01Data controller
Sylvain Lejamble, sole trader (entrepreneur individuel, EI) operating under the trade name Lampion, SIREN 947 709 275, Paris (75017), France. Contact: [email protected].
Lampion has not appointed a Data Protection Officer (DPO), as this is not mandatory given its processing activities. Requests are handled at the address above.
02Data collected
| Category | Data | Source |
|---|---|---|
| Account | Name, email address, password (bcrypt-hashed), preferred language | You, at sign-up |
| Third-party sign-in | Identifier, email and name provided by Google, GitHub or your SSO provider | The identity provider |
| Organization | Organization name, role, memberships | You |
| Usage | Compute, storage and transfer volumes per project | Automatic metering |
| Billing | Billing details, invoice history | You and Stripe |
| Audit log | Actions performed in the console, timestamp, user identifier | Automatic |
| Technical | IP address, error and access logs | Automatic |
Lampion never accesses the content of your databases. Metering measures volumes, not data.
03Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage your account, deliver the service | Performance of a contract (art. 6.1.b) |
| Confirm your email address and secure sign-up | Legitimate interest — abuse prevention (art. 6.1.f) |
| Meter consumption and bill | Performance of a contract (art. 6.1.b) |
| Issue and retain invoices | Legal obligation (art. 6.1.c) |
| Log actions (audit, security) | Legitimate interest — security (art. 6.1.f) |
| Answer support requests | Performance of a contract (art. 6.1.b) |
| Inform you about what's new in Lampion (product news emails) | Legitimate interest — informing customers about services similar to those they use (art. 6.1.f GDPR, art. L34-5 of the French Postal and Electronic Communications Code). You can object at any time, free of charge: unsubscribe link in every email or your account settings |
| Inform you about maintenance or changes to the terms (service emails) | Performance of the contract (art. 6.1.b) |
04Recipients and sub-processors
| Sub-processor | Role | Location |
|---|---|---|
| Scaleway SAS | Hosting of the service and databases | France |
| OVH SAS | Data plane hosting | France |
| Cloudflare, Inc. | Marketing site hosting, network protection | Outside the EU — standard contractual clauses |
| Stripe Payments Europe, Limited | Payment and invoicing | Ireland (EU), with onward transfer to Stripe, LLC (USA) — DPF, standard contractual clauses (SCC) as a fallback |
| Plus Five Five, Inc. (Resend) | Email delivery (transactional, service and product news) | USA — DPF and standard contractual clauses (SCC) |
| Raintank, Inc. (Grafana Labs) | Technical monitoring (metrics and logs) | EU (Germany), transfers to the USA possible — standard contractual clauses (SCC) and DPF |
The DPF (EU-U.S. Data Privacy Framework) is the European Commission adequacy decision of July 10, 2023; the standard contractual clauses are those of Implementing Decision (EU) 2021/914. Details are in the DPA, section 5.
No data is sold or transferred to third parties for commercial purposes.
05Retention periods
| Data | Period |
|---|---|
| Account and organization | Until the account is deleted |
| Databases and backups | Restorable for 7 days after the project or organization is deleted, then permanently and automatically deleted; residual copies kept by object-storage versioning are erased within the following 30 days |
| Audit log | 12 months |
| Technical logs | 14 days |
| Invoices and accounting records | 10 years (legal obligation, art. L.123-22 French Commercial Code) |
06Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability set out in articles 15 to 22 of the GDPR.
Account deletion is available directly in the console and triggers effective erasure of the associated data. For any other request: [email protected]. Lampion responds within one month.
You may lodge a complaint with the CNIL (French data protection authority), 3 place de Fontenoy, 75007 Paris — cnil.fr.
07Security
Encryption in transit (TLS), bcrypt-hashed passwords, organization isolation, role-based access control, logging of sensitive actions, and a separate administration session that expires after a period of inactivity.
Technical and organizational measures are detailed in the DPA.