Privacy policy.
We build software that handles accounts between siblings, inheritance documents, family situations nobody wants circulating. This page states exactly what we do with that data — and what we do not do.
Last updated · 2 September 2026Version · 1.0Framework · GDPR (EU) 2016/679
01Our four commitments
Before the legal detail, what we hold ourselves to:
We sell no data. We rent none. We do no targeted advertising. We do not use your data, or your users' data, to train artificial intelligence models.
- Minimisation. We collect only what we need in order to reply, scope, build and invoice. Our audience measurement is open source and cookie-free: anyone can verify what it does.
- Location. Data in the applications we deliver is stored in the European Union — the database and authentication service are hosted in France, in the Paris region.
- Reversibility. You can export all of your data at any time, in a readable and reusable format — including the day you stop working with us.
- Erasure. At the end of a contractual relationship, your data is returned to you and then deleted from our environments, save where the law requires us to keep it.
02Who processes your data
The controller for data collected through this site is:
- Data controller
- Curious Holding, SASU with share capital of €1, operating the Focusme Agency brand
- Registered office
- 47 rue Vivienne, 75002 Paris, France
- Registration
- Currently being registered with the Paris Trade and Companies Register
- Legal representative
- Gautier Justeau, President
- Data protection contact
- contact@curiousholding.eu
- Data protection officer
- No DPO has been appointed: appointment is not mandatory under Article 37 GDPR. Requests are handled directly by the legal representative.
- Supervisory authority
- CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr
The publisher's full legal identity is set out in the legal notice.
03Two roles not to confuse
Depending on the data concerned, we do not act in the same capacity. The distinction is not cosmetic: it determines who you address a deletion request to, and who decides what is kept.
| Situation | Our role | What follows from it |
|---|---|---|
| You write to us, we scope your situation, we invoice you | Controller | We determine the purposes and the retention periods. You exercise your rights directly with us. |
| We host or maintain an application we built for you | Processor (Art. 28 GDPR) | You remain the controller for your users' data. We act only on your documented instructions, under a data processing agreement. |
| You use Indivisionnaires or another independent product | Out of scope | Each product has its own privacy policy, applicable to its own users. |
04What we collect
This site is static: it has no forms, no accounts and no database. The only data we receive is what you send us voluntarily, chiefly by email.
| Processing | Data | Purpose | Legal basis |
|---|---|---|---|
| First contact and scoping | Name, email address, sometimes a phone number, and whatever you choose to tell us about your situation | Replying to you, understanding the need, telling you frankly whether software is the right answer | Pre-contractual steps taken at your request — Art. 6(1)(b) GDPR |
| Project management | Business contact details, correspondence, meeting notes, material required to build the software | Performing the contract: scoping, prototype, development, acceptance, go-live | Performance of a contract — Art. 6(1)(b) GDPR |
| Invoicing and accounting | Identity, billing address, amounts, payment references | Issuing invoices and keeping the accounts | Legal obligation — Art. 6(1)(c) GDPR |
| Audience measurement | Page viewed, referring page, country, browser, screen size. A technical fingerprint derived from the IP address and user agent — irreversible and renewed daily — distinguishes visits without identifying anyone. No IP address is retained. | Knowing which pages are actually read, and improving the site accordingly | Legitimate interest in non-intrusive audience measurement — Art. 6(1)(f) GDPR |
| Security and logging | IP addresses, timestamps, technical events | Detecting incidents, evidencing the integrity of our environments, preventing abuse | Legitimate interest in securing our systems — Art. 6(1)(f) GDPR |
| Evidence and defence | Quotations, contracts, contractual correspondence | Establishing or defending legal claims | Legitimate interest — Art. 6(1)(f) GDPR |
When you first contact us, describe your situation in broad terms — the nature of the problem is ample for scoping. There is no need, and no benefit, in sending us notarial deeds, bank statements or medical records at that stage. When documents are genuinely required, we will point you to an appropriate channel.
05Retention periods
| Data | Period | Starting point |
|---|---|---|
| Enquiry that led nowhere | 12 months | Last exchange |
| Prospect who went through scoping | 3 years | Your last contact with us |
| Active client file | Duration of the contractual relationship | — |
| Contracts, quotations, contractual records | 5 years | End of the relationship (Art. 2224 French Civil Code) |
| Invoices and accounting records | 10 years | Financial year end (Art. L. 123-22 French Commercial Code) |
| Aggregated audience statistics | Indefinitely, in aggregated and non-individual form | Page view |
| Technical and security logs | 12 months maximum | Event record |
| Data hosted on behalf of a client | Per your instructions; returned then deleted within 30 days of the end of the contract | End of contract |
06Who has access
Access to data is limited to those who need it to carry out their work, on a least-privilege basis. We rely on a deliberately small number of processors:
| Processor | Role | Location |
|---|---|---|
| Netlify, Inc. | Hosting of the public site and of application functions | European regions (Frankfurt, Ireland, Paris) — US company, global CDN for static files |
| Supabase | Database and authentication for the applications we deliver | France — Paris region (eu-west-3) |
| Resend | Sending transactional email | European Union |
| GoatCounter | Open-source, cookie-free audience measurement for the site and the applications we deliver | European Union — script served from gc.zgo.at |
| Google Ireland Ltd. | Delivery of the site's typefaces (Google Fonts) | Ireland / United States |
Each of these providers is bound by a contract compliant with Article 28 GDPR. No data is passed on for commercial, advertising or model-training purposes.
Your data may in addition be disclosed to an administrative or judicial authority where the law requires it.
07Hosting and location
We distinguish two perimeters, because they do not offer the same guarantees.
The site you are reading
It is hosted by Netlify, Inc., a US company. As the site is static and has no forms, none of the data you send us passes through it or is stored on it: the host processes only technical connection data (IP address, user agent, page requested) for delivery and security purposes.
Its files are distributed through a global delivery network: the page may be served to you from a point of presence outside the European Union, whichever is closest to you.
The applications we deliver
The data they contain is stored in the European Union. The database and authentication service are hosted by Supabase in the Paris region (eu-west-3), in France. Application functions run on Netlify's European regions (Frankfurt, Ireland, Paris). Transactional email is routed by Resend, within the European Union.
Division of security responsibilities
The host secures the infrastructure: data centres, network, encryption in transit, availability. Application security — authentication, access control, tenant isolation, exchanges with third-party services — is the responsibility of Curious Holding.
08Transfers outside the European Union
Users' personal data is stored in the European Union.
Hosting is nevertheless provided by Netlify, Inc., a US company, and the site's typefaces are delivered by Google. The resulting transfers — chiefly technical connection data and support access by the host — are governed by the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) and by Netlify's certification under the EU–U.S. Data Privacy Framework.
We therefore do not claim that your data never leaves Europe: we state where it is stored, and under what legal framework access from the United States may occur.
09Security
We implement technical and organisational measures appropriate to the risks:
- encryption of communications in transit (TLS) and of data at rest;
- strong authentication and least-privilege access management;
- strict separation of development, staging and production environments;
- no real data in development or demonstration environments;
- regular encrypted backups, with restoration testing;
- logging of access to production environments;
- regular updating of software dependencies.
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we notify the CNIL within 72 hours and inform you as soon as possible where the risk is high, in accordance with Articles 33 and 34 GDPR.
10Your users' data
Where we host or maintain an application on your behalf, your users' data remains yours. We then act as a processor, under a data processing agreement annexed to the contract, which provides in particular:
- that we process such data only on your documented instructions;
- that our personnel are bound by confidentiality obligations;
- that we assist you in responding to your users' rights requests;
- that we inform you without undue delay of any data breach;
- that no sub-processor is added without prior notice and an opportunity to object;
- that at the end of the contract the data is returned to you in a usable format, then deleted.
A copy of our standard data processing agreement is available on request at contact@curiousholding.eu.
11Your rights
In respect of data for which we are the controller, you have the following rights:
- Access — to confirm whether processing exists and obtain a copy of the data.
- Rectification — to have inaccurate or incomplete data corrected.
- Erasure — to request deletion, within the limits of our legal retention obligations.
- Restriction — to have processing frozen while a point is verified.
- Portability — to receive your data in a structured, commonly used format.
- Objection — to object to processing based on our legitimate interest, on grounds relating to your particular situation.
- Post-mortem directives — to determine what becomes of your data after your death (Art. 85 of the French Data Protection Act).
How to exercise them
Write to contact@curiousholding.eu, or by post to 47 rue Vivienne, 75002 Paris, France. We respond within one month, extendable by two months for complex requests, in which case we will tell you.
We may ask you for proof of identity where there is reasonable doubt as to who is making the request — only in that case, and the proof is destroyed as soon as the check is complete.
If our answer does not satisfy you, you may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — cnil.fr/fr/plaintes. If you reside in another EU member state, you may also lodge a complaint with your own national supervisory authority.
13Minors
Our services are addressed to adults. We do not knowingly collect data concerning children under fifteen.
The family situations we build tools for may nevertheless involve minors — a child who is an heir to jointly owned property, for instance. Where an application we build must process such data, the arrangements are defined with the client acting as controller, strictly limiting the information recorded to what is necessary.
14Changes
This policy may be amended to reflect legal or technical developments, or changes in our practices. The applicable version is the one published on this page, whose update date appears above.
Where a substantial change affects ongoing processing, the clients concerned are informed by email before it takes effect.