Privacy Policy

1. Data controller

The data controller under the GDPR is Maxim Lyoen-Levecq, a sole trader who publishes Chatven. For any question about your personal data or to exercise your rights, you can write to us at privacy@chatven.fr.

2. Data collected

We collect strictly the minimum necessary for the operation of the Service:

• Account: email address and password. The password is hashed server-side (bcrypt via Supabase Auth) and is never stored in plain text or accessible by our teams.
• Business data: the listings you follow, your purchases, items, instances and sales — entered by you via the web application or the browser extension.
• Extension authentication: a local identifier (UUID v4) generated at first launch by the extension, stored in your browser's chrome.storage.local. This identifier does not allow tracking of your hardware or identifying you outside of Chatven (see section 8 on the absence of fingerprinting).
• Technical metadata: login dates, write timestamps, language and theme preference.
• Subscription and payment: subscribed plan, status, due dates and Stripe identifiers. Bank card data is entered and processed directly by Stripe; we never have access to it and do not store it.
• Third-party data: by following or importing listings, you may record seller data (name or pseudonym, rating, profile photo). You are responsible for it and undertake to comply with the applicable regulations.

3. Purposes of the processing

• Authenticate your account (web and extension).
• Allow you to track your listings and buy-and-resell operations.
• Manage your subscriptions and payments.
• Restore your data between your sessions and your devices.
• Ensure the security of the Service (abuse detection, error logs).

No processing is carried out for advertising, profiling or data resale purposes.

4. Legal basis

The processing of your data is based on the performance of the contract that you enter into by using the Service (article 6.1.b of the GDPR), on compliance with our legal obligations (billing, accounting — art. 6.1.c) and, for the technical logs necessary for security, on our legitimate interest (article 6.1.f).

5. Retention period

Your data is kept as long as your account is active. You may request the deletion of your account and of all your data at any time, by email at compte@chatven.fr. Deletion is effective within 30 days, except for legal retention obligations (invoices kept for 10 years; security logs kept for 12 months maximum).

6. Storage and processors

Your data is processed by the following providers (processors), governed by data processing agreements:

• Supabase — database, authentication and photo storage.
• Vercel — hosting of the web application and cookieless audience measurement.
• Stripe — secure processing of payments and subscriptions.
• Resend — sending of transactional emails.
• Anthropic — AI-assisted page analysis and price estimation (no account data is transmitted).

None of these providers is authorized to use your data for purposes other than the provision of the Service. Any transfers outside the EU are governed by the Standard Contractual Clauses (SCCs) of the European Commission. No data is sold or transmitted to third parties for advertising purposes.

7. Cookies and local storage

• Web session cookie (Supabase Auth) — strictly necessary to keep you logged in. No third-party cookie, no advertising cookie.
• Extension local identifier — UUID v4 stored in chrome.storage.local, used only to identify the installed extension instance in order to avoid session duplicates.
• Local preferences — theme (light/dark), language, stored in localStorage to avoid the flash on load.

8. No fingerprinting

Chatven uses no digital fingerprinting technique: no collection of hardware attributes (canvas, installed fonts, plugins, hardware concurrency, WebGL), no cross-site correlation, no third-party identifier. The extension's local UUID is randomly generated and is never associated with technical characteristics of your machine.

9. Your rights

In accordance with the GDPR, you have the following rights:

• Access — obtain a copy of your personal data.
• Rectification — correct inaccurate or incomplete information.
• Erasure — delete your account and all your data.
• Portability — retrieve your data in a structured format (JSON).
• Objection and restriction — object to processing or limit its scope.
• CNIL complaint — refer the matter to the French supervisory authority if you consider your rights are not respected.

To exercise these rights, write to us at privacy@chatven.fr. We respond within 30 days maximum.

10. Changes

We may update this policy to reflect changes to the Service or the regulations. The date of the last update appears at the top of the page. Substantial changes will be notified to logged-in users.