed sign-in, password change, two-factor, API keys), time, truncated IP network (IPv4 /24, IPv6 /48: never the full address), browser and OS, country.
- Purpose
- Detect and block account takeovers, show you your account activity.
- Legal basis
- Legitimate interest (GDPR art. 6.1.f): the security of the service and of your account.
- Retention
- 90 days.
Abuse protection
- Data
- Attempt counters and lockouts, keyed by an HMAC of the e-mail address or the network (never the e-mail or the IP address in clear); at sign-up and on password change, the first 5 characters of the new password’s SHA-1 hash are sent to Have I Been Pwned to reject passwords already leaked (never the password or your e-mail).
- Purpose
- Prevent account takeover, brute-force attacks and automated sign-ups.
- Legal basis
- Legitimate interest (GDPR art. 6.1.f): the security of the service and of accounts.
- Retention
- Counters: the length of their window, lockouts forgotten 24 hours after the last failure; nothing is kept for the password check.
Site logos
- Data
- Domain names of your sites and of the sites referring your traffic, and the logo found. The logo is looked up on the site itself, then, failing that, from DuckDuckGo’s and Google’s icon services, which only receive the domain name.
- Purpose
- Show the logo of each site and traffic source in the dashboard.
- Legal basis
- Legitimate interest (GDPR art. 6.1.f): making reports readable.
- Retention
- 14-day cache (1 day when there is no logo), erased at most 30 days after expiry.
Alerts and webhooks
- Data
- Alert rules, destination (webhook) URLs you configure, content and status of each delivery.
- Purpose
- Notify you according to your rules and show you the delivery history.
- Legal basis
- Performance of the contract (GDPR art. 6.1.b).
- Retention
- Rules: until you delete them; delivery log: 30 days.
Subscription and billing
- Data
- Plan, subscription status and period, customer id at Polar, country, invoice references (once paid plans open). Card details are processed by Polar and never reach us.
- Purpose
- Manage your subscription and access rights, keep our accounts.
- Legal basis
- Performance of the contract; legal obligation (GDPR art. 6.1.c) for accounting records.
- Retention
- Subscription term, then 10 years for accounting records (French Commercial Code L. 123-22).
Free trial
- Data
- An irreversible keyed hash of your e-mail address (HMAC-SHA256 with a secret key, computed on the normalised address: lowercase and, for Gmail, without dots or “+tag”), and the dates of the first and the last trial request. Never the address itself.
- Purpose
- Grant the free trial once per e-mail address and prevent its abuse (accounts re-created to chain trials): an account whose address already had a trial starts on the Free plan.
- Legal basis
- Legitimate interest (GDPR art. 6.1.f): preventing abuse of the free trial.
- Retention
- 24 months after the last trial request for this address, including after the account is deleted, then erased automatically.
Support and correspondence
- Data
- Your messages, our replies, the e-mail address used.
- Purpose
- Answer your requests and complaints.
- Legal basis
- Legitimate interest (GDPR art. 6.1.f): answering people who contact us.
- Retention
- 3 years after the last exchange.
Waitlist
- Data
- E-mail address, sign-up page, date. Never the IP address.
- Purpose
- Tell you once when paid plans are published.
- Legal basis
- Consent (GDPR art. 6.1.a), which you can withdraw at any time.
- Retention
- Until that message, your unsubscription, or 3 years at most.
“Ask Globatics” AI assistant
- Data
- Your question and aggregated statistics of your site (counts, pages, sources). Never IP addresses, visitor ids or individual records.
- Purpose
- Answer your question when the assistant is enabled (Claude, by Anthropic).
- Legal basis
- Performance of the contract (GDPR art. 6.1.b).
- Retention
- Not kept by Globatics beyond the answer; Anthropic does not train its models on this content.
Browsing globatics.live
- Data
- IP address and request headers, processed by the host to serve pages. No advertising or analytics cookies (see Cookies).
- Purpose
- Serve the site, prevent abuse.
- Legal basis
- Legitimate interest (GDPR art. 6.1.f): running a safe and available website.
- Retention
- Short-lived technical logs at the host; never linked to your account or to analytics.
Data about visitors of our customers’ sites
When you visit a site that uses Globatics, its publisher (our customer) is the controller and decides on audience measurement; we process the data on their behalf. By default:
- no cookie is set and nothing is written to your browser;
- your IP address is only used, in memory, to derive a city-level location and a daily identifier; it is never stored;
- the visitor id is a truncated hash (
sha256) of a random salt that changes every day, the site id, the IP address and the browser: it cannot follow you from one day to the next, or from one site to another; - stored: pageviews (without URL parameters other than UTM), referring site, campaign, country, region and city, browser, OS and device type, language, engagement, events sent by the site, performance and technical errors;
- retention: 760 days (about 25 months) by default, set by the customer between 30 days and 10 years, then deleted automatically;
- browsers that send the Global Privacy Control signal are never followed across days.
The customer can turn on options that change this: data-persist (a random id in your browser’s local storage) and identify() (their own user id). They must then collect your consent. Every field is listed in Data fields and privacy.
Exercising your rights as a visitor
Contact the publisher of the site you visited first: they decide. If you write to us, we forward your request to our customer and help them answer it. With no cookie and no stored IP address, we usually cannot find your past visits.
Recipients and sub-processors
Your data is only accessible to authorized people at Penra, and to our providers within the limits of their task. We never sell or rent data and do no targeted advertising. Authorities can obtain it on a lawful request.
- Vercel — Application hosting, server functions, content delivery network (CDN).
- Supabase (Amazon Web Services) — Managed PostgreSQL database: accounts, configuration and statistics.
- Polar — Subscription payments as reseller (Merchant of Record): checkout, invoicing, VAT. Only if you subscribe to a paid plan.
- Google — Sign-in with Google (“Continue with Google”). Only if you use sign-in with Google.
- Anthropic — “Ask Globatics” analysis assistant powered by Claude. Only when the AI assistant is enabled and you ask it a question.
Our servers also query, without sending them personal data: Have I Been Pwned, DuckDuckGo, Google (favicons). Details are on the sub-processors page.
Full list, locations and safeguards: sub-processors.
Transfers outside the European Union
The database is hosted in the European Union (Ireland) and server functions run in Dublin. Some providers are established outside the Union (United States, Singapore) and may access or process some data there. These transfers rely on the European Commission’s standard contractual clauses (Decision 2021/914) and, for certified US companies (Vercel, Google), on the 10 July 2023 adequacy decision on the EU-U.S. Data Privacy Framework. A copy of these safeguards is available from privacy@globatics.live.
Your rights
Under the GDPR and the French Data Protection Act, you have the following rights:
- access to your data and a copy of it (art. 15);
- rectification of inaccurate data (art. 16);
- erasure (art. 17);
- restriction of processing (art. 18);
- portability, in a structured, machine-readable format (art. 20);
- objection, on grounds relating to your particular situation, to processing based on legitimate interest (art. 21);
- withdrawal of your consent at any time, without affecting earlier processing;
- setting instructions for what happens to your data after your death (art. 85 of French law no. 78-17 of 6 January 1978).
No decision with legal effects on you is based solely on automated processing.
How to exercise them
- In the app: Settings → Export → “Export my data” downloads all your account data (JSON); the Account page lets you correct your profile, disconnect Google and permanently delete your account and all its data, except the free-trial hash (section 2), kept 24 months.
- By e-mail: privacy@globatics.live.
We answer within one month, which may be extended by two months for complex requests (GDPR art. 12.3), in which case we tell you. If we have reasonable doubts about your identity, we may ask for additional information.
Complaints to the CNIL
If you believe your rights are not respected, you can lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr/fr/plaintes, or with the supervisory authority of your country of residence in the European Union.
Security
- Encryption in transit (HTTPS, HSTS) and at rest (database and backups).
- Passwords hashed with scrypt; session tokens and API keys stored as SHA-256 hashes.
- Two-factor authentication, rate limits and progressive lockouts, security log.
- Least-privilege database role, row-level security, schema not exposed.
- Access to production data limited to authorized people only.
If a personal data breach creates a risk, we notify the CNIL within 72 hours and, if the risk is high, the people concerned (GDPR art. 33 and 34). To report a vulnerability: security@globatics.live.
Minors
Globatics is a service for professionals and adults. We do not knowingly collect data about children under 15; if you believe we have, write to us and we will delete it.
Changes
Each version has a number and a date. We tell account holders by e-mail or in the app before any significant change. Previous versions are available on request.