Data controller
Yann Burger — entrepreneur individuel (EI)
UNSEEN Factory — trading name, “GetUnseen” app — micro-enterprise
SIRET: 520 020 355 00027
1, boulevard Paul Langevin, 44100 Nantes, France
DPO contact: hello@getunseen.app
Data collected
When you use the GetUnseen app and the getunseen.app site, the following data is collected:
| Data |
Purpose |
Legal basis |
| E-mail address |
Authentication, sending order confirmations and invoices |
Performance of the contract (Art. 6.1.b) |
| First name, surname |
Identification, invoicing, delivery |
Performance of the contract (Art. 6.1.b) |
| Postal address |
Shipping of the photo prints |
Performance of the contract (Art. 6.1.b) |
| Photos taken in the app |
Temporary storage until printing and delivery |
Performance of the contract (Art. 6.1.b) |
| Order history |
Delivery tracking, refunds, accounting |
Legal obligation (Art. 6.1.c) — 10 years |
| Payment data |
Secure processing of transactions |
Performance of the contract — processed exclusively by Stripe |
No bank details are stored by UNSEEN Factory. Payments are processed directly by Stripe, Inc., which is PCI-DSS compliant.
Retention periods
| Data |
Period |
| Account data (e-mail, name) |
Lifetime of the account + 30 days after deletion |
| Photos |
90 days after the delivery date of the order, then deleted automatically |
| Invoices and accounting records |
10 years (legal obligation — French Commercial Code Art. L123-22) |
| Delivery addresses |
Lifetime of the account |
Processors
UNSEEN Factory calls on the following processors as part of the processing of your data:
| Processor |
Role |
Location |
| Supabase, Inc. |
Database, authentication, photo storage |
EU (Frankfurt, Germany) |
| Stripe, Inc. |
Card payment processing |
United States (Privacy Shield / SCCs) |
| Prodigi Group Ltd. |
Printing and shipping of the photo prints |
United Kingdom |
| Resend, Inc. |
Sending of transactional e-mails |
United States (SCCs) |
| OVH SAS |
Hosting of the getunseen.app website |
France (Roubaix) |
| Apple Inc. |
“Sign in with Apple” login (authentication only) |
United States (SCCs) |
| Google LLC |
“Continue with Google” login (authentication only) |
United States (SCCs) |
Personal data (delivery address, first name/surname) is passed on to Prodigi for the sole purpose of shipping your order. No data is sold or transferred to third parties for commercial purposes.
Your rights
In accordance with articles 15 to 22 of the GDPR, you have the following rights over your personal data:
- Right of access (Art. 15) — obtain a copy of your data
- Right to rectification (Art. 16) — correct inaccurate data
- Right to erasure (Art. 17) — request the deletion of your account and your data
- Right to portability (Art. 20) — receive your data in a structured format
- Right to object (Art. 21) — object to certain processing
- Right to restriction (Art. 18) — restrict processing in certain cases
To exercise these rights, contact:
hello@getunseen.app
Reply guaranteed within
30 days in accordance with the GDPR.
Account deletion
You can request the complete deletion of your account and of all your personal data by sending an e-mail to hello@getunseen.app from the address associated with your account.
Deletion will take effect within 30 days at most. Data subject to a legal retention obligation (accounting records) will be kept for the period laid down by law, then deleted.
Cookies and trackers
The GetUnseen app and the getunseen.app site use neither advertising tracking cookies nor third-party analytics tools. No cookie consent is required at this stage.
Should audience measurement tools be added, a GDPR-compliant consent banner would be put in place beforehand.
Data security
UNSEEN Factory implements appropriate technical and organisational measures to keep your data secure:
- Encryption of data in transit (HTTPS / TLS 1.3)
- Encryption of data at rest (Supabase / AES-256)
- Authentication with expiring JWT tokens
- Access to data restricted by role (Supabase Row Level Security)
- No unauthorised third-party access to users' photos
Complaint to the CNIL
If you consider that the processing of your personal data breaches the GDPR, you have the right to lodge a complaint with the competent supervisory authority:
Commission Nationale de l'Informatique et des Libertés (CNIL)
3, place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07
cnil.fr
Changes to this policy
UNSEEN Factory reserves the right to amend this privacy policy at any time. In the event of a substantial change, users will be informed by e-mail or by a notification in the app. The version in force is always available at getunseen.app/en/privacy/.