This English version is provided for convenience. The French version is the legally binding one.
← back to home01 Who is responsible?
JERWIS CONSEIL (SAS, Avignon Trade Register 991 155 136), represented by Jérémy Sagnier, is the data controller for your personal data collected on jerwis.fr and its subdomains.
Contact: jeremy.sagnier@jerwis.fr — I reply personally within 7 business days max.
No DPO appointed (not required for a structure this size), but the contact above handles all GDPR requests.
02 Data collected & purposes
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email + first name (newsletter) | Send you the weekly Jerwis email | Consent (art. 6.1.a GDPR) | As long as you're subscribed + 3 years after unsubscribing, for legal proof |
| Email + name + billing address | Issue the invoice following a purchase (genpics, other products) | Contract (art. 6.1.b) + legal accounting obligation (art. 6.1.c) | 10 years (French accounting obligation) |
| GitHub handle | Invite the buyer to the private repo of the purchased source code | Contract (art. 6.1.b) | As long as access is active. You can request revocation at any time. |
| IP, user-agent, Vercel logs | Technical security (rate-limit, anti-fraud, debug) | Legitimate interest (art. 6.1.f) | 30 days |
| Meta Pixel cookies (_fbp, _fbc) | Measure the effectiveness of Facebook/Instagram ads | Consent (cookie banner) | 90 days max (Meta's retention) |
03 Sub-processors & service providers
We handle almost nothing in-house. Here are the third-party tools that see your data pass through, with their exact role:
- Vercel Inc. (US, hosting) — serves the site's pages. Server logs 30 days. SCCs in place.
- Supabase Inc. (US, Frankfurt eu-west-1 infrastructure) — database (newsletter subscribers, newsletter submissions). GDPR-compliant, DPA signed.
- Resend Inc. (US) — sends the newsletter emails. Stores the emails and open/click statistics. Privacy policy.
- Stripe Inc. (US/IE) — card payment processing. Stripe is an independent data controller for payment data. Privacy.
- Anthropic PBC (US) — Claude API used to write the newsletter from the sources I select. Never receives your personal data, only the editorial content.
- GitHub Inc. (US, Microsoft) — hosts the private repos delivered after purchase. Receives your GitHub handle only.
- Meta Platforms Inc. (US/IE) — Meta Pixel + Conversions API to measure the effectiveness of Facebook/Instagram ads. Receives your hashed email (SHA-256) if you buy, for server-side matching.
- Vercel Blob (US, Vercel infrastructure) — hosts the ZIP files delivered after purchase. Private, signed, expiring access.
All transfers to the United States are governed by the European Commission's Standard Contractual Clauses (decision 2021/914). No transfers to countries without a legal framework.
04 Cookies & trackers
Three categories of cookies on jerwis.fr:
- Strictly necessary (no consent required): Vercel technical session, form anti-CSRF. Duration: session.
- Audience measurement (no consent required, CNIL exemption): none for now — no Google Analytics or equivalent.
- Marketing / advertising (consent required): Meta Pixel (_fbp, _fbc) — triggered only after you accept the cookie banner. Duration 90 days.
You can withdraw your consent at any time via the banner ("Manage my cookies" link at the bottom of the page).
05 Your GDPR rights
At any time, with a simple email to jeremy.sagnier@jerwis.fr, you have the right to:
- Access all of the data about you that I hold
- Rectify inaccurate data
- Erase your data (except data subject to a legal retention obligation, such as invoices)
- Restrict or object to the processing
- Retrieve your data in a structured format (portability)
- Withdraw your consent at any time (e.g. unsubscribe from the newsletter in 1 click via the link at the bottom of every email)
I reply personally to any request within 7 business days max. If I don't reply, or if you feel the answer is insufficient, you can lodge a complaint with the CNIL (the French data protection authority).
06 Permanent deletion
Newsletter unsubscribe: click the "Unsubscribe" link at the bottom of any email. Takes effect immediately.
Full account deletion: send an email to jeremy.sagnier@jerwis.fr with "GDPR deletion" in the subject line. I delete everything within 7 days, except invoices (mandatory 10-year retention, but anonymized of any non-tax data).
See also the page dedicated to deleting data collected via Meta.
07 Minors
The site is not intended for minors under 16. No data is knowingly collected from minors. If you believe a minor has provided data by mistake, contact me for immediate deletion.
08 Changes
This policy may change (new provider, new product, new legal obligation). Significant changes are notified by email to newsletter subscribers. Date of the last update: May 12, 2026.