privacy policy

    Last updated: March 27, 2026

    1. Who are we?

    MRL DigiTech is a French-language tech blog and a web creation agency. The site offers editorial content about artificial intelligence, cybersecurity, gadgets, and digital innovation, along with web design services for businesses and individuals.

    The data controller is MRL DigiTech, reachable at: contact@mrldigitech.com

    We are committed to complying with the General Data Protection Regulation (GDPR — EU 2016/679) and the amended French Data Protection Act. This policy explains which data we process, why, and how to exercise your rights.

    2. Data collected

    2.1 Account creation

    When you register, we collect:

    • Email address (required)
    • Display name (optional)
    • Profile picture (optional)
    • Short bio (optional)
    • Account creation timestamp

    2.2 Blog interactions

    When you use the site's features:

    • Published comments (text, date, author ID)
    • Liked articles (article ID, user ID)
    • Per-article view counters (aggregated, non-identifying)

    2.3 Contact / quote-request form

    Via the Contact page, we receive the information you enter: name, email address, subject, and message. This data transits through EmailJS and reaches us by email — it is not stored in our database.

    2.4 Newsletter

    If you subscribe to the newsletter, we keep your email address and subscription date. You may unsubscribe at any time via the link in every email, or by contacting us directly.

    2.5 Technical data

    Collected automatically for security and abuse-prevention purposes:

    • IP address (hashed and not stored in plaintext after processing)
    • User agent (browser, operating system)
    • Action timestamps (login, comment publication)

    3. Cookies and trackers

    We use a consent banner — no non-essential cookie is set without your explicit agreement. Your choice is stored in your browser's localStorage.

    Strictly necessary cookies — always active

    Supabase Auth session token (authentication), cookie-consent preference. Legal basis: contract performance / legitimate interest.

    Analytics cookies — subject to consent

    Google Analytics 4 — anonymized audience measurement (anonymized IP, no advertising cross-tracking). Activated only after your consent. Legal basis: consent (art. 6.1.a GDPR).

    User preferences

    Display theme (dark/light mode) — stored in localStorage, never sent to third parties.

    You can withdraw your consent at any time by clicking the cookie banner or by contacting our reference address.

    4. Purposes and legal bases of processing

    PurposeLegal basis
    Account management and authenticationContract performance
    Display and moderation of commentsLegitimate interest
    Processing a contact / quote requestPerformance of pre-contractual measures
    Sending the newsletterConsent
    Security, abuse prevention, rate limitingLegitimate interest
    Audience measurement (Google Analytics)Consent
    Compliance with legal obligationsLegal obligation

    5. Processors and transfers outside the EU

    We never sell, rent, or transfer your personal data.

    Your data may transit through the following providers:

    Supabase

    Database hosting, authentication

    Data hosted in Europe (EU). DPA available.

    Google Analytics 4

    Anonymized audience measurement

    Transfer to the United States — covered by the Standard Contractual Clauses (SCC). Activated only after consent.

    EmailJS

    Routing of contact-form messages

    Form data transits via EmailJS and reaches us by email. It is not retained on their servers.

    Legal authorities

    If required by legal obligation or judicial decision

    6. Retention periods

    • Account dataLifetime of the account, then deleted within 30 days after closure
    • CommentsLifetime of the account; removed when the account is deleted
    • Security logs7 days (automatic purge)
    • NewsletterUntil unsubscription, then immediate deletion
    • Contact form dataNot stored — only forwarded by email
    • Google Analytics data14 months (GA4 default setting)

    7. Data security

    • HTTPS — all communications are encrypted in transit (TLS 1.2+)
    • bcrypt hashing — your passwords are never stored in plaintext
    • Row Level Security (RLS) — row-level access control on the database via Supabase
    • Rate Limiting — protection against spam, flood, and automated abuse attempts
    • XSS protection — all user content is sanitized before display
    • Monitoring — automatic detection of suspicious behavior

    In case of a data breach likely to create a risk for your rights, we will notify the CNIL within 72 hours and inform you without undue delay if the risk is high.

    8. Your rights (GDPR)

    Under the GDPR, you have the following rights:

    Right of access

    Obtain a copy of all the data we hold about you.

    Right to rectification

    Correct inaccurate information directly from your profile or by contacting us.

    Right to erasure

    Delete your account and all associated data via cascade — accessible directly from the Profile page.

    Right to portability

    Receive your data in a structured, machine-readable format (JSON).

    Right to object

    Object to processing based on legitimate interest, notably for marketing purposes.

    Right to restriction

    Request suspension of the processing of your data in the cases provided by the GDPR.

    Withdrawal of consent

    Revoke a previously granted consent (newsletter, analytics) at any time, without affecting the legality of prior processing.

    To exercise these rights: contact@mrldigitech.com — reply within 30 days. You may also lodge a complaint with the CNIL (cnil.fr) if you believe your rights are not being respected.

    9. Protection of minors

    MRL DigiTech is not intended for people under 15 (the age threshold applicable in France for digital consent). If we learn that a minor under 15 has created an account without parental consent, we will delete their data without delay.

    10. Contact

    For any question regarding this policy or your personal data:

    MRL DigiTech — Data controller
    contact@mrldigitech.com

    Data Protection Officer (DPO)

    MRL DigiTech is not legally required to appoint a DPO under article 37 of the GDPR (no large-scale processing of sensitive data or large-scale regular and systematic monitoring of data subjects). Any request regarding your personal data, any complaint, or any exercise of your GDPR rights can be sent directly to contact@mrldigitech.com — guaranteed reply within 30 days.

    This policy may be updated. Any change will be published on this page with a new date. We recommend checking it regularly.

    Terms of serviceContactBack to home