Privacy Policy

Last updated: 17 September 2026

This policy explains how GhostMeta (https://www.ghostmeta.online) processes your personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act. The French version prevails.

1. Data controller

Abderrahim Hourmatallah, sole trader (*Entrepreneur individuel*) — 63 rue de l'Union, 16600 Ruelle-sur-Touvre, France — SIRET 98489333900015
Privacy contact: contact@ghostmeta.online

2. What data, and why (purposes & legal bases)

Processing	Data	Purpose	Legal basis (GDPR art. 6)
Account / authentication	Email, name (Google OAuth / Supabase)	Enable sign-in and access	Contract (6.1.b)
Premium subscription	Subscription status, payment customer ID	Provide paid features	Contract (6.1.b)
Anonymous analytics	Aggregated, anonymous data (Vercel Analytics)	Traffic statistics	Consent (6.1.a), collected through the cookie banner
Error monitoring	Error logs (Sentry)	Service stability & security	Legitimate interest (6.1.f)
Non-exempt cookies/trackers	see Cookies	see that document	Consent (6.1.a)

Local processing: the core service processes images entirely in the user's browser; images and their metadata are never uploaded to our servers.

3. Recipients and processors

Your data may be processed by the following processors under GDPR art. 28 agreements: Supabase (auth & storage of email/name), Vercel (hosting & anonymous analytics), Sentry (error monitoring), and the payment service provider identified on the checkout page and in the order confirmation (payment processing).

4. International transfers

Some processors are located in the United States. Those transfers rely on the safeguards provided for by the GDPR: the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework. The exact mechanism for each provider is set out in its own data processing agreement, published on its website.

5. Retention

Account data: for the duration of the subscription, then deleted within 30 days of account deletion.
Technical and error logs: kept for a maximum of 12 months.
Cookies: see the cookie policy (max 13 months for consent-based trackers, per CNIL).

6. Your rights

Under GDPR articles 15–22 you have the rights of access, rectification, erasure, restriction, objection, portability, and to withdraw consent at any time. To exercise them: contact@ghostmeta.online. We reply within one month.

7. Complaint to the supervisory authority

You may lodge a complaint with the CNIL (French DPA), 3 place de Fontenoy, 75007 Paris — https://www.cnil.fr/en/home.

8. Changes

This policy may be updated; the "Last updated" date reflects the latest version.