Legal information

Privacy policy

This policy explains what personal data Entresonge processes when you visit entresonge.com or write to us, why, on what legal basis, for how long, and how to exercise your rights.

It is drawn up in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and French law no. 78-17 of 6 January 1978 on information technology, data files and civil liberties. This English version is provided for convenience; in case of discrepancy, the French version prevails.

Last updated: 7 October 2026

01Data controller

Controller: Entresonge, French SASU with share capital of €5,000
Registered office: 58 allée de la Pièce du Lavoir, 91190 Gif-sur-Yvette, France
Registration: RCS Évry 108 107 970
Represented by: Antoine Langloys, President
Contact: [email protected]

Entresonge has not appointed a data protection officer; for any question about your data: [email protected].

02At a glance

The site requires no account and contains no advertising.
It uses no advertising cookies, no social media trackers and no third-party analytics.
The only data you entrust to us is what you send through the contact form or by email, used to reply to you.
Audience statistics are simple page counters, with no cookies and no personal data.
YouTube videos only load after you click.
Your data is never sold, rented or transferred for commercial purposes.

03Data, purposes, legal bases and retention

Each processing operation carried out on the site is described below. Legal bases refer to article 6 of Regulation (EU) 2016/679 (GDPR).

Enquiries sent through the contact form or by email

Data: Name, email address, subject of the enquiry, message content, site language and date received. If you write directly to [email protected]: your email address and the content of your message.
Purposes: Replying to your enquiry, discussing a potential project and following up on any resulting relationship.
Legal bases: Pre-contractual steps taken at your request (art. 6(1)(b)) when your message concerns a project or a service; otherwise, Entresonge’s legitimate interest in replying to the messages it receives (art. 6(1)(f)).
Retention: As long as needed to handle your enquiry and follow up on the relationship. Closed enquiries are reviewed regularly and deleted, together with their copies in the mailbox, once no longer needed, and at the latest three years after your last contact. A deleted message stays in a trash folder for thirty days, then is permanently erased. If a contract is concluded, the necessary data is kept for the duration of the contract, then for the limitation and archiving periods required by law (for example ten years for accounting records).

All form fields are required: without them, Entresonge cannot reply. Please do not include sensitive data (health, opinions, etc.) or information about other people that is not needed for your enquiry. A hidden field filters out automated submissions: when it is filled in, the message is ignored and not stored.

Site security and abuse prevention

Data: Where applicable, a fingerprint of your IP address, computed with a secret key (HMAC-SHA-256) and associated with a request count. The IP address itself is not stored. For the administration area, the number of failed login attempts per account.
Purposes: Limiting abusive use of the contact form and repeated login attempts on the administration area.
Legal basis: Entresonge’s legitimate interest in keeping the site and its users secure (art. 6(1)(f)).
Retention: Ten minutes: each counter expires at the end of its window and is deleted on the next request.

Technical operation of the site

Data: IP address, date and time, page requested, browser type and referring page, sent by your browser with each request.
Purposes: Displaying the site, delivering it to you and protecting it against attacks and malfunctions.
Legal basis: Entresonge’s legitimate interest in providing a working and secure site (art. 6(1)(f)).
Retention: For the duration of the request. Server technical logs are kept for a limited period not exceeding twelve months; those of the hosting and delivery providers follow their own retention periods, limited to the security needs of their services.

Audience statistics

Data: The address of the page viewed and the date, nothing else: no IP address, no cookie, no identifier, no browser fingerprint. The browser type is only used to exclude bots and is not stored.
Purposes: Knowing how many times each page is viewed, day by day.
Legal basis: These counters contain no personal data and no tracker is stored on or read from your device: your consent is not required. The request that feeds them falls under Entresonge’s legitimate interest (art. 6(1)(f)).
Retention: Anonymous, aggregated counters that may be kept indefinitely.

Administration area

Data: For persons authorised by Entresonge only: email address, hashed password and login sessions.
Purposes: Managing site content and reading the messages received.
Legal basis: Entresonge’s legitimate interest in administering its site securely (art. 6(1)(f)).
Retention: For as long as access is authorised. A session ends at logout, and at the latest two hours after its token is issued.

Entresonge makes no decision based solely on automated processing and carries out no profiling.

04Recipients and processors

Your data is accessible only to authorised Entresonge staff, to the extent necessary for their tasks. Entresonge uses the following providers, which act as processors and only process data for the purposes of their service:

OVHcloud: Hosting of the site’s server and database, in France; receipt and forwarding of emails sent to the entresonge.com domain.
Cloudflare: Delivery network in front of the server: traffic routing, HTTPS encryption and protection against attacks.
Resend: Sending the email notifications generated by the contact form.
Google: Gmail email service used to read and reply to emails received at [email protected].

OVHcloud · Cloudflare · Resend · Google

Your data may also be disclosed to administrative or judicial authorities where required by law. It is never sold, rented or transferred to third parties for commercial purposes.

05Transfers outside the European Union

Cloudflare, Resend and Google are companies established in the United States or whose parent company is established there. Some data (IP address, contact details and message content) may therefore be processed outside the European Union or made accessible from there. Email sending through Resend is configured in a hosting region located in the European Union.

Where they occur, these transfers are covered by the safeguards provided in chapter V of the GDPR: the European Commission’s adequacy decision on the EU-US Data Privacy Framework, for companies that participate in it, or otherwise the standard contractual clauses adopted by the European Commission. You can obtain information about these safeguards by writing to [email protected].

06Cookies and similar technologies

A tracker is information stored on or read from your device when you visit a site: a cookie, browser local storage, etc. Article 82 of the French Data Protection Act requires your consent before any such storage, except for trackers that are strictly necessary for a service you request or whose sole purpose is to enable online communication.

The site only uses trackers of this kind, which are exempt from consent under the guidelines of the CNIL, the French data protection authority. It uses no advertising cookies, no social media cookies and no third-party analytics: this is why no consent banner is shown.

entresonge-lang
Cookie
Remembers the language you choose with the FR / EN switch, to show the site in that language on later visits. Only set if you use the switch.
Duration: one year · Category: preference you expressed, exempt
entresonge-motion
Local storage
Remembers whether you chose to play or pause animations. Only created if you use this setting; never sent to the server.
Duration: until you change the setting or clear the site’s data · Category: preference you expressed, exempt
entresonge-seuil
Session storage
Records that the opening animation has already played in the tab, so that it is not replayed in full. Contains no identifier; never sent to the server.
Duration: cleared when the tab is closed · Category: interface operation, exempt
payload-token
Cookie
Authenticates authorised persons signed in to the administration area. Never set for visitors of the public site.
Duration: login session, two hours at most · Category: authentication, strictly necessary
Cloudflare security cookies
Cookie, where applicable
Set by Cloudflare only when a security or bot detection check is triggered, to remember its outcome.
Duration: short, set by Cloudflare · Category: security, strictly necessary

You can delete or block these trackers at any time in your browser settings. The site remains usable: it simply will not remember your preferences.

YouTube videos

Videos are shown as a preview: the image is served by entresonge.com and no connection to YouTube is made until you start playback. When you click “Play via YouTube”, the player loads from youtube-nocookie.com, YouTube’s privacy-enhanced mode. YouTube, a Google service, then receives your IP address and technical information about your browser, and may store or read trackers under its own responsibility. If you do not want this, do not start playback. See Google’s privacy policy.

Other resources

Fonts are hosted with the site: no request is sent to Google Fonts when you visit. The view counts shown for episodes are fetched by Entresonge’s server from YouTube or from a public statistics service, without sending any data about you. Links to social networks are plain links: no social media plug-in is embedded in the pages.

07Security

Entresonge implements appropriate technical and organisational measures to protect your data:

HTTPS encryption, enforced in browsers by the HSTS header;
a content security policy (CSP) restricting the scripts and resources allowed, and security headers that prevent, among other things, the site from being displayed inside a third-party frame;
origin checks on form submissions, an anti-bot field and limits on the number of submissions;
an administration area protected by authentication: hashed passwords, a session cookie inaccessible to scripts, temporary lockout after several failed logins and session revocation at logout;
access to messages restricted to authorised persons.

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, Entresonge will inform you under the conditions set out in article 34 of the GDPR.

08Your rights

You have the following rights over your personal data:

Access · art. 15: Obtain confirmation that data concerning you is processed and receive a copy of it.
Rectification · art. 16: Have inaccurate data corrected or incomplete data completed.
Erasure · art. 17: Have your data deleted, under the conditions set out in the GDPR.
Restriction · art. 18: Have the use of your data temporarily suspended, for example while a dispute is checked.
Objection · art. 21: Object, on grounds relating to your particular situation, to processing based on legitimate interest; and at any time, without giving reasons, to any marketing.
Portability · art. 20: Receive the data you provided in a structured, commonly used format, where processing is based on pre-contractual steps or a contract.
Post-mortem instructions: Set instructions on the retention, erasure and disclosure of your data after your death (article 85 of the French Data Protection Act).

09Exercising your rights

Write to [email protected] or by post to Entresonge, 58 allée de la Pièce du Lavoir, 91190 Gif-sur-Yvette, France, stating your request and the email address you used in your exchanges with Entresonge.

Entresonge replies within one month of receiving your request. This period may be extended by two months given the complexity or number of requests; you will then be informed within the first month. Exercising your rights is free of charge. If there is reasonable doubt about your identity, additional information may be requested, solely to verify it.

10Complaint to the CNIL

If, after contacting Entresonge, you consider that your rights have not been respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL):

Online: www.cnil.fr
By post: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07

11Minors

The site is not specifically intended for children. If you are under fifteen, please ask one of your parents or the person with parental authority to write to us with you. If you believe a minor has sent us personal data, write to [email protected] and it will be deleted.

12Third-party sites

The site contains links to other sites, including the applications presented (Cinelude, OvationMap, Ventace), completed projects and social networks. These sites apply their own privacy policies, which you should read. The rules for using the site are set out in the terms of use.

13Changes

Entresonge may amend this policy to reflect changes to the site, its providers or the regulations. The version in force is the one published on this page. Last updated: 7 October 2026.