Privacy policy

Last updated: August 2026

1. Data controller

Benoit Lefevre – EI, sole trader, SIREN 104 187 547, France. Data protection contact: [email protected]

2. Data we collect

Category	Data	Purpose
Account	Email, hashed password (bcrypt), first name	Authentication, communication
Security	TOTP two-factor code, session tokens	Keeping the account secure
Content	Whatever you enter in the modules (recipes, transactions, contacts…)	Providing the Service
Technical	IP address, user agent, access logs	Security, debugging (30 days max)
Payment	Stripe identifier, subscription status	Billing (no card details stored)

3. Legal bases

Performance of the contract, providing the Service, managing the subscription
Legitimate interest, keeping the Service secure, preventing fraud
Legal obligation, keeping invoices (10 years)
Consent, marketing messages and non-essential trackers

4. Hosting and transfers

Data is hosted in Europe (Hostinger, European Union). No transfer to a third country takes place without appropriate safeguards. Our payment provider Stripe (United States) is covered by the European Commission's standard contractual clauses.

5. How long we keep data

Account data: for the life of the account, plus 3 years after closure
Content data: deleted 30 days after the account is closed
Technical logs: rolling 30 days
Billing data: 10 years (legal obligation)

6. Your rights (GDPR)

Under the General Data Protection Regulation (EU 2016/679), you have the following rights:

Right of access, obtain a copy of your data
Right to rectification, correct inaccurate data
Right to erasure, delete your account and your data
Right to portability, export your data (JSON/CSV)
Right to object, object to certain processing
Right to restriction, restrict the processing of your data

To exercise your rights, write to [email protected]; we reply within 30 days. You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

7. Security

Vivio applies appropriate technical and organisational measures: TLS encryption in transit, passwords hashed with bcrypt (salt 12), TOTP two-factor authentication, access logs and regular security updates.

8. Cookies and analytics

We use the following trackers, and no others:

Strictly necessary cookies, make the site work (language preference, authentication session, security). Exempt from consent.
Anonymous analytics (Umami), a privacy-friendly tool that sets no cookie and cannot identify you. Always on, exempt from consent.
Cookie-based analytics (Microsoft Clarity, Google Analytics), set only after you consent. They help us understand how the site is used so we can improve it.
Review widget (Trustpilot), loaded on the home page only after you consent, to show our rating and reviews. Trustpilot then receives the address of the page you are viewing and your IP address. Without consent, no request is sent to Trustpilot.
Advertising (Google AdSense), when active, it runs on the blog articles of this site only — never on the other pages — and, inside the app, only on free-plan accounts: no ad is served during the first 15 days or on a paid plan. Third-party vendors, including Google, then set cookies on your device and use them to show ads based on your previous visits, to this site and to others. That consent is collected by Google's consent management platform, which is separate from the banner described below; without it, no personalised ad is served.

Opting out of personalised advertising. Independently of our site, you can turn off Google ad personalisation in your Google account ad settings, and that of other ad networks at youronlinechoices.com (European initiative) or aboutads.info. These settings apply to every site you visit, not to getvivio.com alone.

You can change or withdraw your choice at any time through the “Manage cookies” link at the bottom of the page. Withdrawing consent reloads the page to stop the scripts concerned and clears the cookies they had set on our domain. Your choice is kept for 6 months, then asked again.