ACID CHERRY
ACID CHERRY · GDPR
Last updated: 26 September 2026
This privacy policy describes how ACID CHERRY collects, uses and protects your personal data when you browse acidcherry.com, use the contact form, subscribe to the newsletter or access the /os/ client space.
It is drawn up in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and French Law No. 78-17 of 6 January 1978 as amended (“Informatique et Libertés”).
ACID CHERRY acts as data controller within the meaning of Article 4 GDPR. No Data Protection Officer (DPO) has been appointed to date; any request relating to your data is handled by the data controller at the address above.
We only collect data that is necessary for the purposes set out in section 3. Depending on how you use the site, this may include:
Each processing operation relies on a legal basis under Article 6 GDPR:
| Purpose | Data concerned | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Responding to your contact request | Name, email, company, message | Legitimate interest in responding to incoming professional enquiries — Art. 6.1.f; consent to form submission — Art. 6.1.a |
| Client relationship management and service delivery (/os/ space, deliverables, billing) | Identity, email, account and project data | Performance of a contract — Art. 6.1.b |
| Payment processing and fraud prevention | Billing and transaction data | Performance of a contract — Art. 6.1.b; legal obligation (accounting) — Art. 6.1.c |
| Sending the newsletter | Email address | Explicit consent, collected via double opt-in — Art. 6.1.a |
| Audience measurement and site improvement (subject to consent) | Cookie identifiers, aggregated browsing data | Consent — Art. 6.1.a (with Consent Mode v2: measurement stays restricted until consent is given) |
| Site security, abuse prevention and record keeping | Technical logs, hashed IP | Legitimate interest in securing the service — Art. 6.1.f |
No automated profiling producing legal effects against you is carried out. Your data is never sold or rented to third parties.
Data is kept only for as long as strictly necessary for the purposes pursued, then deleted or anonymised:
| Data category | Retention period |
|---|---|
| Contact form messages (prospects) | 24 months from the last exchange |
| Newsletter subscription | Until you unsubscribe (or deletion after 3 years of inactivity) |
| /os/ client account and project data | Duration of the contractual relationship, then 3 years from the last contact for prospect data |
| Accounting records and invoices | 10 years (legal obligation — Article L. 123-22 of the French Commercial Code) |
| Technical and connection logs | 6 months (CNIL recommendations for connection data) |
| Cookies and trackers (see cookie policy) | 13 months maximum for audience measurement cookies; consent kept for 6 months |
The periods above are the reference framework adopted by ACID CHERRY; they are to be confirmed during the legal review of this document.
Your data is accessible only to authorised ACID CHERRY staff and to the following technical providers, each acting as a processor within the meaning of Article 28 GDPR and strictly limited to their mission:
| Category | Provider | Mission | Location |
|---|---|---|---|
| Hosting | Vercel Inc. | Site hosting and page delivery | United States (transfers safeguarded — see section 6) |
| Database and authentication | Supabase | Storage of /os/ client accounts and authentication | European Union / United States depending on the project region |
| Payment | Stripe | Payment for services, transaction management and fraud prevention | United States (transfers safeguarded — see section 6) |
| Transactional email | Email delivery provider [TO BE COMPLETED] | Contact form notifications, authentication emails and newsletter | Depending on the provider selected |
| Audience measurement | Google Analytics 4 (with Consent Mode v2), Plausible, Vercel Analytics | Traffic statistics, subject to your consent | United States / European Union depending on the tool |
No other category of recipient (advertisers, data brokers, commercial partners) has access to your data. Contact form data is sent by email to the ACID CHERRY team solely to answer your request.
Some of our providers (Vercel, Stripe, Supabase, Google) are established in the United States. These transfers are governed by the Standard Contractual Clauses approved by the European Commission (Article 46 GDPR), supplemented where applicable by the EU–US Data Privacy Framework (DPF) where the provider is certified under it, together with technical safeguards (encryption, data minimisation).
The site uses cookies that are strictly necessary for its operation (language preference, client space access) and, subject to your prior consent, audience measurement and marketing cookies. Audience measurement tools (Google Analytics 4) are configured with Google Consent Mode v2: until you give your consent, measurement stays restricted and no non-essential tracker is set.
The detailed list of cookies, their purpose, their lifetime and how to manage your consent are set out in our cookie policy.
Under the GDPR (Articles 15 to 22) and the French Data Protection Act, you have the following rights:
To exercise these rights, write to contact@acidcherry.com with “Personal data” in the subject line. We reply within one month of receiving your request (extendable by two months for complex requests). Proof of identity may be requested where there is reasonable doubt.
If you believe, after contacting us, that your rights are not respected, you can lodge a complaint with the French Data Protection Authority (CNIL) — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — or at www.cnil.fr.
ACID CHERRY implements appropriate technical and organisational measures to protect your data: encrypted connections (HTTPS/TLS), hashed passwords, restricted access, regular backups and data minimisation.
This policy may change to reflect updates to our processing operations or to the law. The version in force is the one published on this page. Last updated: 26 September 2026.