01Data controller
Lampion SAS, [TO BE COMPLETED]. Contact: [email protected].
Lampion has not appointed a Data Protection Officer (DPO), as this is not mandatory given its processing activities. Requests are handled at the address above.
02Data collected
| Category | Data | Source |
|---|---|---|
| Account | Name, email address, password (bcrypt-hashed), preferred language | You, at sign-up |
| Third-party sign-in | Identifier, email and name provided by Google, GitHub or your SSO provider | The identity provider |
| Organization | Organization name, role, memberships | You |
| Usage | Compute, storage and transfer volumes per project | Automatic metering |
| Billing | Billing details, invoice history | You and Stripe |
| Audit log | Actions performed in the console, timestamp, user identifier | Automatic |
| Technical | IP address, error and access logs | Automatic |
Lampion never accesses the content of your databases. Metering measures volumes, not data.
03Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage your account, deliver the service | Performance of a contract (art. 6.1.b) |
| Confirm your email address and secure sign-up | Legitimate interest — abuse prevention (art. 6.1.f) |
| Meter consumption and bill | Performance of a contract (art. 6.1.b) |
| Issue and retain invoices | Legal obligation (art. 6.1.c) |
| Log actions (audit, security) | Legitimate interest — security (art. 6.1.f) |
| Answer support requests | Performance of a contract (art. 6.1.b) |
| Send product news | Consent (art. 6.1.a), withdrawable at any time |
04Recipients and sub-processors
| Sub-processor | Role | Location |
|---|---|---|
| Scaleway SAS | Hosting of the service and databases | France |
| OVH SAS | Data plane hosting | France |
| Cloudflare, Inc. | Marketing site hosting, network protection | Outside the EU — standard contractual clauses |
| Stripe Payments Europe, Ltd. | Payment and invoicing | Ireland (EU) |
| Resend | Transactional email delivery | Outside the EU — standard contractual clauses |
| Grafana Labs | Technical monitoring (metrics and logs) | Outside the EU — standard contractual clauses |
No data is sold or transferred to third parties for commercial purposes.
05Retention periods
| Data | Period |
|---|---|
| Account and organization | Until the account is deleted |
| Databases and backups | Deleted within 30 days of account deletion |
| Audit log | 12 months |
| Technical logs | 14 days |
| Invoices and accounting records | 10 years (legal obligation, art. L.123-22 French Commercial Code) |
06Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability set out in articles 15 to 22 of the GDPR.
Account deletion is available directly in the console and triggers effective erasure of the associated data. For any other request: [email protected]. Lampion responds within one month.
You may lodge a complaint with the CNIL (French data protection authority), 3 place de Fontenoy, 75007 Paris — cnil.fr.
07Security
Encryption in transit (TLS), bcrypt-hashed passwords, organization isolation, role-based access control, logging of sensitive actions, and hardened authentication for administrative access.
Technical and organizational measures are detailed in the DPA.