Privacy policy

Data controller

The data controller is the sole trader who runs wondarchive, named in the legal notice, who can be reached at info@wondarchive.com. This policy says which personal data we process, why, for how long, with whom we share it and how to exercise your rights. The documents you deposit are processed only to provide the service you ask for.

Which data

Your email address and your password (hashed); the images, texts and metadata you deposit; the technical logs needed for operation, kept for thirty days; the IP addresses of your successful sign-ins, kept for thirty days, so that an account holder is not locked out when someone else keeps trying passwords; the email address of a trial request or a sign-up is kept beyond that, so that we can contact you again, until you ask for it to be erased. A deleted page is erased seven days after being placed in the bin: its image disappears at once; its text may remain for up to thirty-six months in the database backups. Card payments are made on Stripe’s secure page: we never see or keep your card number, only the payment reference. No third-party cookie, no advertising, no resale.

Audience measurement of the wondarchive.com site (not the application): our server sends Google Analytics the page viewed, where the visit came from, the language, the country (derived from your IP address on our server, using the DB-IP database), the type of device and the site’s actions (links and buttons clicked, simulator opened, quote downloaded, trial or sign-up request), under an identifier computed each day and never stored; neither your IP address, nor your browser, nor your account, nor any cookie is sent to Google. The same data is also kept for thirteen months on our server, with a measurement cookie (the wondarchive_mesure cookie: a randomly drawn number, valid for thirteen months and never extended) that tells us only whether a visitor returns; it is used only for our statistics and never leaves our server. If your browser sends the “Global Privacy Control” or “Do Not Track” signal, or if you refuse audience measurement (your refusal is kept for thirteen months in this same cookie), your visits are not measured at all. Basis: our legitimate interest in knowing how the site is visited. Google keeps the data for fourteen months.

If you choose to sign in with Google, we receive from Google your name, your email address, an account identifier and your profile picture, nothing else.

Usage measurement: to improve the service, we record, linked to your account, the actions taken in the application (screen opened, kind of action, counts, durations, errors and slowdowns, type of device) — never the text of your pages, the words you search for, or the name of a collection or a file. Legal basis: our legitimate interest in running and improving the service. The detail is kept for thirteen months, then only monthly totals; nothing is handed to a third party. We also note the date and the means of each sign-in (password, Google, welcome link), without IP address or browser.

Tester accounts: during the test, the wondarchive team may look at your pages (photos, transcriptions, translations and their processing errors) to improve the service; this is possible only for accounts on the Tester plan, never for any other, and each viewing is recorded in our logs. The email that opens your account tells you so.

Purposes and legal bases

Where the basis is our legitimate interest, you may object to the processing (see “Your rights”).

Recipients and subcontractors

Your data is passed on only to the people at wondarchive who need it, to the subcontractors below, who act only on our behalf, and, if the law requires, to the competent authorities. It is neither sold nor rented. The people you invite to a collection see that collection, according to the role you give them.

Transfers outside the European Union

Your documents and your account data are hosted in France and processed in the European Union. Only the audience measurement of the wondarchive.com site, entrusted to Google (Ireland), may involve a transfer to the United States: it is covered by the EU-US Data Privacy Framework and, failing that, by the European Commission’s standard contractual clauses. If you choose to sign in with Google, Google processes that sign-in under its own privacy policy.

Retention periods

Cookies

The site sets no advertising cookie. Its only measurement cookie, wondarchive_mesure, is described above; it is used only for our statistics and therefore needs no consent from you. The cookies needed for operation (session, lasting sign-in, language) are described in the legal notice.

Your rights

You have the right of access, rectification, erasure, restriction of processing, portability of your data and objection (in particular to processing based on our legitimate interest). Where processing rests on your consent, you may withdraw it at any time. You may also give instructions on what becomes of your data after your death.

To exercise these rights, use your account (profile, exports, account deletion) or write to info@wondarchive.com; if there is reasonable doubt, we may ask for proof of identity. We reply within one month, which may be extended in the cases the law provides for.

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the CNIL (the French data protection authority), cnil.fr.

Security

Exchanges with the site and the application are encrypted (HTTPS). Passwords are kept only in hashed form; access to the administration of the service is reserved to the operator and protected by a password; original images are kept with our host, in France, with backups. No measure is infallible: in the event of a data breach likely to put you at risk, we will inform the CNIL and, where the law requires, the people concerned.

Minors

The service is intended for adult researchers, students and professionals. We do not knowingly collect data from people under fifteen; if you think a minor has given us some, write to info@wondarchive.com and we will erase it.

Updates to this policy

We may change this policy, in particular if the service or the law changes. The version published on this page is the one in force; in the event of an important change, we will tell you by email or on screen.