Privacy Policy
Last updated: May 2026
1. Data Controller
Onde Interactive is a trading name of Yves Léon EI, a sole trader (micro-entreprise) registered in France.
Data Controller: Yves Léon
Address: 173 RUE de Courcelles, 75017 Paris, FRANCE
Email: contact@ondeinteractive.com
SIRET: 10318989000017
2. Data We Collect and Why
2a. Account Data
When you create an account on Onde Interactive, we collect the following information:
- Email address — account identification and login
- First and last name — profile display
- Username — public identification on the platform
- Profile picture — avatar display (optional)
This data is necessary for the performance of our service contract with you (GDPR Art. 6(1)(b)).
2b. Uploaded Content
When you submit a video clip to a competition, we collect:
- Video URL — link to the video hosted on a third-party platform
- Spot name — location where the clip was filmed
- City — geographic location of the clip
- Session date — date the video was recorded
- Photographer/videographer name — content attribution
2c. Navigation and Session Data
When you log in and navigate the platform, we collect:
- IP address — security and session management
- User agent (browser and operating system) — security and compatibility
- Session token — maintaining your login session
This data is processed on the basis of our legitimate interest (GDPR Art. 6(1)(f)) in ensuring the security of the platform.
2d. Competition Scores and Votes
When you participate as a judge, the votes and scores you assign to matchups are recorded to calculate competition standings.
2e. Analytics
To understand how the platform is used, we use PostHog Cloud (European Union) as our analytics tool. The data collected includes:
- Pseudonymous internal user ID — your Onde Interactive user identifier only (never your email address or name)
- Product journey events — for example: starting a bracket, scoring a matchup, sharing a result (never the score value itself)
- Technical metadata — locale, browser, session state
This data is processed on the basis of your consent (GDPR Art. 6(1)(a)), collected via the consent banner. No data is transmitted to PostHog before you have accepted. You can revoke your consent at any time via the "Cookies" link in the page footer.
Full details of the cookies set and their retention periods are provided in the cookie policy.
3. Legal Basis for Processing
| Data | Legal Basis |
|---|---|
| Account data | Performance of contract — GDPR Art. 6(1)(b) |
| Uploaded content | Performance of contract — GDPR Art. 6(1)(b) |
| IP address, user agent, sessions | Legitimate interest (security) — GDPR Art. 6(1)(f) |
| Scores and votes | Performance of contract — GDPR Art. 6(1)(b) |
| Analytics data (PostHog) | Consent — GDPR Art. 6(1)(a) |
4. Cookies
Onde Interactive uses two categories of cookies:
- Strictly necessary cookies — exempt from prior consent requirements (CNIL guidelines). They enable the basic functioning of the service (authentication, language preference, etc.).
- Analytics cookies — set only after your explicit consent via the banner presented on your first visit. These cookies are used by PostHog Cloud (EU) — see §2e above.
Full details (name, purpose, retention period, revocation) are provided in the cookie policy.
| Cookie | Category | Purpose | Duration |
|---|---|---|---|
better-auth.session_token | Strictly necessary | Authentication session cookie — keeps you logged in | 30 days |
NEXT_LOCALE | Strictly necessary | Saves your language preference | Browser session |
consent | Strictly necessary | Your consent choice state | 30 days |
ph_* | Analytics (consent required) | PostHog pseudonymous identifier | 1 year (cookie) — see cookie policy for server-side retention |
5. Data Retention
| Data | Retention Period |
|---|---|
| Account data (email, name, username) | Until account deletion |
| Profile picture | Until account deletion |
| Session tokens | Maximum 30 days |
| IP address and user agent | Maximum 30 days (session duration) |
| Uploaded content (video clips) | Until clip or account deletion |
| Scores and votes | Duration of tournament or until account deletion |
| Passkey credentials (passwordless authentication) | Until passkey removal or account deletion |
6. Recipients and Data Processors
Your personal data may be shared with the following sub-processors as part of delivering the service:
| Provider | Role | Data Shared | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting | HTTP logs, IP addresses | United States (Covina, CA) |
| Neon Inc. | Database hosting | All stored personal data | Europe / United States |
| Stripe Inc. | Payment processing (if applicable) | Billing data | United States / European Union |
These providers act as data processors under the GDPR and are not permitted to use your data for their own purposes.
7. International Data Transfers
Vercel Inc. is a company based in the United States. Personal data processed through our application hosting may be transferred to the United States. This transfer is governed by the Standard Contractual Clauses adopted by the European Commission, in accordance with GDPR Art. 46(2).
To obtain a copy of the safeguards in place for these transfers, please contact us at contact@ondeinteractive.com.
8. Your Rights as a Data Subject
Under the GDPR, you have the following rights regarding your personal data:
Right of Access (GDPR Art. 15)
You may request a copy of all personal data we hold about you.
Right to Rectification (GDPR Art. 16)
You may request the correction of inaccurate or incomplete data held about you.
Right to Erasure (GDPR Art. 17)
You may request the deletion of your personal data. This will result in the permanent closure of your account along with the deletion of your clips, votes, and associated session data.
To exercise your right to erasure: send an email to contact@ondeinteractive.com with the subject line "Account deletion — Onde Interactive". We will process your request within one month of receipt.
Right to Data Portability (GDPR Art. 20)
You may request to receive your data in a structured, commonly used, and machine-readable format.
Right to Object (GDPR Art. 21)
You may object to the processing of your data where it is based on our legitimate interests (in particular, navigation and security data).
How to Exercise Your Rights
Send your request by email to contact@ondeinteractive.com. We will acknowledge receipt of your request and respond within one month. This period may be extended by a further two months for complex requests.
9. Right to Lodge a Complaint with the CNIL
If you believe that the processing of your personal data does not comply with applicable data protection law, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the French data protection authority:
Website: www.cnil.fr
Address: 3 Place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07
You may also contact the data protection authority in your country of residence within the European Union.
10. Changes to This Policy
This privacy policy may be updated to reflect changes to the service or applicable regulations. In the event of a material change, we will inform you by appropriate means. The last updated date at the top of this document is kept current at all times.
We encourage you to review this page periodically.