Privacy policy

Data controller

The controller of your personal data is Clément Guérin, sole proprietor (micro-enterprise), SIRET: 10028571700011, located at 43 Quai Malakoff, 44000 Nantes, France. For any data-related question: clement@mangue.work

Data collected

When you use Ping Me If, we process the following data:

• Account data: email address, user id, display name and profile picture (via Supabase Auth). If you sign in with Google, that service passes us your email, name and profile picture; no password is ever shared with us
• Watches: the conditions you describe, the interpretation our service produces, the search strategy, the verification history (results, evidence and sources found) and the status of each watch
• Pings: the emails we send you when a watch is confirmed, delivered by Resend. Each ping contains a link to stop the watch
• Data submitted to AI: your condition and the search results are transmitted to AI models via OpenRouter for interpretation and verification
• Search queries: the searches we run are sent to our search provider (Serper). They are derived from your condition and contain nothing that identifies you
• Billing data: handled by Stripe; we do not store your banking details, only the customer id and the subscription status

Purposes of processing

• Providing and operating the Ping Me If service
• Managing your account, subscription and associated quotas
• Running the automated checks and AI features you trigger
• Sending you pings when your conditions are confirmed
• Service-related communication and abuse prevention

Legal bases

• Performance of the contract: processing the data needed to provide the service and to bill for it
• Legitimate interest: service security and abuse prevention
• Legal obligation: retention of accounting and invoicing records

Retention periods

• Account data: kept until your account is deleted
• Watches: kept until you delete them or until your account is closed
• Billing data: as required by law (10 years for accounting records)

Transfers and sub-processors

Your data is hosted within the European Union (Supabase EU region, Ireland). The application is hosted by Vercel (a company based in the United States); any transfers to third countries are covered by appropriate safeguards (Standard Contractual Clauses). Data processing agreements (DPAs) are in place with our sub-processors.

Sub-processors involved: Supabase (database, authentication), Vercel (application hosting), Stripe (payment), OpenRouter (AI processing), Resend (transactional email), Serper (web search).

If you choose to sign in with Google, that service handles your authentication as an independent controller, under its own policies.

AI model providers

OpenRouter is not the final recipient of your content: it is a gateway. Each request is routed to the provider of the model in use, which processes it on its own servers, in the United States.

Retention policies differ from one provider to the next: some keep nothing, some log requests for a limited time, some may use them to improve their models. This step is outside our control and we cannot give you any guarantee about it.

Your rights (GDPR)

• Right of access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to data portability
• Right to object
• Right to restriction of processing
• Right to lodge a complaint with a supervisory authority

To exercise these rights, write to us at clement@mangue.work. If a dispute remains unresolved, you may refer the matter to the CNIL. We reply within one month.

Data breach notification

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, along with the competent supervisory authority (CNIL), in accordance with articles 33 and 34 of the GDPR.