PRIVACY AND PERSONAL DATA PROTECTION POLICY (GDPR / RGPD)

Last updated: September 20, 2026

This Privacy Policy informs users of the website and application Internet's Answer (accessible at https://internetsanswer.com) about how their personal data is collected, used, stored, and protected, in accordance with the General Data Protection Regulation (GDPR - Regulation EU 2016/679) and French Law No. 78-17 of January 6, 1978 as amended (Loi Informatique et Libertés).

1. Data Controller

Personal data collected on the website is processed by the platform operator:

• Trade Name: Internet's Answer — Operated by [OPERATOR FULL NAME] (Sole Proprietorship - Micro-entreprise)
• Professional Address: [REGISTERED ADDRESS, POSTAL CODE, CITY, FRANCE]
• Registration: SIRET n° [14-DIGIT SIRET NUMBER]
• Privacy / DPO Contact: contact@internetsanswer.com

2. Data Collected, Purposes & Legal Bases

In accordance with the principle of data minimization (Article 5-1-c GDPR), we only collect data strictly necessary for the performance, security, and operation of our services.

A. Account Creation & User Profile Management

• Data Processed: Username, email address, secure cryptographically hashed password (one-way bcrypt), profile avatar, unique user ID, and registration timestamp.
• Purpose: Account creation and administration, access security, and authentication.
• Legal Basis: Performance of a contract / Terms of Service (Article 6-1-b GDPR).
• Retention Period: Maintained for the active lifespan of the account. Accounts inactive for 3 consecutive years are deleted following prior notification.

B. Quiz Participation, Community Consensus & Gamification

• Data Processed: Quiz responses and votes, scores, experience points (Points), winning streaks, unlocked badges, participation history, and created quizzes.
• Purpose: Real-time opinion statistics calculation, consensus comparison, leaderboard ranking, and gamified progression.
• Legal Basis: Performance of a contract / Terms of Service (Article 6-1-b GDPR).
• Retention Period: Maintained while the user account is active. Aggregated and anonymized statistical vote data is retained permanently to ensure historical validity of public consensus benchmarks.

C. Paid Subscriptions & Billing (Membership Pro)

• Data Processed: Subscription tier (monthly or annual), payment status, transaction identifiers, renewal date.Full payment card details are processed directly by our PCI-DSS certified payment processor and never touch our servers.
• Purpose: Subscription management, Premium feature activation, billing, and renewal processing.
• Legal Basis: Performance of a contract / Terms of Sale (Article 6-1-b GDPR) and legal accounting obligations (Article 6-1-c GDPR).
• Retention Period: Duration of subscription plus 10 years statutory archival for accounting records (French Commercial Code Art. L.123-22).

D. Transactional Emails & Security

• Data Processed: Email address, time-limited verification tokens, dispatch logs.
• Purpose: Sending email confirmations, password reset links, and critical security notices via Resend.
• Legal Basis: Performance of a contract (Article 6-1-b GDPR) and legitimate interest in platform security (Article 6-1-f GDPR).
• Retention Period: Dispatch logs retained for up to 30 days.

E. Audience Measurement & Analytics (Google Analytics 4, GTM, Vercel Analytics)

• Data Processed: Pseudonymized identifiers, pages visited, time on page, device and browser performance metrics.
• Purpose: Platform usage analysis, UI error detection, and performance optimization.
• Legal Basis: Prior express consent (Article 6-1-a GDPR and French Data Protection Act Art. 82) collected via our cookie banner.
• Retention Period: Up to 13 months for cookie storage; 14 months for events recorded in Google Analytics.

F. Security, Fraud Prevention & Rate Limiting

• Data Processed: Truncated/hashed IP addresses, request headers, request timestamps.
• Purpose: DDoS mitigation, automated bot prevention, and brute-force protection.
• Legal Basis: Legitimate interest of the publisher to safeguard platform availability and integrity (Article 6-1-f GDPR).
• Retention Period: From minutes up to a maximum of 30 days in our security cache (Upstash Redis).

3. Data Recipients & Processors

Your data is never sold, rented, or traded to third parties for marketing purposes. It is shared only with technical service providers strictly necessary to operate the service:

• Vercel Inc. (USA): Application hosting, serverless functions, and infrastructure telemetry.
• Neon Inc. / Supabase Inc.: Managed secure PostgreSQL relational database.
• Upstash Inc. (USA / Cloud): Distributed Redis caching and rate-limiting infrastructure.
• Resend Inc. (USA): Transactional email dispatch.
• Google Ireland Ltd. / Google LLC: Web analytics (GA4, GTM) only when consent is granted.

4. International Data Transfers

Certain technical processors are based in or operate data centers in the United States (Vercel, Resend, Upstash, Google). These transfers comply with Chapter V of the GDPR:

• Under the European Commission adequacy decision of July 10, 2023 for the EU-U.S. Data Privacy Framework (DPF), where our partners maintain active certification;
• Or via Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by end-to-end encryption in transit and at rest (TLS 1.3 / AES-256).

5. Your Rights Over Your Data

Pursuant to Articles 15 to 22 of the GDPR and the French Data Protection Act, you hold the following rights:

• Right of Access (Art. 15): Request confirmation and obtain a copy of your personal data.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete information directly from your profile or by contacting us.
• Right to Erasure (Art. 17): Request complete account deletion autonomously via our dedicated Account Deletion page.
• Right to Restriction of Processing (Art. 18): Request temporary freezing of certain processing operations.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used format (CSV/JSON).
• Right to Object (Art. 21): Object to processing based on legitimate interests at any time.
• Right to Withdraw Consent: Withdraw consent for non-essential analytics cookies anytime via the "Manage Cookies" button in the footer.
• Post-Mortem Directives (Art. 85 French Data Protection Act): Define instructions regarding the retention, erasure, and communication of your data after death.

6. Exercising Your Rights & Regulatory Recourse (CNIL)

To exercise your rights or ask questions regarding personal data processing, contact us at:

Email: contact@internetsanswer.com
We commit to responding promptly, and at the latest within one (1) month of receiving your request (Article 12-3 GDPR).

If you consider that your data rights are not being respected after contacting us, you have the statutory right to lodge a complaint with the French data protection supervisory authority:

• Commission Nationale de l’Informatique et des Libertés (CNIL)
• Postal Address: 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07, France
• Website: https://www.cnil.fr