Privacy Policy
Last updated: 30 October 2026
Data controller
Maxence Roux, [ADRESSE], [EMAIL], is the controller of personal data collected on metalstat.com.
Data collected and its uses
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email, encrypted password | Create and secure the account | Performance of a contract | Account lifetime, then deletion within 30 days |
| Portfolio: items, weights, purities, purchase prices, photos, invoices | Provide value tracking | Performance of a contract | Account lifetime, then deletion within 30 days |
| Selected plan, subscription history | Manage Premium access | Performance of a contract | Account lifetime + 5 years |
| Billing data | Invoice and manage VAT | Legal obligation | 10 years, retained by Paddle |
| Support correspondence | Respond to enquiries | Legitimate interest | 3 years after the last exchange |
| Technical data (IP address, sign-in logs) | Security and abuse prevention | Legitimate interest | 12 months maximum |
| Information emails and newsletter | Provide updates | Consent | Until unsubscribing |
Portfolio data is personal and is never sold, rented or used for advertising.
Payment
Payments are processed by Paddle.com Market Limited, the official reseller. Metalstat receives no bank details. Paddle processes payment data under its own privacy policy.
Recipients and processors
Data is accessible only to the publisher and the providers required for the service:
- website hosting: OVH SAS (France);
- account database: [BASE DE DONNÉES];
- payment and billing: Paddle;
- email delivery: [SERVICE E-MAIL];
- domain name: OVH SAS.
Some providers may be located outside the European Union. In that case, transfers are covered by appropriate safeguards, such as the European Commission's standard contractual clauses.
Security
Communications are encrypted (HTTPS), passwords are stored encrypted and access to data is restricted. As no system is infallible, users should choose a strong, unique password.
Your rights
You have the right to access, rectify, erase, restrict the processing of, object to the processing of, and port your data, and to withdraw your consent at any time.
To exercise these rights: [EMAIL]. A response is provided within one month. You may also delete your account and export your data in settings.
If you disagree, you may contact the CNIL (www.cnil.fr).
Cookies
Metalstat uses only cookies and technical storage required for the website to function: maintaining sign-in, display preferences and security. These do not require consent.
No advertising or audience measurement cookies are set. If an analytics tool is added, this section will be updated and your consent requested where legally required.
Minors
The service is restricted to adults.
Changes
This policy may change. The update date appears at the top of the page and registered users are informed of significant changes.