CarnelyCarnely

Privacy policy

Who is the data controller?

ELVN, SAS with €100 share capital, 60 rue François Ier, 75008 Paris, France - SIREN 979 732 906.

For any question regarding your data: bonjour@carnely.com.

Eligibility

Carnely is intended for adults or for people aged 16 or over. If you are under 16, signing up requires the prior consent of a parent or legal guardian.

What data do we collect?

  • Email address (if you give it to us)
  • Answers to the 5 onboarding questions (if you answer them)
  • Anonymised technical signature (hashed IP, user agent, origin page)
  • Visit source (UTM parameters)

For what purposes?

  • To let you know when Carnely is available (based on your consent to the pre-launch list)
  • To gauge interest and improve what we offer

What is the legal basis?

  • Consent (pre-launch list signup)
  • Legitimate interest (anonymous audience analytics via Plausible)

How long do we keep your data?

  • If you left your email: until you unsubscribe
  • If you started the onboarding without giving an email: 90 days, then automatic deletion

Who do we share your data with?

  • Resend (email sending) - Germany, GDPR processor
  • Neon (storage) - Germany (Frankfurt), GDPR processor
  • Vercel (hosting) - United States, under SCC agreement

What are your rights?

  • Access, rectification, deletion, portability, objection
  • To exercise these rights: bonjour@carnely.com
  • You may also lodge a complaint with the CNIL (cnil.fr)

Cookies and trackers

  • Plausible Analytics: anonymous, cookieless, GDPR-compliant without consent.
  • Google Ads (gtag.js): one advertising measurement cookie (`_gcl_au`, `_gac_*`) set only after your explicit consent via the cookie banner. Used to measure the performance of our Google Ads campaigns. Without consent, no cookie is set and Google only receives anonymous signals (Consent Mode v2).
  • You can withdraw your consent at any time by removing the `carnely_consent_v1` entry from your browser's local storage, or by writing to bonjour@carnely.com.

Withdrawing consent

You can withdraw your consent at any time, without justification. Every email we send you includes an unsubscribe link. You can also write to bonjour@carnely.com to request deletion of your data.

Withdrawing your consent does not affect the lawfulness of processing carried out before that withdrawal.

Data security

  • Encrypted connections (TLS 1.2+) between your browser and our servers
  • Database encrypted at rest on Neon (Frankfurt region)
  • Access strictly limited to authorised ELVN staff
  • Regular backups, access logging, administrator passwords stored as hashes

No automated decision-making

We do not take any decision producing legal effects concerning you based on automated processing of your data, within the meaning of Article 22 of the GDPR. No profiling is carried out.