Privacy Policy

1. Introduction

This privacy policy describes how SquishConvert (www.squishconvert.com) collects, uses and protects your personal data in compliance with the General Data Protection Regulation (GDPR).

2. Data Controller

• Name: Davison Evan
• Address: 22 Le Domaine, 35310 Mordelles, France
• Email: contact@dvs-web.fr
• SIRET: 10007724700011

3. Data Collected

We collect the following data:

3.1 Data You Provide

• Account data: Email address, password (hashed)
• Uploaded files: Files submitted for conversion (deleted after processing)
• Payment data: Processed directly by Stripe (we do not store your banking details)

3.2 Data Collected Automatically

• Connection data: IP address, browser type, operating system
• Cookies: Session identifiers, user preferences
• Usage data: Number of conversions performed (for quota tracking)

4. Purpose of Processing

Your data is used to:

• Manage your user account and authentication
• Provide the file conversion service
• Process payments via Stripe
• Track conversion quotas (free plan limits)
• Send transactional emails (payment confirmation, password reset)
• Improve our services and user experience
• Comply with our legal obligations

5. Legal Basis

• Contract execution: Providing the file conversion service
• Consent: Analytical cookies (Google Analytics)
• Legitimate interest: Service improvement, security
• Legal obligation: Retention of billing data

6. Data Recipients

Your data may be shared with:

• Stripe: Payment processing (see their privacy policy)
• CloudConvert: File conversion processing
• Vercel: Website hosting
• Supabase: Database hosting and authentication
• Google Analytics: Traffic analysis (subject to your consent)

We never sell your personal data to third parties.

7. International Transfers

Some of our service providers are located in the United States (Stripe, Vercel, Supabase). These transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, by the EU-US Data Privacy Framework (DPF).

8. Data Retention

• Account data: Retained while account is active, then 3 years after deletion
• Uploaded files: Deleted immediately after conversion
• Billing data: 10 years (legal obligation)
• Connection logs: 1 year

9. Your Rights

Under the GDPR, you have the following rights:

• Right of access: Obtain a copy of your data
• Right to rectification: Correct inaccurate data
• Right to erasure:Delete your data (“right to be forgotten”)
• Right to portability: Receive your data in a structured format
• Right to object: Object to the processing of your data
• Right to restriction: Restrict the processing of your data

To exercise these rights, contact us at: contact@dvs-web.fr

10. Data Security

We implement appropriate security measures:

• HTTPS encryption for all communications
• Password hashing
• Restricted access to personal data
• Immediate deletion of uploaded files after conversion

11. Cookies

Our site uses cookies:

Essential cookies are necessary for the site to function and do not require your consent. Analytical cookies (Google Analytics) are only set after your explicit consent via our cookie banner.

12. Complaints

If you believe that the processing of your personal data constitutes a violation of the GDPR, you have the right to file a complaint with the CNIL (French Data Protection Authority): www.cnil.fr

13. Changes

We reserve the right to modify this privacy policy. Any changes will be published on this page with a new update date.

14. Contact

For any questions regarding this privacy policy, contact us at: contact@dvs-web.fr