Privacy Policy

How we protect and manage your personal data.

Last updated: November 2, 2026.

1. Data controller

Stéphane Bogaert, sole proprietor (entrepreneur individuel, EI), trade name NEXACARE, 231 rue Saint-Honoré, 75001 Paris, France, is the controller of the processing described here. For any questions: contact@nexacare.fr. We do not sell your data and do not take any fully automated decision about you.

2. Data, purposes and retention periods

• Contact and quote requests. Name, email, activity or need, website or business name, budget, project details, chosen offer and template, date, browser type, and our exchanges, including the replies you send us by email, which are automatically linked to your request, and our internal notes. Purpose: to carry out the requested diagnostic, reply and draw up a quote. Basis: pre-contractual measures taken at your request. Retention: 3 years after the last contact.
• Client reviews. If you leave a review on our Google listing, it is published and processed by Google under its own policy, with the name of your Google account; you manage it from that account. Reviews previously submitted from the client area (rating, comment, first name and last initial, project) are published with your consent, which you can withdraw at any time on request, and kept until you withdraw your consent, or for 5 years at most. Your email address is never published. The home page may display Google reviews: they are read from Google each time they are displayed, without being kept by us, and the author's profile photo is loaded directly from Google's servers, which then receive your IP address.
• Client area and performance of the contract. Name, email, phone, company and address if you provide them, confirmation of your email address, login details (password managed by Firebase Authentication, never readable by us, or Google sign-in), projects, messages, files, deliverables, monthly results and invoices, history of the emails exchanged with us, and internal notes. The content of emails containing a sign-in link is not kept. Purpose: to carry out and track the service, to manage the client relationship, and to send the emails needed for the account and the project (address confirmation, forgotten password, notifications). Basis: contract. Retention: term of the contract then 5 years, the limitation period. If you use Google sign-in, we receive your name, email address and account identifier from Google: they are used solely to sign you in and link you to your project, are kept with your account and are neither sold nor shared, except with the providers listed in Article 3.
• Two-factor authentication. Phone number, if you enable this option. Purpose: to send you a code by text message at activation and at sign-in. Basis: your request, to secure your account. Google’s reCAPTCHA service is used to block abusive text message sends: it analyzes technical information about your device and your browsing, and may set cookies, only when a text message is requested. Retention: until the option is disabled or the account is closed.
• Device notifications. Technical subscription address provided by your browser, encryption keys and language, if you turn on this option. Purpose: to notify you of a message, an invoice or an update on your project. Basis: your consent, which you can withdraw at any time in the Security section or in your device settings. Retention: until you turn it off or sign out. The content passes, encrypted, through your browser’s notification service.
• Rate limiting. Request counter linked to your account or to a fingerprint of your email address, which is not kept in clear text. Purpose: to prevent abusive sending of security emails. Basis: legitimate interest. Retention: about 30 days.
• Visibility services. If you entrust them to us, we access your Google accounts (business profile, Google Ads, statistics) to carry out the service and prepare your reports. Basis: contract. Retention: term of the contract then 5 years.
• Event pages. Names, date, place, photos and other content you send us. They are visible to anyone who has the page’s address. Purpose: to publish the page ordered. Basis: contract. The page is taken down at the end of the hosting; the order file follows the periods applicable to the contract and to accounting.
• Newsletter and offers. Email, first name, day and month of your birthday if you provide them, account creation date, promo codes received and used, mailings and unsubscribing. Purpose: to send you our tips and offers, including birthday promo codes. Basis: legitimate interest for our clients and similar services, otherwise your consent. You can refuse at any time through the link in every email or in “My details”. Retention: 3 years after the last contact; your refusal is kept so that it can be respected.
• Business prospecting of professionals. Name of the business, contact person if known, professional email address, phone, city, website, status of exchanges, from public sources. Purpose: to present our services by an individual message. Basis: legitimate interest. Retention: 3 years after the last contact. You may object at any time by replying “stop”: your address is then excluded from any further sending.
• Accounting. Invoices and accounting records. Legal basis: legal obligation. Retention: 10 years.
• Payment. Card payments are processed directly by Stripe. We receive the payment status, never the card number.
• Audience measurement. See Article 5. Legal basis: your consent.

Automatic deletion. One week before a retention period ends, we notify you by email. You can then ask us to keep your data, which restarts the period; without a reply, it is deleted, except accounting documents and, where applicable, the file of an invoice still due.

The fields of the contact form and of the account creation form are necessary to process your request; without them, we cannot reply to you or open your access.

3. Recipients and service providers

Your data is accessible to the publisher and to the strictly necessary technical service providers, acting on our instructions or under their own terms:

• Google (Firebase: hosting, authentication, sending of text messages, database, files, functions; reCAPTCHA for two-factor authentication; Google Analytics if you accept it; fonts of the demo templates).
• Resend (Plus Five Five, Inc., United States): sending of automatic emails (address confirmation, password, notifications), of our replies to your requests, and of the emails we send you from our client follow-up tool.
• Stripe : payment of invoices by card.
• Anthropic (United States): artificial intelligence tool used to prepare quotes and carry out the services, when elements of your project are entrusted to it.
• Your browser’s notification service (Google, Apple, Mozilla or Microsoft depending on your device), if you turn on notifications.
• IONOS : professional @nexacare.fr email, including the sending of prospecting messages.
• WhatsApp (Meta): if you choose to contact us this way.

4. Transfers outside the European Union

Some of these service providers, in particular Google and Resend, may process data in the United States. These transfers are governed by the EU–US Data Privacy Framework or, failing that, by the European Commission’s standard contractual clauses, a copy of which you may request.

5. Cookies and local storage

Only with your consent, this website uses Google Analytics (Google Ireland Ltd) to measure its traffic: pages viewed, length of visit, type of device and approximate origin. These measurements are used only to improve the website; no advertising or profiling results from them. As long as you have not clicked “Accept”, no Google Analytics script or cookie is loaded. The cookies set (_ga, _ga_*) are kept for no more than 13 months and your choice is stored for 6 months in your browser. You may withdraw your consent at any time: manage cookies.

Apart from that, only strictly necessary technical storage is used (remembering your choice, sign-in to the client area and to the administration). Your language choice is also remembered in your browser. If you have not chosen one, the language of the pages is determined from the country of your IP address, by our host, without that address being recorded by us. If you install the client area as an app, or simply when you open it, your device keeps a copy of public files (styles, scripts, fonts, images) to display it faster and to indicate a lack of connection; no personal page or client data is kept there. Your choice to postpone installation is remembered for 60 days. The client area loads libraries from Google servers, and the demo templates load their fonts from them: these servers receive your IP address on that occasion, as with any web request. When a text message is requested, reCAPTCHA works as described in Article 2.

6. Security

Communications are encrypted (HTTPS). Access to projects and files is limited by account, requires a confirmed email address, and rights are checked server-side. Two-factor authentication by text message is offered in the client area. As no system is infallible, keep your login details confidential. In the event of a breach presenting a risk to you, we will inform you under the conditions set out in the GDPR.

7. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, the right to withdraw your consent at any time, and the right to set directives on what happens to your data after your death. Write to us at contact@nexacare.fr ; we reply within one month. Certain data must nevertheless be retained to comply with a legal obligation.

You may lodge a complaint with the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.

8. Changes

This policy may be updated; the date appears at the top of the page.