Privacy Policy

Who is responsible

The data controller is Dylan Merigaud EI, a French sole proprietorship (entrepreneur individuel) registered under SIREN 834 511 768, 173 rue de Courcelles, 75017 Paris, France. It runs wedpalette and the business outreach described below. For anything in this policy, including the rights listed below, write to hello@wedpalette.com; a person answers.

What is collected, why, and on what legal basis

What is on this site. wedpalette has no accounts and no login. Your quiz answers (yours and your partner's) and the finished board are stored in our database: they are what your private link opens. Any photos you add to the quiz are analyzed in the moment to read colouring only, then discarded: they are never uploaded to storage and never saved. The only thing kept from a photo is the short written description of colouring the analysis produces, stored with your answers. Anthropic's AI writes your board from your answers. After payment, Resend sends you the email holding your private link. Legal basis: the contract you enter into when you buy (Article 6(1)(b)).

Visiting the site. Vercel serves the pages and, like any web host, processes your IP address and browser details to deliver them and keep the site secure. Legal basis: our legitimate interest in running a working, secure site (Article 6(1)(f) GDPR).

Audience counts. Vercel Web Analytics counts pageviews without any cookie: a visit is recognized by a hash of the request that is discarded after 24 hours. Legal basis: our legitimate interest in knowing which pages are read (Article 6(1)(f)).

Product analytics. PostHog records pageviews, interaction events and error reports for every visitor, and screen recordings ONLY on public pages such as the home page, the guides and the palette pages: recording is switched off for the whole quiz, for the checkout return and for your board, so your answers, your names and your photos are never in a recording. In the European Union, the EEA and the United Kingdom, a banner asks first: if you accept, PostHog sets its cookie on the basis of your consent (Article 6(1)(a)), which you can withdraw at any time from the Cookie settings link on the site; if you decline, it counts the visit with a rotating hash and no cookie, on the basis of our legitimate interest (Article 6(1)(f)). Everywhere else, PostHog sets its own first-party cookie from your first visit, on the basis of our legitimate interest (Article 6(1)(f)). Errors thrown by our own servers are reported to PostHog for every visitor, since that happens on our side and stores nothing in your browser.

Buying. If you buy wedpalette, payment is taken by Stripe on its own checkout page; your card number never reaches us. We receive your name, email address, billing address and country, what you bought and the amount, and we use them to deliver what you bought and to issue your invoice. Legal basis: the contract you enter into (Article 6(1)(b)) and, for the invoice and its accounting record, our legal obligation (Article 6(1)(c)).

Writing to us. Mail sent to hello@wedpalette.com is received by Cloudflare Email Routing and forwarded to our Google Workspace mailbox, where a person reads and answers it. Legal basis: our legitimate interest in answering you (Article 6(1)(f)), or the contract when you write about a purchase (Article 6(1)(b)).

Nothing is sold or rented, and nothing is put on a marketing list. Your photos are never stored. Beyond the US-scoped ad measurement described below, there is no other advertising use and no profiling. Legal basis for that ad measurement: our legitimate interest in knowing which ads bring buyers (Article 6(1)(f)).

Ad measurement, scoped to where the ads run

wedpalette advertises only in the United States, and its Meta ad measurement is scoped to match. The Meta Pixel loads only for visitors whose device places them in the Americas: visitors in Europe never receive its script or its cookies, so Meta never asks a consent question of its own (the PostHog banner above is a separate, analytics-only choice). When a purchase completes, a hashed (irreversible) copy of the buyer's email is sent to Meta so the purchase can be attributed to the ad that brought them, and only when the billing country at checkout is the United States.

If we contacted you

wedpalette itself writes to no one: it sells to couples who come to the site. Dylan Merigaud EI does write to businesses by email to offer its other products; if you received one of these messages, this section is for you.

Where your details came from. Your name, job title, company and business email address come from public sources: public registers, licensing lists and filings, your company's own website and business directories. Some addresses come from the B2B contact databases Prospeo and Apollo.io. Before a first message, an address no source had verified is checked with an email verification service (Reoon Email Verifier, or the checks built into Prospeo and Apollo.io), so that we do not write to a mailbox that does not exist. We do not write to an address guessed from a naming pattern.

What we hold. Your name, job title, company and business email address, the result of its verification, your company's public details (website, location, and the public record that made it relevant to us), and the dates and content of the messages we exchanged.

Legal basis. Our legitimate interest in offering a business a product related to its activity (Article 6(1)(f) GDPR). We write to you about your professional role only, in a short sequence that any reply ends.

Your right to object. You can object at any time, without giving a reason: reply to any of our messages or write to hello@wedpalette.com. We stop writing to you, and your address goes on our suppression list, which every later message is checked against.

How long. Your record is kept 3 years after our last contact with you, then deleted. If you object, we keep only your address on the suppression list, so that the objection holds.

Who handles it for us. Neon (our database), Google Workspace (the mailboxes our messages leave from and replies arrive in), Prospeo, Apollo.io and Reoon (finding and verifying addresses), GitHub (a private backup of our records), OVHcloud (the server that runs our tools), Anthropic (the Claude AI assistant that helps us draft messages and read replies) and Telegram (a notification on our own phone when a reply asks for something). Where each one is, and how a transfer outside the EU is covered, is in the next section.

Who receives it, and transfers outside the EU

The controller is in France. These services receive the data described above, each holding only what its task needs.

Vercel Inc. (hosting and audience counts, United States): certified under the EU-US Data Privacy Framework, with standard contractual clauses in its data processing terms.

PostHog, Inc. (product analytics, United States): certified under the Data Privacy Framework, with standard contractual clauses.

Anthropic Ireland, Limited (the AI that writes your board; processing in the United States): standard contractual clauses. It does not train on your answers and deletes them within 30 days.

Databricks, Inc., which runs Neon (the database holding your answers and board, United States): certified under the Data Privacy Framework, with standard contractual clauses.

Plus Five Five, Inc., which runs Resend (sends the email with your board link, United States): certified under the Data Privacy Framework, with standard contractual clauses.

Meta Platforms, Inc. (ad measurement in the Americas only, United States): certified under the Data Privacy Framework.

Stripe Payments Europe, Limited (payments, Ireland), which relies on Stripe, LLC in the United States: certified under the Data Privacy Framework, with standard contractual clauses.

Cloudflare, Inc. (receives and forwards mail sent to our address, United States): certified under the Data Privacy Framework, with standard contractual clauses.

Google Cloud France SARL (Google Workspace mailboxes), which relies on Google LLC in the United States: certified under the Data Privacy Framework, with standard contractual clauses.

Databricks, Inc., which runs Neon (the database of our outreach records, United States): certified under the Data Privacy Framework, with standard contractual clauses.

ZenLeads Inc., doing business as Apollo.io (B2B contact data, United States): certified under the Data Privacy Framework, with standard contractual clauses.

Defastra Tech Inc., which runs Prospeo (B2B contact data, Canada): Canada is covered by an EU adequacy decision.

GitHub, Inc. (a private backup of our records, United States): certified under the Data Privacy Framework.

OVH US LLC (the server that runs our tools, hosted in London): the United Kingdom is covered by an EU adequacy decision, and OVH US is certified under the Data Privacy Framework.

Reoon Technology (email verification): receives an email address alone and keeps the result 15 days. It is not certified under the Data Privacy Framework and publishes no data processing terms.

Anthropic (the Claude AI assistant, United States), used under its subscription terms, which include no data processing agreement; it is not certified under the Data Privacy Framework.

Telegram Messenger Inc. (notifications on our own phone; data of European users is stored in the Netherlands): it is not certified under the Data Privacy Framework and publishes no data processing terms.

How long it is kept

Audience counts: Vercel Web Analytics keeps them 1 month on our plan.

Product analytics: PostHog keeps events 1 year and screen recordings 1 month on our plan.

Your quiz answers and board: for as long as your private link must work; ask, and they are deleted with the email tied to them.

Customers: for as long as the contract runs.

Invoices and accounting records: 10 years, as the French Commercial Code requires (article L123-22).

Prospects: 3 years after our last contact, then deleted; an objection keeps only the address on the suppression list.

Messages sent to our address: kept with the customer or prospect record they belong to, for the same period.

Your rights

You can ask for access to the data held about you and a copy of it, its rectification, its erasure, the restriction of its processing, and its portability (a copy in a reusable format). You can object at any time to processing based on our legitimate interest, the outreach described above included. Where processing rests on your consent, you can withdraw it at any time, without affecting what was done before. Under French law, you can also give directions on what happens to your data after your death.

To exercise any of these rights, write to hello@wedpalette.com; we answer within one month. You can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07), or with the supervisory authority of the country where you live or work.