Privacy Policy

This policy covers this marketing website only. The site does not sell products online, create user accounts, run advertising trackers, or profile visitors. The meaningful data flows are newsletter email, basic hosting logs, privacy-friendly analytics, and small technical browser storage used to keep the interface from being annoying.

1. Controller and contact

The data controller is IAGA, a société par actions simplifiée registered with the RCS Paris under number 106 510 019 (SIREN 106 510 019; SIRET 106 510 019 00016), with a share capital of €99.99 and registered office at 16 ter rue du Moulin Vert, 75014 Paris, France (EUID: FR7501.106510019). For privacy requests, email info@iaga.tech. This is the privacy contact; no Data Protection Officer is currently appointed or claimed.

2. Newsletter

• What: the email address you submit.
• Purpose: to send occasional IAGA Sentinel updates.
• Legal basis: consent (Article 6(1)(a) GDPR).
• How it works: after you submit the form, your address, delivery metadata, and the confirmation message are processed by Resend solely to deliver a confirmation link. Submitting the form does not add you to the newsletter. Opening the link only shows a confirmation button; we notify our team only after you press it, so an automatic mailbox scan cannot subscribe you. The team then manages the list manually; this website does not maintain a newsletter database or user account.
• Retention: we keep the email until you unsubscribe or ask us to remove it. We may also remove inactive or invalid addresses during list hygiene. We keep the internal confirmation message, which records your address and the time you confirmed, for as long as you stay subscribed and for three years afterwards, because Article 7(1) GDPR requires us to be able to demonstrate that consent was given. Delivery data handled by Resend follows its service terms and DPA; when you unsubscribe, we remove you from our list and request processor-side deletion where applicable.

To unsubscribe, use the unsubscribe option your mail client offers on our emails, reply to any newsletter email, or write to info@iaga.tech. Replies reach a monitored address. Withdrawal does not affect processing that happened before withdrawal.

3. Analytics

We use Plausible Analytics to understand aggregate site usage: page views, referrers, countries, devices, browsers, and similar high-level metrics. Plausible is cookieless, does not use persistent browser identifiers, does not track visitors across sites or devices, and does not build advertising profiles. We rely on legitimate interest (Article 6(1)(f) GDPR) to run these minimal, privacy-friendly statistics so we can improve the website. Aggregate statistics are retained for the period published for our current Plausible plan (three years on Starter and Growth, five years on Business, or the period agreed for Enterprise) and may be deleted earlier. See Plausible's plan and retention information.

4. Technical storage

We do not use advertising cookies or analytics cookies. The website uses local browser storage only for technical interface state:

• iaga_nl in localStorage remembers whether the newsletter popup was dismissed or whether a confirmation email was requested, so we do not keep showing it. A dismissal suppresses the popup for 30 days; the value stays in your browser until you clear your site data.
• iaga_nl_shown in sessionStorage remembers that the newsletter popup was already shown during the current visit. It is discarded when you close the tab.

These values are not used for advertising, cross-site tracking, or profiling. They are technical preferences for this site only, which is why the site shows no cookie banner: there is nothing here that requires consent under Article 5(3) of the ePrivacy Directive.

5. Hosting and providers

We rely on a small number of providers and do not sell personal data.

• Railway hosts the website and may process technical hosting data such as IP address, request metadata, and security logs. Those logs exist to keep the site available and to investigate abuse. Railway publishes a plan-based rolling retention period of seven days for Trial/Hobby, 30 days for Pro, and up to 90 days for Enterprise; we do not copy those logs elsewhere or use them to profile visitors. Railway Corporation is a US company; relevant transfers and processing are covered by its Data Processing Addendum and Standard Contractual Clauses where required.
• Resend delivers newsletter confirmation and notification emails. It processes the recipient address, delivery metadata, and message content. Resend is US-based and its Data Processing Addendum includes Standard Contractual Clauses for EU-to-US transfers. This site sends plain-text messages and does not add tracking pixels or link rewriting; those options must also remain disabled in the Resend domain settings.
• Plausible Analytics provides cookieless, aggregate analytics and is hosted in the EU. Its script is loaded from plausible.io; its data policy describes the limited data it processes.

That list is exhaustive. Fonts, images, and application code are served from this site's own domain; the only third-party browser script is the disclosed Plausible script. Loading a page therefore exposes connection data to Railway and Plausible, while newsletter operations send the data described above to Resend. Our Content Security Policy restricts third-party connections to these disclosed services. You may request more information about, or a copy of, the applicable transfer safeguards by writing to info@iaga.tech.

6. Your rights

Under the GDPR, you may request access, rectification, erasure, restriction of processing, objection, data portability, and withdrawal of consent. To exercise these rights, email info@iaga.tech.

You may also lodge a complaint with a supervisory authority. Because IAGA is established in France, the competent authority is the CNIL (cnil.fr).

7. Changes

We may update this policy from time to time. The date at the top reflects the latest version.