Privacy Policy

1. Data controller and contact

The data controller is the publisher of the Erasr service (“Erasr”). For any question about your personal data or to exercise your rights, write to support@erasr.me — the address also listed on the Contact page of your dashboard.

2. Data collected

• Account: the email address you signed up with.
• Rights-enforcement identity: first and last name, aliases or maiden name, date of birth, postal addresses (current and previous), phone number, alias email addresses. This data is indispensable: it lets brokers identify your data, which is a condition of your demands' validity.
• Demand history: targeted brokers, sending dates, statuses and replies received.
• Billing: handled by Stripe; Erasr keeps neither card numbers nor bank details.
• Analytics and logging: anonymized visit statistics (cookieless) and technical logs required for security and troubleshooting.

3. Purposes and legal bases

• Preparing, sending and tracking your erasure demands: performance of the contract (Art. 6-1-b GDPR).
• Security, abuse prevention and error monitoring: legitimate interest (Art. 6-1-f GDPR).
• Billing and accounting obligations: legal obligation (Art. 6-1-c GDPR).
• Newsletter: consent, revocable at any time via the unsubscribe link (double opt-in).

4. Recipients: the data brokers

The very purpose of the service is to send your demands to data brokers: the identity elements listed in section 2 are therefore transmitted to the targeted brokers, in the body of the demand email sent in your name, so that your data can be identified and deleted. Those brokers are recipients within the meaning of the GDPR, not processors of Erasr.

5. Processors

Erasr uses technical providers that process data on its behalf, under contracts governing the processing:

• Supabase (authentication and database, EU hosting),
• Stripe and Stripe Managed Payments — Stripe acts as merchant of record for transactions — (payment and billing),
• Resend (sending emails and receiving brokers' replies),
• Inngest (deferred execution of sendings),
• Sentry (error monitoring),
• Umami (cookieless analytics, hosted in the European Union),
• as well as a professional cloud host for the service itself.

6. Analytics and cookies

Erasr uses Umami, a cookieless analytics solution: no tracker is placed on your device, no browsing data is sold or shared for advertising purposes, and IP addresses are not retained in an identifiable way. No consent is therefore required for this measurement.

7. Retention periods

• Identity data and demand history: for the life of the account, then deleted at the latest 12 months after closure, unless retention is required by law.
• Invoices: 10 years (accounting obligations).
• Technical logs: limited to what security and troubleshooting require.

8. Your rights and how to exercise them

You have rights of access, rectification, erasure, portability, restriction and objection regarding your data. To exercise them, write to support@erasr.me from your account's email address, stating your request; we respond within one month at most.

Deleting your account results in the erasure of your identity data and demand history within the same timeframes, subject to statutory retention obligations. You may also lodge a complaint with the CNIL (cnil.fr).

9. Security

Communications are encrypted in transit, data is encrypted at rest, access to data is limited to the strict needs of the service, and technical secrets are managed separately. In the event of a data breach likely to pose a risk to your rights, you would be informed in accordance with the GDPR.

10. Changes to this policy

This policy may be adapted to the evolution of the service or of regulation; the last-updated date appears at the top of the page. These provisions are governed by French law, in accordance with the Terms and Conditions.