Privacy Policy

The data controller under Regulation (EU) 2016/679 (GDPR) is:

For any privacy-related inquiry, please contact us at hello@bapti.day.

We only collect what is strictly necessary to provide our services. The categories of data processed are:

In accordance with Article 6 GDPR, every processing is based on a specific legal basis:

Your data is shared only with the following sub-processors, bound by contract under Article 28 GDPR:

Some sub-processors are established outside the European Economic Area (notably in the United States and Singapore). Such transfers are protected by the appropriate safeguards under Articles 44 ff. GDPR:

• For the United States: enrolment in the Data Privacy Framework (DPF) when the sub-processor is certified; otherwise, Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914) apply.
• For Singapore: signing of Standard Contractual Clauses and Transfer Impact Assessment (TIA) ensuring equivalent protection.
• Additional technical measures: encryption in transit (TLS 1.2+), encryption at rest, pseudonymisation where possible.

You may request a copy of these safeguards by writing to hello@bapti.day.

We retain your data only as long as necessary for the purposes described above. Main durations are:

• Active account: as long as you use the app.
• Deleted account: complete erasure within 30 days, except for legal obligations (billing, accounting, tax obligations: up to 10 years).
• Security logs: rolling 12 months.
• Anonymised analytics data: max. 13 months (CNIL guidance).
• Support messages: 3 years from the last exchange.

When you import or enter your guests' contact details (name, email, phone), you act as an independent data controller for that data.

Guests may request deletion of their data by contacting us at hello@bapti.day; we will forward the request to the relevant organiser.

Under Articles 15 to 22 GDPR, you have the following rights:

• Right of access: obtain confirmation that we process your data and receive a copy.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): request deletion of your data, subject to legal retention obligations.
• Right to restriction: request processing suspension in specific cases.
• Right to object: object to processing based on legitimate interest or for direct marketing purposes.
• Right to data portability: receive your data in a structured, machine-readable format (JSON).
• Right to withdraw consent at any time for processing that relies on it.
• Right to set post-mortem instructions on the fate of your data (Article 85 French Data Protection Act).
• Right to lodge a complaint with the CNIL: www.cnil.fr or any competent supervisory authority.

To exercise your rights, write to hello@bapti.day. We will reply within one month, which may be extended by two months for complex requests. You may also delete your account directly from the app (Profile → Settings → Delete account).

We implement appropriate technical and organisational measures:

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Strong authentication with short-lived JWT tokens.
• Role-based access control and least-privilege principle.
• Strict environment separation (development, production).
• Supabase Row Level Security (RLS): each user can only access their own data.
• Access logging and anomaly detection.
• Daily automated backups and disaster recovery plan.
• Regular security testing and vulnerability monitoring.

In case of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you within 72 hours of discovery, in accordance with Article 34 GDPR.

BaptiDay is intended for users aged 15 or older. Under Article 8 GDPR and the French Data Protection Act, minors under 15 require their legal representatives' authorisation.

Photos and names of children included in an event are entered under the sole responsibility of the organiser, who must have obtained the legal representatives' consent.

Our use of cookies and trackers on the website and mobile app is described in our Cookie Policy.

We may update this policy to reflect legal, technical or functional changes. Any substantial change will be communicated by email or via an in-app notification at least 30 days before it takes effect.

Supervisory authority: Commission Nationale de l'Informatique et des Libertés (CNIL) — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.