Privacy policy
This notice applies to visitors of 100.rocks. Merchant console users and storefront analytics are covered separately at get.100.rocks/legal/privacy.
Who we are
100 Rocks is operated by Karen Charykov, Entrepreneur individuel (EI), trade name 100 Rocks. We are the data controller for the processing described here. Privacy requests are handled through help@100.rocks; no separate data protection officer is appointed today.
What we collect
Hosting and security logs (IP address, user agent, requested URL, timestamps). Information you submit via contact or demo forms (name, email, message). If you are signed in to the merchant console, we read your existing Supabase session to show account links in the header (email and user id from your console account). On this site we also run 100 Rocks analytics (page paths, device class, viewport, locale, truncated IP, per-tab session key in sessionStorage) to measure our own marketing performance. After you allow analytics, we also store a persistent visitor identifier and page-layout references in localStorage; these are removed if you decline or opt out.
Purposes and legal bases (GDPR)
Operate and secure the website (hosting logs) — legitimate interests in security and abuse prevention (Art. 6(1)(f)). Respond to sales and support inquiries (form submissions) — steps prior to contract and legitimate interests (Art. 6(1)(b)/(f)); consent where a jurisdiction requires it for marketing follow-up. Recognize signed-in merchants in the header (session check) — legitimate interests and, where applicable, contract (Art. 6(1)(f)/(b)). Measure marketing site performance (100 Rocks analytics on 100.rocks) — consent, collected through our on-site privacy banner. We do not start analytics collection until you choose your preferences, and behavior signals require explicit consent.
Retention
Hosting and security logs: up to 90 days. Contact and demo inquiries: up to 24 months after our last interaction, or sooner on erasure request. 100 Rocks analytics on this site: raw events 90 days; sessions and session metrics 12 months; daily rollups 24 months; consent log 25 months when behavior tier is used. Session keys use sessionStorage and clear when the tab closes.
Recipients and location
We use Vercel (hosting and CDN), Supabase (auth session check and analytics storage), and Stripe when a visitor becomes a merchant customer and starts paid billing. Our primary application functions and database/auth storage are configured in Paris/EU regions where supported by these providers. CDN, security, support, logging, billing, payment, or other provider operations may still involve limited processing outside the European Economic Area. Where a transfer requires safeguards, we rely on adequacy decisions, data processing terms, and Standard Contractual Clauses or equivalent safeguards.
Cookies and storage
See our Cookie notice at /cookies for cookies, sessionStorage, and localStorage used on this site, how to manage consent, and your choices.
Your rights
You may have rights to access, rectify, erase, restrict, object to, or port your personal data. You may also withdraw consent where processing is based on consent. You can lodge a complaint with your local supervisory authority; in France, this is the CNIL. We do not sell personal data.
Contact
Privacy requests: help@100.rocks. We aim to acknowledge within 72 hours and respond within 30 days.
Last updated: 2026-07-12