Privacy policy

This policy explains what personal data collabas.com collects, why we collect it, who else handles it and what you can ask us to do about it. It covers this website only.

In short: the personal data this site collects is what you type into the enquiry form and choose to send us, what you give us when you buy a template, plus audience measurement if — and only if — you accept it. There is no advertising, no profiling and no newsletter, and we do not sell or rent anyone’s data.

Who is responsible

The controller is Collabas, a French société par actions simplifiée (SAS), registered office 24 Résidence le Trimaran, 11370 Leucate, France. Its full registration details are in the legal notice.

We have not appointed a data protection officer — we are not required to. Privacy questions and requests go to contact@collabas.com, which reaches the two of us directly.

What we collect

Your enquiry

The enquiry form asks for your name, your email address, what you would like help with, and a description of the project. You can also add your company or project name and a link to an existing website. Nothing else is asked, and nothing is filled in behind the scenes.

Sending an enquiry is entirely up to you, and there is no consequence to not sending one. Those first four answers are the ones the form requires, because without a name, a way to reply and some idea of the project there is nothing for us to answer; everything after them is optional.

The guided brief, if you use it

After sending an enquiry you can answer a set of optional questions about the project: what you are building, its goals and audience, the scope and features you have in mind, what material you already have, when you would like to launch, and the investment range you are considering. Every question is optional and you can stop at any point. Some answers — the budget range and the timing, for instance — are commercial rather than personal, but they are attached to your enquiry and so are covered by this policy.

Documents you attach, if you attach any

You can upload up to 5 supporting files of up to 15.0 MB each — a brief, requirements, a sitemap, wireframes, a presentation. We do not open them looking for personal data, but whatever they contain reaches us with them, which is why we ask you not to attach anything confidential that is not yours to share.

If you buy a template

Our checkout asks for the email address the template should be delivered to, and for your two confirmations: that you accept the licence and the terms of sale, and that you ask for delivery before the withdrawal period ends and give up the right of withdrawal. We record those confirmations with the date and time and the versions of the documents you accepted, because they are the proof the law asks us to be able to give.

You then pay on a page run by Stripe, where you give your name, billing address and payment details. Those go to Stripe, not to us. Once the payment is confirmed, Stripe tells us your name, email address, billing country and the amount paid, and we add them to your order. We never see or store your card details.

Technical data

Like every web server, ours records the requests it receives. Those technical logs include IP addresses, and they are kept in our own hosting project rather than by Google on its own account.

When you submit an enquiry your IP address is also counted, briefly and in the server’s memory only, so that a single connection cannot flood the form. It is not written to a database, not attached to your enquiry and not sent to anyone.

Audience measurement, if you accept it

We use Google Analytics to understand how the site is used — which pages are read, how visitors arrive, roughly which country or region they are in, and what kind of device and browser they use. Google derives the approximate location from the IP address and does not report the address itself to us.

It runs only if you accept it. Until you do, nothing is requested from Google and no analytics cookie is written — refusing, or simply ignoring the question, means it never runs at all. You can change your answer at any time with “Manage cookies” in the footer. The cookie policy lists the cookies involved and how long they last.

This measurement tells us how the site performs. It is not used to identify you, to build a profile, or for advertising of any kind, and it is never combined with an enquiry you send us.

Why we use it, and on what basis

To answer your enquiry — reading it, asking follow-up questions, judging whether the project is one we can do well, and preparing a proposal. This is processing carried out at your request before any contract, under Article 6(1)(b) GDPR.
To sell you a template — recording your order and your confirmations, delivering the template, sending your install link and answering questions about your purchase. This is necessary to perform the contract you enter into at checkout, under Article 6(1)(b) GDPR.
To keep a record of enquiries — so that we recognise you if you come back, do not lose an ongoing conversation, and can show how an engagement began. Where no contract follows, we rely on our legitimate interest in managing and following up on business enquiries, under Article 6(1)(f).
To keep the form working and unabused — the rate limiting described above, and the checks on uploaded files. Our legitimate interest in the security of the site, under Article 6(1)(f).
To meet our legal obligations — once you become a client, accounting and commercial record-keeping under French law, under Article 6(1)(c).
To measure how the site is used — your consent, under Article 6(1)(a), given through the banner and withdrawable at any time from “Manage cookies” in the footer. This is the only thing on this site we ask your permission for.

We do not ask you to consent to the rest of it, because consent is not the right basis for answering a message someone chose to send us — and a form that made you tick a box before it would reply would be asking for permission it does not need.

We do not send marketing emails, we run no newsletter, and we do not use your enquiry to build a profile or to make any automated decision about you.

Who else handles it

These providers process personal data on our behalf, under contracts that require them to act only on our instructions and to protect it:

Google Cloud — Google Cloud France, established in France, as part of the Google group. Hosts this website, runs the server that receives enquiries, and stores the enquiry record and any documents you attach, in France. Keeps the technical logs any web server keeps.
Google Analytics — Google Ireland Limited, established in Ireland. Measures how the site is used — pages viewed, roughly where visitors come from, which device and browser they use. It runs only for visitors who have accepted it, and never before.
OVHcloud — OVH SAS, established in France. Runs the mailbox your enquiry is sent to and the one we reply from, so the enquiry and everything we write back pass through and rest on its mail servers.

What reaches those providers is your name, your email address, and the content of your enquiry, your brief answers and any files you attached: the record is stored in our own Google Cloud project, and the same details are emailed to our mailbox so that we see them. Your IP address and your browser details are sent to neither.

Payments. When you buy a template, Stripe processes your payment through its Managed Payments service, in which Link, a Stripe service, is the merchant of record. For that payment, and for the tax, receipts, fraud checks and disputes that come with it, Stripe acts as a separate controller under its own privacy policy, not on our instructions. Stripe may process data outside the European Economic Area, under the safeguards that policy describes.

Webflow. The install link we send you opens Webflow, which installs the template into your own Webflow account. We do not send Webflow your details; what Webflow processes when you sign in or create an account is governed by its own privacy policy.

Beyond the providers listed above, we share personal data with no one. We do not sell it, rent it or trade it, and we pass it to public authorities only where the law requires it.

Where it is processed

Google Cloud. Google acts as our processor under its Cloud Data Processing Addendum. Where processing or technical support takes place outside the European Economic Area, that addendum applies the European Commission’s standard contractual clauses. Read Google Cloud’s data processing terms.

Google Analytics. Google acts as our processor under its data processing terms for Google Analytics, which apply the European Commission’s standard contractual clauses where analytics data is handled outside the European Economic Area. Read Google Analytics’s data processing terms.

OVHcloud. OVH SAS is established in France and provides the mailbox from its European infrastructure, so an enquiry does not leave the European Economic Area in the ordinary course of being received and answered. Where OVHcloud processes personal data outside the EEA — technical support, for instance — its data processing agreement applies the European Commission’s standard contractual clauses. Read OVHcloud’s data processing terms.

You can ask us for a copy of the safeguards any of these transfers rely on, by writing to contact@collabas.com.

How long we keep it

The enquiry record itself: deleted automatically two years after you send it. That is a rule the database applies on its own, not a note in a calendar — the record carries its own expiry date from the moment it is written.
Documents you attach: deleted automatically one year after they are uploaded, which also stops the download links in our own notification emails from working.
Our correspondence with you: the enquiry also arrives in our mailbox, and what we write back lives there. If it does not lead to work we delete that two years after your last contact, matching the record itself. The CNIL allows three years for prospect records; we keep less, because there is no reason to hold an unanswered conversation longer than the enquiry behind it.
If the enquiry becomes a project: we keep the correspondence for as long as we work together and then three years from the end of that relationship, which is shorter than the five years French law allows a contractual claim to be brought in. Invoices and accounting records are a separate matter — French commercial law requires ten years, so those are archived for that period and used for nothing else.
Orders: your order — the email address, the confirmations you gave at checkout and the payment details Stripe reports back — is kept for ten years from the purchase. It is the record behind our accounts, and the proof of what you agreed to, and French commercial law requires records of that kind to be kept for ten years. The order emails in our mailbox are kept for the same period. Stripe keeps its own payment records under its own policy.
Server logs: the site runs in our own Google Cloud project, so the request logs belong to us rather than to Google. They are kept for the period configured on that project’s log storage — Google’s default is 30 days — and used only to keep the site running and secure.
Rate-limiting counts: a few minutes, in memory, and gone when the server restarts.
Analytics: the cookies expire after 13 months and are not silently renewed; the statistics Google holds for us are kept on the retention period set on our Analytics property. Refusing, or withdrawing your acceptance, clears those cookies from your device.

You can ask us to delete your enquiry sooner, and we will unless we are required to keep it.

Your rights

Under the GDPR you can ask us to:

tell you what we hold about you, and give you a copy;
correct anything inaccurate or incomplete;
delete it;
restrict what we do with it while a question about it is being resolved;
stop processing that rests on our legitimate interest, by objecting to it — we will stop unless we have compelling grounds not to;
hand you, or another provider, the data you gave us in a portable format, where we process it by automated means for the purposes of a contract or steps leading to one;
and, for analytics, withdraw your consent whenever you like — “Manage cookies” in the footer, as easily as it was given. Withdrawing does not undo measurement that already happened, which is the only thing withdrawal cannot do.

Write to contact@collabas.com and we will reply within one month. We may need to check that the request comes from you before acting on it.

If you are not satisfied with how we handle it, you can complain to the CNIL, the French data protection authority: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr.

Security

The site is served over HTTPS and the enquiry endpoints validate and size-limit everything they receive. Uploaded files are checked against their declared type before they are stored, and the reference the browser carries between the steps of the enquiry is signed, so an enquiry cannot be read or added to by someone who did not create it. Access to the enquiry records and to the mailbox is limited to the two of us.

Changes to this policy

If what we do with personal data changes, this page changes with it, and the revision date at the top will tell you when. If the change is significant we will say so here rather than leaving you to spot it.

Contact

Collabas, 24 Résidence le Trimaran, 11370 Leucate, France — contact@collabas.com.