Privacy policy

The website is operated under the Atelier Cadre name by Melina Yorgova, a natural person. Atelier Cadre has not yet been registered as a business. For privacy requests, contact the operator at hello@ateliercadre.eu. The Legal Notice identifies publisher details that remain unresolved before publication; it does not include the operator's home address in this draft.

The Contact form sends the fields below to the server-side contact endpoint. Required fields must be supplied for an enquiry to be processed. Optional fields may be left blank.

If a required field is omitted or invalid, the server rejects the submission and does not send an email. The browser sends the form as a JSON POST request; entered values are not placed in the URL query string. A hidden honeypot field is used for basic spam filtering; if it is filled, the endpoint discards the enquiry and returns a generic success response without sending email. A successful browser response does not guarantee delivery if the server configuration or email provider fails.

Contact details and project information are used to review and answer a project enquiry and, where requested, take steps toward a written proposal before a possible contract. Where the requester is the person considering a contract, the processing is intended to be based on steps taken at that person's request before entering a contract (Article 6(1)(b) GDPR). When a person contacts the studio on behalf of a business, the operator intends to rely on its legitimate interest in reviewing and responding to the enquiry (Article 6(1)(f)), subject to documenting the purpose, necessity, balancing assessment, and right to object. These bases and the controller's actual circumstances should be confirmed before publication; a plausible basis is not by itself a legal assessment.

The endpoint uses the request's x-real-ip value, or the first x-forwarded-for value when the former is absent, as an IP-derived request identity for basic abuse prevention and rate limiting. The intended basis is the operator's legitimate interest in protecting the enquiry service from automated or repeated submissions, subject to documenting that assessment. The identifier is kept as a key in a process-local in-memory counter for rate limiting; it is not written by the application to a database or file. The counter window is 15 minutes, but old map entries can remain in process memory until reused, opportunistically cleaned, or the process ends. The hosting provider may separately process request metadata. The deployed host must be checked to confirm that it supplies and sanitises these proxy headers. No marketing use of enquiry data is implemented or described by this policy.

Required form information is needed to assess and answer an enquiry; without it, the form cannot be submitted successfully. WhatsApp number and company website are optional. The form does not make automated decisions or profile visitors.

A valid enquiry is sent by the server through Resend, operated by Plus Five Five, Inc., for email delivery. The message is sent from Atelier Cadre <enquiries@send.ateliercadre.eu> to hello@ateliercadre.eu. The visitor's email address is used as Reply-To, not as the sender. The message body includes the submitted form information so the operator can review and answer the enquiry.

The owner identifies Google Workspace as the mailbox provider forhello@ateliercadre.eu. Google receives and stores the delivered enquiry in that mailbox. The applicable Google Workspace agreement, access controls, retention settings, and data region have not been checked from this repository. Google publishes a Cloud Data Processing Addendum that includes international-transfer provisions; the owner must confirm whether it is incorporated into the actual Workspace account. Google's published terms allow processing in locations where Google or its subprocessors maintain facilities, subject to service-specific commitments. The account's selected region and applicable transfer arrangements remain unverified.

Resend's published Data Processing Addendum describes its processor role for customer email content, states that its primary processing operations take place in the United States, and describes EU Standard Contractual Clauses for relevant international transfers, with the EU-U.S. Data Privacy Framework described as an additional mechanism. These published terms are not confirmation that this account has accepted or incorporated them. Its published subprocessor list identifies Amazon Web Services in the United States as a hosting and sending provider. The operator must confirm that the applicable Resend terms/DPA cover the account and verify current service and transfer settings; this repository cannot establish the account configuration or the complete route taken by a particular message.

No CRM or application database is connected to the form. The production web host has not been identified from this checkout. Its identity, access logs, request data, retention, and any other infrastructure providers must be verified before publication.

The endpoint checks request format and size, validates all form values on the server, applies a honeypot, and rate-limits requests using an in-memory counter of up to five attempts per identity in a 15-minute window. The counter is process-local: it is not shared across serverless instances, may reset when an instance restarts, and stale entries are cleaned opportunistically. It is a basic deterrent, not a globally reliable rate limit. The application code does not write enquiry contents to an application database or intentionally log them. The host and email provider may have their own operational records, which require separate verification.

The Resend API key is read by the server-side route and is not sent to browser code. These implementation measures do not guarantee that every transmission or provider environment is secure; the operator must verify the production host, account controls, and applicable provider arrangements.

The application does not automatically delete enquiry emails or mailbox copies. The owner has adopted a manual review policy for unsuccessful enquiries: review them 12 months after the last contact and delete or irreversibly minimise them then if they are no longer needed. This is an operational policy, not an automatic feature of the website, mailbox, or Resend integration. It must be carried out across the mailbox and any other copies controlled by the operator. Information for an active project is kept only while needed to manage that project; records required separately for legal or accounting obligations are handled under the relevant retention requirement.

Resend's published GDPR information currently states that email and log data is retained for 30 days on its Free, Pro, and Scale plans, backups persist for 7 days, and remaining customer data is deleted within 90 days after account termination. Its Data Processing Addendum covers account termination. The actual plan, account settings, and applicable agreement have not been verified. These provider periods do not replace the operator's manual 12-month review policy or determine how long copies remain in the Google Workspace mailbox.

The operator must establish and document the manual review and deletion routine, restrict mailbox access, and check any backups or forwarded copies. The application itself has no database or automated enquiry-retention job.

The CNIL's commercial-activity reference describes a three-year period for prospect data used for commercial prospecting; this site does not use enquiry data for marketing, and that example is not presented here as a mandatory period for these enquiries. See the CNIL commercial-activities reference.

The application uses one first-party localStorage record to remember cookie preference choices for six calendar months. It is browser storage, not an HTTP cookie; the value is not automatically sent in HTTP requests, although scripts on this site can read it. No analytics or advertising tracker is active in the reviewed local configuration. The source includes a consent-gated GA4 loader, described below. See the Cookie Policy for the precise key, stored fields, and user controls. The current hosting/CDN behavior has not been checked.

The application contains a conditional Google Analytics 4 loader, but no Measurement ID or production configuration has been verified for this review. Without a valid NEXT_PUBLIC_GA4_MEASUREMENT_ID, the loader does not request Google's script. If configured, it loads only after a saved Analytics choice tied to the exact GA4 purpose revision; rejecting or withdrawing that choice stops subsequent events and attempts to clear accessible GA cookies. Google Analytics is not active in this source review. Before configuration, the operator must verify the GA property, settings, actual data flows, transfer safeguards, and update this notice to reflect them. Google Search Console is intended for site-owner search-performance information; no application integration was found.

Depending on the processing and its legal basis, you may request access, correction, erasure, or restriction, object to processing based on legitimate interests, and request data portability where the legal conditions apply. You may withdraw consent where consent is the basis; withdrawal does not affect processing already carried out lawfully. Contact hello@ateliercadre.eu to exercise a right. The operator may need to verify the request and will respond within the applicable legal time limit.

You may complain to the supervisory authority competent for your situation. For a controller established in France, the authority is generally the CNIL. The controller's actual establishment and the competent authority should be confirmed before publication. For privacy questions, contact the operator at the email above; if a DPO is appointed, the relevant contact details must also be provided.

This policy must be updated when the form, purposes, providers, hosting, retention practices, or applicable law change. It is based on the current application source and provider materials reviewed on 16 October 2026, not on a production deployment inspection. The general information duties are described in Article 13 GDPR and the CNIL guidance on informing people.

Related pages: Cookie Policy, Legal Notice, and Terms & Conditions.