Privacy Policy
Last updated: October 23, 2026 · Version: 2026-10-23
This policy explains what personal data we process when you use the Agency FWS website and the "Cinematic 3D Websites" course, why we process it, how long we keep it and how you can exercise your rights. It is based on the EU General Data Protection Regulation (GDPR) and French data protection law. This English version is provided for convenience; in case of any discrepancy, the French version prevails.
In short
- We only collect what we need for your account, your purchase and your course.
- No advertising trackers. Audience measurement works without cookies.
- Your card details are entered with Stripe and never pass through our servers.
- Your data is never sold or rented, and is never used for advertising.
- You can download your data and delete your account under "My account".
Data controller
The data controller is the seller of the course:
- Léon Pasquier, sole trader (entrepreneur individuel, EI, under French law)
- Aix-en-Provence, Bouches-du-Rhône (13), Provence-Alpes-Côte d'Azur, France
- Contact for personal data matters: leon.business.pro.13@gmail.com
The data we process
| Data | Why | Legal basis | How long we keep it |
|---|---|---|---|
| Account: first name, email address, password (hashed, never stored in plain text), language | To create and manage your account, sign you in and write to you in your language | Performance of the contract | For as long as your account exists. You can delete it at any time under "My account" |
| Purchases: date, amount, currency, Stripe payment references (customer, checkout session, payment), invoice | To manage your order, your access, your invoice and any refund | Performance of the contract; legal obligation (accounting) | 10 years, including after your account is deleted (Article L123-22 of the French Commercial Code) |
| Consent: date, version of the terms accepted, language | To prove your request for immediate access and your waiver of the right of withdrawal | Legal obligation; legitimate interest (being able to prove your choice in a dispute) | 5 years from purchase (the applicable limitation period) |
| Progress: completed sections, AURA project steps, checklist items, reading position | To show your progress and let you pick up where you left off | Performance of the contract | For as long as your account exists; erased when your account is deleted |
| Technical and security logs: sign-in attempts, rate limiting, the IP address and browser (user agent) recorded with each sign-in session | To protect accounts and limit sign-in attempts and the number of requests | Legitimate interest (website security) | A short period: as long as needed for the website's security |
| Administrator action log: actions taken on accounts (access granted or removed, email resent, refund, etc.) | To keep a record of actions on accounts and secure the administration area | Legitimate interest (security and accountability) | As long as needed to keep track of actions taken on accounts |
| Password reset email: email address, first name, message content | To let you choose a new password when you ask for one | Performance of the contract | In line with your account data; Google keeps its sending logs under its own terms |
| Testimonials: name, text of the review | To publish your review on the website, only if you have agreed | Consent | Until you withdraw your consent |
| Emails exchanged: emails you send us and our replies | To answer your questions and complaints | Legitimate interest (replying to you); performance of the contract if they concern your order | As long as needed to deal with your request |
We only send emails related to your account and your order.
Card details. You enter your card details directly in Stripe's secure form. We never have access to your full card number, and the website never stores your card details.
Audience measurement. The website counts its own page views anonymously: it only records the page, the day, the country, the referring site and the type of device, with no IP address, no cookie and no personal data at all. It also uses Cloudflare Web Analytics, Cloudflare's audience measurement tool, which works without cookies. This measurement is used to know how many people visit the website and is based on our legitimate interest. Details are in our cookie policy.
Deleting your account
You can delete your account at any time under "My account". When you do:
- your account data is anonymized;
- your progress is erased;
- your access to the course ends permanently.
We keep your purchase and your invoice for 10 years, as required by law (Article L123-22 of the French Commercial Code), and the proof of your consent for 5 years from purchase.
Before deleting your account, you can download your data under "My account".
Who receives your data
Your data is processed by the data controller. It is shared only with the following providers, which act on our behalf (processors):
- Cloudflare, Inc. (San Francisco, USA), for hosting the website, the database (Cloudflare D1, in Western Europe), file storage (Cloudflare R2, in the European Union jurisdiction) and cookieless audience measurement (Cloudflare Web Analytics).
- Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland, for European customers), for payments. For certain purposes of its own, such as fraud prevention and its legal obligations relating to payments, Stripe acts as a separate data controller under its own privacy policy.
- Google (Gmail), for sending password reset emails and for the emails we exchange with you.
We may also disclose data to public authorities where the law requires it.
Transfers outside the European Union
Cloudflare, Stripe and Google are US companies, so some of your data may be transferred to the United States. These transfers are covered by these companies' certification under the EU–US Data Privacy Framework and by the European Commission's standard contractual clauses.
The website's database is hosted in Western Europe, and its files are stored in the European Union jurisdiction of Cloudflare R2.
Security
- Encrypted connection (HTTPS).
- Passwords hashed, never stored in plain text.
- Limited number of sign-in attempts.
- Administration area restricted to the administrator, whose actions are logged.
- No card data on our servers.
Your rights
You have the following rights over your data:
- Access: find out what data we hold about you and get a copy.
- Rectification: correct inaccurate data. You can change your name, email address and password under "My account".
- Erasure: ask us to delete your data, or delete your account yourself. Data we are legally required to keep (purchase, invoice, proof of consent) is kept for the periods stated above.
- Restriction: ask us to suspend the use of some of your data.
- Objection: object to processing based on our legitimate interest, on grounds relating to your particular situation.
- Portability: receive your data in a reusable format. An export is available under "My account".
- Withdrawal of consent: withdraw your consent to the publication of a testimonial at any time.
- Instructions after death: under French law, you may give instructions on what should happen to your data after your death.
To exercise these rights, email leon.business.pro.13@gmail.com. We reply within one month. If we have reasonable doubts about your identity, we may ask you to confirm it.
If you believe your rights have not been respected, you may lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr (opens in a new tab)), or with the data protection authority of your country of residence in the European Union.
Cookies
We only use cookies that are strictly necessary for the website to work. Details are in our cookie policy.
Changes
We may update this policy. The date at the top of the page shows the latest version.
Back to home