Privacy policy

This is a courtesy translation. The French version prevails in the event of any discrepancy: Politique de confidentialité.

This page says which personal data we collect, why, how long we keep it and how to exercise your rights. The site’s legal notice is on the Legal notice page.

Data controller

Controller

Cabestian, a French simplified joint-stock company (société par actions simplifiée) with a single shareholder and share capital of €5,000

Registered office

57 rue de l’Ouest, 75014 Paris, France

Registration

130 291 610 R.C.S. Paris

President and publication director

Maxime Lhuillier

Contact for any question about your data

contact@cabestian.com

Processing activities

For each one: what we collect, why, on what legal basis, for how long, and who receives the data.

1. Contact form

• Data: email address, name (or organisation), situation chosen, message, and role and organisation if you give them.
• Purpose: to read and answer your request.
• Legal basis: pre-contractual steps taken at your request (GDPR art. 6.1.b) where your request concerns a service; otherwise our legitimate interest in answering people who write to us (art. 6.1.f).
• Retention: the time needed to handle the request, then three years from the last contact. A request with no follow-up is kept three years from the last contact.
• Recipients: Cabestian; Resend, which delivers the message to our mailbox; Vercel, which hosts the function that receives the form.

The “Contact” button in the navigation bar opens a plain “mailto” link: in that case, nothing passes through the site.

2. Cab-Club sign-up, with double confirmation

The Cab-Club form asks for a name and an email address, and a company and job title if you wish to give them. The name and address are used to open access to the Cab-Club and to answer you. Access to the Cab-Club does not depend on the monthly letter.

An optional tick box, not pre-ticked, lets you ask for the monthly letter. If you tick it, we send you a confirmation email with a link. Nothing is entered in the mailing list until you click that link, and the request reaches our contact@ mailbox only after that click. The link expires after 7 days. After the click, we send you a welcome email.

• Data: name or first name, email address; company and job title if you give them; if you ask for the letter, the date and version of the text you agreed to, and the dates of confirmation, reminder and unsubscription.
• Purpose: to open access to the Cab-Club and answer you; if you ask for the letter, to keep the list of people who asked for it and confirmed.
• Legal basis: for the letter, your consent (GDPR art. 6.1.a), given by ticking the box and then confirmed by a click in an email. You may withdraw it at any time, without affecting what was done before.
• Retention:
  • letter subscriber: three years after your last confirmation. We then email you “do you want to stay?”. Without an answer within 30 days, we delete your address;
  • unsubscribed: your address alone is kept three years after unsubscription, so as not to resubscribe you by mistake, then deleted.
• Recipients: Cabestian; Resend (contact list and email delivery); Vercel (hosting of the pages and of the sign-up function).

3. Monthly letter

• Data used: email address and first name, taken from the mailing list.
• Purpose: to send you at most one email a month about the Cab-Club (articles, tips, videos).
• Legal basis: your consent (GDPR art. 6.1.a).
• We do not measure opens or clicks in our emails.
• Retention: that of the list (see point 2).
• Recipient: Resend, for delivery.

4. Proof of consent

• Data kept: date of the request, version of the text accepted, date of confirmation.
• Purpose: to be able to show that you consented, in case of a dispute.
• Legal basis: our legitimate interest in keeping proof of our obligations (GDPR art. 6.1.f).
• Retention: the length of your subscription, then five years after it ends. Before your contact is deleted at Resend, this proof is archived outside Resend.
• Recipients: Cabestian; Resend, which hosts the list.

5. Audience measurement

The site loads Vercel’s audience measurement tool, served from our own domain. We use it to know which pages are read. Legal basis: our legitimate interest (GDPR art. 6.1.f). Recipient: Vercel.

6. Booking an appointment with Cal.com

The appointment buttons open a Cal.com booking window. What you enter there (identity, email address, time slot, answers you add) is received and processed by Cal.com, not by our function. Purpose: to arrange an appointment with you. Legal basis: pre-contractual steps taken at your request (GDPR art. 6.1.b). Cal.com’s terms govern this processing.

Who receives your data

Three providers are involved:

Resend

Email delivery (contact notification, confirmation email, welcome email, monthly letter) and the Cab-Club contact list. The cabestian.com sending domain is configured there in region eu-west-1 (Ireland), according to a check made on 12 October 2026.

Vercel Inc.

Site hosting, contact and sign-up functions, audience measurement.

Cal.com

Appointment booking.

Your data is neither sold, nor rented, nor passed on for advertising purposes. Vercel Inc. is established in the United States: data may therefore be processed outside the European Union.

Storage in your browser

The site sets no cookie. It uses your browser’s local storage (localStorage) and session storage (sessionStorage) for the keys below. They stay on your device, and the site sends them to no server.

cabLang

The language chosen, fr or en. It is set when you switch language and stays until you clear the site data.

cabclub

A marker showing that you submitted the Cab-Club form. It stays until you clear the site data.

cabclub-consentement

The date and version of the text you agreed to. This key is set only if you tick the monthly letter box. It stays until you clear the site data.

cabclub-annonce

A marker showing that you closed the Cab-Club announcement. It stays until you clear the site data.

cabIntroVue

A marker showing that the intro animation has already been shown to you. It is kept in session storage and disappears when you close the tab.

The Cal.com booking window is a third-party service, which follows its own rules.

Your rights and how to exercise them

You have the right to:

• access the data concerning you;
• have it rectified;
• have it erased;
• ask for its restriction;
• object to its processing;
• receive it in a structured format (portability), for data you gave us on the basis of consent or a contract;
• withdraw your consent at any time, without affecting what was done before;
• set directives on what happens to your data after your death.

For the Cab-Club letter, click the unsubscribe link in any email: your address is removed from mailings at once, and full deletion follows the retention periods above. For any other right, or if you prefer, write to contact@cabestian.com. We may ask for reasonable proof of identity if in doubt. We answer within one month of the request, extendable by two months if the request is complex.

You may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, 75007 Paris, cnil.fr.

Minors

The site and the Cab-Club are meant for professionals. They are not meant for minors, and we do not knowingly collect data from them.

Security

• Confirmation and unsubscription links carry a signed token (HMAC-SHA256) with an expiry date: 7 days for confirmation, 400 days for unsubscription. Each token opens only the action it was issued for.
• The token is signed, not encrypted: it contains your address, first name and language, which you already know. It is sent only to your address.
• No sign-up is entered in the list before you click the confirmation link.
• After the click, the result page does not keep the token in its address.
• The form is protected against bots by a hidden field and a proof of work.
• The signing secret and the sending API key are sensitive variables on the host, outside the code repository.
• Data travels over HTTPS.

Changes to this policy

We update this policy when our processing or the law changes. The date of the last update appears at the top of the page. When a change affects processing based on your consent, we ask for your consent again before applying it.