Privacy Policy

BV FACTORY, 16 rue des Caillères, 44330 Le Pallet, France — RCS Nantes 930 867 353. Contact for any privacy request: contact@bvfactory.dev.

• Orders — email address, products purchased, Q-SYS Core ID, discount code, payment status. Purpose: processing your order, generating and delivering your licenses, support. Legal basis: performance of the contract. Accounting records are kept to comply with our legal obligations.
• Payment and invoicing — handled by Stripe. We never receive or store your card details. Your billing name and address and, for businesses, your VAT number are collected at payment to calculate VAT and issue your invoice (legal obligation); we keep the Stripe payment and invoice references.
• Contact form and email exchanges — name, email, subject, message and any attachment, as well as the other addresses copied on your emails. Purpose: answering your request. Legal basis: our legitimate interest in handling enquiries, or pre-contractual steps taken at your request.
• Newsletter — email address and, optionally, name, together with the date and origin of your consent. Purpose: sending product news and offers. Legal basis: your consent, which you can withdraw at any time through the unsubscribe link in every email.
• Audience statistics — we count page views, plugin and manual downloads, the language of the page and the website you came from (its domain name only), without any cookie and without storing your IP address. To count visitors rather than page loads, a daily fingerprint is computed from your IP address and browser with a random key that is destroyed after 24 hours: from then on, no one — including us — can link a visit to a person. Robots and our own visits are not counted.
• Security — your IP address is used transiently, in memory, to limit abusive requests. It is not stored in our database.

We only ask for the data needed for these purposes. Providing an email address and a Core ID is required to deliver a license.

This website does not use advertising or third-party analytics cookies, which is why no cookie banner is displayed. Your browser's local storage is used only to remember your cart — strictly necessary for the service you request and never sent to third parties.

Your data is only accessible to BV FACTORY and to the service providers acting on our behalf:

• Vercel Inc. (USA) — website hosting
• Supabase — database, hosted in the European Union (Paris)
• Stripe Payments Europe Ltd (Ireland) and its affiliates — payment processing, VAT calculation and invoicing
• Resend (USA) — delivery of transactional emails, replies and newsletters

When answering your request requires it (for example a technical question involving a partner or integrator working on your project), we may forward your message to that third party, only for that purpose.

We never sell or rent your data.

Some providers are located in the United States. These transfers are covered by appropriate safeguards provided for by the GDPR, such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

• Orders and accounting records: 10 years, as required by French commercial law.
• Checkouts that were started but never paid: deleted after 30 days.
• Contact messages and drafts of our answers, with their attachments: 3 years after the last exchange (or after the last edit of a draft that was never sent). A file uploaded for a message that was finally not sent is deleted after 7 days.
• Addresses blocked as a source of unwanted email (spam): 3 years after the block, or earlier if you ask for your data to be erased.
• Newsletter: until you unsubscribe. After that we only keep your address on a suppression list so that we do not email you again.

You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, to withdraw your consent at any time, and to define instructions regarding your data after your death.

To exercise these rights, write to contact@bvfactory.dev. We answer within one month. We may ask for proof of identity if there is reasonable doubt.

You can also lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, 75007 Paris — www.cnil.fr.

Data is encrypted in transit, access to the database is restricted to our servers, and administrative access is authenticated. No system is infallible; if a breach affecting your data were to occur, we would notify you and the CNIL as required by law.

We may update this policy to reflect changes in our services or in the law. The date of the last update is shown at the top of this page.