1.Data controller
Jérôme Buisine, sole trader (SIRET 822 432 902 00044), whose registered office and contact details appear in the legal notice, is the controller for the processing described below. Contact: contact@subalpine.it.
2.Data processed
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address | Create the account, send sign-in codes, notify a moderation decision | Performance of the Terms | Until the account is deleted, and at most 24 months after the last sign-in — an email warns you 30 days before |
| Nickname | Publicly attribute contributions | Performance of the Terms | Until the account is deleted, and at most 24 months after the last sign-in |
| Sign-in code (hashed) and IP address of the request | Send the code, prevent bulk email from a single machine | Legitimate interest — security of the service | 24 hours |
| Session tokens (hashed) | Keep you signed in without asking for a code every visit | Performance of the Terms | 30 days, revocable on sign-out |
| Contributions: places, votes, attached orders | Make the map work | Performance of the Terms | Places and orders kept, detached from the account when it goes; votes leave with it |
| Visit fingerprint (see article 3) | Measure traffic in aggregate | Legitimate interest — understanding use of the service | No longer re-identifiable the next day |
| Web server logs: IP address, page requested, browser | Security, incident diagnosis, abuse prevention | Legitimate interest | 14 days |
3.Traffic measurement that cannot follow you
Counting visits without setting a cookie or keeping an IP address takes a detour. Here it is, in plain terms.
On each visit, the server computes a fingerprint from your IP address and a very coarse version of your browser, mixed with a secret that changes every night. Only that fingerprint is recorded, with the date and a counter. Neither the address nor the browser is kept, and the fingerprint cannot be used to recover them.
The consequence is deliberate: today’s fingerprint matches no fingerprint from yesterday. Nobody — not even us — can link two visits made on two different dates. That is what makes the measurement harmless, and it is also its limit: over a month, one person coming back on ten days counts as ten. The dashboard therefore speaks of “visitor-days”, not people.
Since 17 August 2026, this counting is handled by Umami, open-source software installed on our own server — not a third-party service. The script and the address receiving the statistics are served by this domain: no request goes anywhere else. The principle is the one described above, and it is verifiable: the database schema contains no IP address column, and the fingerprint is specific to each site — moving from ForPet to another SubAlpine product produces two unrelated identifiers. Retention: 25 months at most.
4.Session recording, which does ask for your consent
ForPet can record what you do on screen — pointer movements, scrolling, typing — to understand where the app gets stuck. Displayed text is masked as it is captured, but the technique remains of a different nature from the counting described above: no exemption applies to it, so it rests on your consent.
Nothing starts without your explicit consent. This is not a declaration of intent: the recording script is a separate 190 KB file, and until you accept, it is not even downloaded. Declining therefore does not mean “collect then discard” — there is nothing to discard, and declining also spares you the download.
If your browser sends Global Privacy Control or Do Not Track, you are never asked: you have already answered.
Recordings are kept for 30 days, then erased automatically. Withdrawing is exactly as simple as consenting and is done right here, without an account — it takes effect immediately, the page reloading to interrupt any capture in progress.
Help improve the app
Optional, with no effect on the service. Stopping reloads the page. Recordings already sent remain until they are erased automatically, thirty days later.
5.What we do not do
- No cookies, no local storage for tracking purposes.
- No third-party analytics tool, no pixel, no ad network.
- No sale, rental or sharing of your data for commercial purposes.
- No profiling, no automated decision producing legal effects.
- No font, map or script loaded from a third-party server: everything is served from our own infrastructure, including address search and route calculation — what you look for does not leave here.
6.Recipients
Your data is accessible only to the publisher and, for pending entries alone, to the service’s moderators — who see the author’s nickname, never their email address. The processors are as follows:
| Processor | Role | Data concerned | Location |
|---|---|---|---|
| OVH SAS | Server hosting and email delivery | All service data | France |
All data is hosted in France. No transfer outside the European Union takes place.
7.What is public
The places you submit, the orders you attach and the nickname that signs them are visible to everyone. Your email address never is. Nor are your individual votes: only aggregate totals appear.
8.Your rights
You have rights of access, rectification, erasure, restriction, objection and portability, as well as the right to give directions on what happens to your data after your death.
Two of them can be exercised directly from your settings, without writing to us: correcting your nickname and deleting your account. Deletion erases the account and the votes; places and orders are kept but detached from you — other users rely on them, and removing them would impoverish information the community has confirmed.
Erasure also happens without you in the end. After 24 months without a sign-in we no longer have a reason to keep your address: an email warns you, and if we hear nothing back the account is deleted 30 days later, exactly as if you had done it yourself. Signing in again cancels the notice, and there is nothing else to do.
For everything else, write to contact@subalpine.it. You will get an answer within one month. If the answer does not satisfy you, you can lodge a complaint with the French data protection authority, the CNIL.
9.Security
Exchanges are encrypted end to end with TLS. There is no password to steal: signing in relies on a single-use code, valid for ten minutes, stored only in hashed form. Session tokens are hashed in the database too, and renewed on each use, so that an intercepted token stops working as soon as its rightful holder uses it.
10.Changes
This policy may change along with the service. The applicable version is the one published on this page; its effective date appears at the top. A substantial change is announced in the application.