Privacy

Baobun Studio (France) is the controller for the personal data described here. Questions go to charles@baobun.studio.

Cookies and measurement

The cookies that keep you signed in are set by Clerk, our sign-in provider, and are strictly necessary to run the service.

We also set one cookie of our own, holding a single word for where you arrived from — "google", "x", "direct". It is read once, when an account is created, and it is how we know which of the places we write about reaches anyone.

When we are trying two versions of something on our home page — a different label on a button, say — a second cookie of ours remembers which version you were shown, so it does not change under you and so the two versions can be compared fairly. It holds the name of the test and a letter, nothing else, and it is set on our own pages only.

There is no advertising pixel and no third-party tracker anywhere on this site — not on these pages, not inside the product, and not on a published customer page. Nothing about you is sent to anybody else, for marketing or otherwise.

Our home page and every published customer page do run one small script of our own. As you leave it sends a single message to our server saying how many seconds you were there, which sections of the page you scrolled to, and the labels of any links you clicked. That is the whole message. It sets nothing on your device, carries no identifier, and there is nothing in it that could be matched to you or to another visit — the figures are added to a daily count and the message is discarded. Its purpose is to tell the person whose page it is whether anybody read past the first screen.

To count how many different people visited, the visitor's address and browser are combined with a random value that changes every day and scrambled; the scrambled result is kept in memory for that day only and then discarded. While the page is open it also says "still here" every 30 seconds with a random code made when the page loads, so its owner can see how many people are on it right now. Neither is stored on your device or written to our database.

A page's owner can also try two versions of a line on their page, such as its headline or a button, to see which gets more clicks. Which version you see is worked out the same way, from your address and browser scrambled with that day's random value, so it stays the same for the day without anything being stored on your device or kept about you. The message sent as you leave then also says which version you were shown and whether you clicked the page's main button. Both are added to a daily count per version, and the message is discarded.

What we hold, and why

That a visit happened

We count arrivals as a daily tally per source — "12 from google today" — and alongside it the same shape of count for what a visit was made on, how far down the page it got, what it clicked, and how long it lasted. Numbers in a table, incremented in place: no address, no identifier, no record of an individual visit and nothing that could be traced back to you.

Where you arrived from

A single word — "google", "x", "direct" — kept from your first visit, so we know which of the places we write about actually reaches anyone. Not the page you were on, not a history of your visits: one label, written once, never updated.

Your email address

So we can send your page, answer your change requests and reach you about your subscription. Needed to perform our contract with you.

What you send us for your page

Your text, prices, images and links. We hold it to build and host your page. Some of it may be your clients' material — see below.

An email left on someone's page

Pages can have a signup form. If you leave your email on one, we store it with the day you signed up and the place you arrived from, and show it only to the owner of that page, who decides what to do with it. They are the controller; we hold it on their behalf and send it nothing. It is deleted with their page. To come off a list, ask the page's owner, or write to us and we'll remove it.

Payment details

Handled entirely by Stripe. We never see or store your card number. We receive your name, billing country, the last four digits and whether a charge succeeded.

Server logs

IP address, time, URL and user agent, written when a page is requested. Kept 14 days to find faults and block abuse, then deleted. Our legitimate interest in a working, non-abused service.

Your clients' material

Designers send us work made for other people. Where that work contains someone else's personal data, you are the controller and we act on your instructions. Do not send us anything you are not free to publish — an NDA you signed is not something we can see or check.

Who else processes it

Your page is served from a server in Germany. Where a processor transfers data outside the EU, it does so under the European Commission's standard contractual clauses.

How long we keep it

• Your page and its content: while you subscribe, then 30 days after cancellation, then deleted.
• Server logs: 14 days.
• Invoices: 7 years, because tax law requires it and we cannot delete them on request.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, ask for it in a portable form to take elsewhere, ask us to restrict what we do with it, or object to it. Email charles@baobun.studio and we will answer within thirty days, at no charge.

If you think we have handled your data badly, you can complain to your data protection authority — for us that is Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, 75007 Paris — cnil.fr.