Controller
The controller is the association Aphantasia Club, an association governed by the law of 1 July 1901 and the decree of 16 August 1901, with its registered office at 9 rue Romy Schneider, 21000 Dijon (RNA W212013867).
No data protection officer is appointed. For a question about this policy or to exercise a right, write to aphantasiaclub@gmail.com. Requests are addressed to the board.
The principle
This site is an editorial site. It does not ask you for an account, does not sell any data, and does not take any automated decision that produces a legal effect.
Leaving an email address is optional. The site is not directed at children. Viewing a page does not record a profile about you. The host and the edge relay do keep technical logs, described below, and the browser may receive a cookie that is strictly necessary for the service you request.
Technical logs
Like any web server, the host keeps technical logs needed for security and for the service to work (IP address, timestamp, requested page). The legal basis is the association’s legitimate interest in protecting the site (GDPR Article 6(1)(f)).
These logs are kept for one year by OVH SAS, in France, in line with the French legal obligation that applies to the host (GDPR Article 6(1)(c)). Cloudflare, Inc., in the United States, provides the edge relay and may process the same request metadata for security and traffic distribution.
Cookies
The site does not set an advertising cookie or an audience-measurement cookie. No consent banner is shown. The cookies in use are strictly necessary for the service you request.
When you choose English, or when you open a page whose address starts with /en, the site sets the NEXT_LOCALE cookie. It remembers the last language you chose for one year, and switches back to French as soon as you open a French page or choose French. It does not contain a personal identifier.
While the “coming soon” page is shown, entering the access password sets the aq_maintenance cookie. It lets you browse the site during that period, for seven days in the default configuration, and it contains no personal data. It is not set if you do not enter that password.
If you write to us
When you contact us by email, we process your address and the content of your message in order to reply. The legal basis is the association’s legitimate interest in handling your request (GDPR Article 6(1)(f)). When the message exercises a right under the GDPR, the legal basis is a legal obligation (Article 6(1)(c)).
The message is kept for the duration of the exchange, then for three years from the last message. We do not use it for any other purpose, and we do not sell it.
The mailbox aphantasiaclub@gmail.com is a consumer mailbox operated by Google, which processes the message in order to deliver and store it.
If you ask to be told about the launch
Before the site opens, the “coming soon” page lets you leave your email address so you can be told. We then record only that address, the page that collected it, and the date. The legal basis is your consent (GDPR Article 6(1)(a)).
That address is used only to send you one announcement, once, at launch. It is never matched with a questionnaire participation. It stays in the project database until it is sent. The announcement is then sent via Resend.
We keep it until that sending or until you unsubscribe. Each message contains an unsubscribe link. You can also write to aphantasiaclub@gmail.com to be removed from the list immediately. Withdrawing consent does not affect a sending that has already taken place.
If you subscribe to La lettre
La lettre is the association’s monthly edition. You subscribe on the site by ticking a box yourself. The legal basis is your consent (GDPR Article 6(1)(a)). This subscription is separate from the launch announcement and from answers to the A-Quest questionnaire.
We record your address and the version of the text you accepted. The address is kept in a separate database, Listmonk, on the association’s server, until you withdraw your consent. An address that has not confirmed the message it received expires at the end of that tool’s confirmation window. Each sending goes through Resend, used as the mail server. A published edition on the site is not personal data.
Each message contains an unsubscribe link. Unsubscribing places the address on a blocklist, so that an import or a campaign cannot write to you again. A new consent from the site form removes that entry and starts confirmation again. To receive an export of your record, or to be erased, write to aphantasiaclub@gmail.com. The association replies within one month. Erasure removes the subscriber. The blocklist entry may remain, only so that we do not write to you again. Backups of this database cannot be rewritten afterwards.
If you turn on a browser notification
A notification of a new edition is a second consent, separate from email. You turn it on with the switch on the La lettre page, in the browser you are using at that moment. The legal basis is your consent (GDPR Article 6(1)(a)). The page does not ask for it when it opens.
The site then keeps the technical address the browser provides for the notification, without your email address and without a link to a questionnaire participation. It stays on the association’s server until you turn the switch off, or until the browser’s notification service reports that the address is no longer valid. A request that names an email address does not locate this subscription: you remove it with the switch, on that browser. Backups of this store cannot be rewritten afterwards.
Recipients and transfers
The site is hosted by OVH SAS, 2 rue Kellermann, 59100 Roubaix, France. Hosting data stays in the European Union.
Cloudflare, Inc., in the United States, processes connection metadata (IP address, timestamp) for security and traffic distribution. Resend (Plus Five Five, Inc., United States) sends the launch announcement to addresses left on the “coming soon” page, and La lettre to addresses that have confirmed it. Launch-announcement addresses are passed to Resend and stored in the United States for that sending. La lettre is sent from addresses kept on the association’s server: Resend receives the address for the time it takes to send. Resend does not handle the emails you send us directly. The browser’s notification service (Google, Mozilla, or Apple, depending on the browser) receives the edition’s public title and its address on the site, encrypted, and does not receive an email address.
These transfers outside the European Union rely on the European Commission’s standard contractual clauses and on the EU-US Data Privacy Framework, as published by those providers.
Google processes messages received at aphantasiaclub@gmail.com in order to deliver and store them. The association does not sell any data and does not pass it to partners.
When you leave the site
Links to social networks and to laboratory recruitment calls, including on the studies page, lead to services the association does not control. Those organisations are their own controllers.
The association does not receive applications and does not embed those services in its pages.
The questionnaire is handled separately
Answers to the A-Quest questionnaire belong to a separate processing, described in that service’s own privacy policy.
Rights of access and erasure relating to questionnaire answers are exercised directly within A-Quest, not from this site.
Your rights
You have a right of access, rectification, erasure, restriction, objection, and portability over the data the association holds about you. Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out. You may also set instructions for what happens to your data after your death.
For La lettre, access and portability are an export of your record from the letter’s database, provided within one month. After erasure, the blocklist entry may remain so that the address is not written to again. Backups of that database, like backups of the notification store, cannot be rewritten afterwards. A browser notification is not tied to an email address: you remove it with the switch on that browser.
To exercise them, write to aphantasiaclub@gmail.com. Requests are addressed to the board. No data protection officer is appointed: the association is the one that answers, within one month, extendable by two months when the request is complex. You may also lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at www.cnil.fr.