Privacy policy
This notice applies to visitors of 100.rocks. Merchant console users and storefront analytics are covered separately at get.100.rocks/legal/privacy.
Who we are
100 Rocks is operated by Karen Charykov, Entrepreneur individuel (EI), trade name 100 Rocks, at 200 rue de la Croix Nivert, 75015 Paris, France. We are the data controller for the processing described here. Contact: help@100.rocks. We have not appointed a data protection officer.
What we collect
We receive hosting and security logs from your browser and hosting providers (IP address, user agent, requested URL, timestamps). If you choose to contact us, we receive the work email and any session range, store URL, or message you send. These fields are optional, but we need contact details and enough context to answer. If signed in, we read your existing console session to show account links. Limited first-party audience measurement uses page paths, device class, viewport, locale, truncated IP, and a per-tab session key. After analytics consent, we may store a persistent visitor identifier and short-lived layout-probe sampling state. Declining or opting out removes the visitor identifier.
Purposes and legal bases (GDPR)
We operate and secure the site under legitimate interests; answer requested inquiries under pre-contract steps and legitimate interests; recognize signed-in merchants under contract and legitimate interests; use limited first-party audience measurement where an applicable exemption permits it, with notice and opt-out; and use persistent identifiers or behavior measurement only with consent.
Retention
Hosting and security logs: up to 90 days. Contact and demo inquiries: up to 24 months after the last interaction unless law requires longer or a valid request requires earlier deletion. Site analytics: raw events 90 days; sessions and metrics 12 months; daily rollups 24 months; consent records 25 months where used. Per-tab keys clear with the tab; consent-gated visitor identifiers expire after 13 months; layout-probe sampling state expires after 14 days.
Recipients and location
Recipients are authorized personnel and providers that need the data: Vercel (hosting and CDN), Supabase (authentication and analytics storage), and Stripe if you become a paying merchant. Primary functions and database/authentication storage are configured in Paris/EU regions. Other provider operations may occur elsewhere under an adequacy decision, applicable Standard Contractual Clauses, or another lawful safeguard.
Cookies and storage
See our Cookie and storage notice for cookies, sessionStorage, and localStorage used on this site, how to manage consent, and your choices.
Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability, or objection; withdraw consent; appeal a denied request; or use an authorized agent. We may verify identity and authority. You may complain to your local authority; in France, the CNIL. We do not sell or share personal data for cross-context behavioral advertising and do not make solely automated decisions with legal or similarly significant effects.
Contact
Privacy requests: help@100.rocks. We respond within the period required by applicable law.