Privacy policy

Version 2 — 13th july 2026

Data controller: Edge Query SAS (RCS Saverne 851 509 315), Lutzelhouse, France — contact@oursblanc.io.

1. Landing page visitors

No cookie or persistent identifier is used for audience measurement purposes. Measurement relies on a non-reversible technical identifier, recalculated daily from a secret salt (never stored in the browser). It covers: page opens, time spent on page, scroll depth, and clicks aggregated by page zone. This measurement falls under the CNIL "audience measurement" exemption: no consent is required and no banner is displayed for this purpose. This data is kept for a maximum of 13 months.

A session cookie and a CSRF token, strictly necessary for the technical operation of the Service, may be set when logging into a client account. These technical cookies are exempt from consent requirements and are deleted upon logout or expire automatically.

2. Contact form data

Data entered in a form on a landing page is transmitted to the client publishing the page (the "Client"), who acts as data controller under GDPR. Edge Query acts solely as a processor under Article 28 GDPR, following the Client's instructions as set out in the data processing agreement entered into with the Client.

Depending on the purpose declared by the Client for its form, the legal basis is either the performance of pre-contractual or contractual measures (Art. 6.1.b GDPR — e.g. a quote request), or the explicit consent of the data subject (Art. 6.1.a GDPR — e.g. a newsletter sign-up or subsequent commercial prospecting). The Client determines the legal basis used and the exact wording displayed under its form.

Data is encrypted at rest and hosted in the European Union, with our hosting processor Scaleway SAS (France). It is kept for a duration set by the Client, between 30 and 365 days from form submission (default duration: 90 days for this Client), after which it is anonymized. Technical proof of consent or of the request (timestamp, IP address, displayed text) is kept separately for 3 years for evidentiary purposes, independently of the data itself.

3. Customer account data

Identity, contact and billing data, processed for contract performance (Art. 6.1.b GDPR). This data is kept for the duration of the contractual relationship, then 30 days after termination to allow the Client to export it, subject to legally mandated retention periods (in particular accounting and tax obligations, 10 years for accounting records). Payments are handled by Stripe; no card data is stored by xsp.one.

4. Recipients and processors

The data described above is hosted by Scaleway SAS (European Union) and, for payments, processed by Stripe. No data is transferred outside the European Union as part of hosting. No data is sold, rented, or shared with third parties for commercial purposes.

5. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability over your data. For form data falling under a Client's responsibility, requests should primarily be sent to that Client; failing a response, or for other categories of data, write to contact@oursblanc.io. We aim to respond within one month, extendable to three months for complex requests. You may also lodge a complaint with your national data protection supervisory authority, or with the French CNIL (cnil.fr).