Privacy policy
Last updated: 17 October 2026
- We keep what is needed to run your account and your page: your email, your profile content and your plan. We do not sell data or show ads.
- Published pages count views and link clicks without cookies. The IP address is hashed with a key that changes every day and is not stored in the statistics, which are deleted after 180 days.
- The application and its databases run on our server in Paris. Published pages and images are stored with AWS in Ireland. Traffic goes through Cloudflare.
- The only cookies are the ones that keep you signed in. There is no consent banner because there are no tracking cookies.
- For any request, including access or deletion, write to [email protected].
1. Who is responsible
The data controller is Sébastien FONTAINE EI, trading as FuryBee, 34 avenue François Mauriac, Apt 216, 93330 Neuilly-sur-Marne, France. Contact: [email protected]. More details are in the legal notice.
This policy covers profyl.it at profylit.furybee.org: account holders, people invited to a team, and visitors of published profile pages. The content of a profile page, including any personal data about other people it contains, is chosen and published by the owner of that page.
2. What we process, why, and for how long
| What | Data | Why, and legal basis | Kept |
|---|---|---|---|
| Account | Email address, name, account ID, creation and update dates | Create and run your account. Contract (GDPR art. 6(1)(b)) | Until your account is deleted |
| Sign-in emails | Email address, single-use sign-in token | Send you a magic link to sign in. Contract | The link expires after a few minutes |
| Sessions | Session token, IP address and browser user agent recorded when you sign in | Keep you signed in and secure your account. Contract and legitimate interest in security (art. 6(1)(f)) | A session expires 30 days after you last use it, or when you sign out |
| Your profile | Name, headline, bio, links (including any email address or phone number you choose to show), images, embedded media, style settings, page address, publication dates | Build and publish your page, its contact card (vCard) and QR code. Contract | Until you change or delete it, or delete your account |
| Profile statistics | See section 3 | Show page owners how their page is viewed. Legitimate interest | Deleted automatically after 180 days |
| Subscription | Stripe customer and subscription IDs, plan, status, billing period dates, cancellation status. Card details stay with Stripe; we never receive them | Sell and manage paid plans. Contract; keeping accounting records is a legal obligation (art. 6(1)(c)) | Until your account is deleted. Invoices and accounting records: 10 years (French Commercial Code, art. L123-22) |
| Teams | Team name and address, members and their roles, invitations (invitee's email, who invited them, status, expiry date) | Run team features for the team owner. Contract (owner and members) and legitimate interest (sending an invitation) | As long as the team exists. An invitation expires after 7 days |
| Custom domain | The domain name you connect | Issue a certificate and serve your page on your domain. Contract | Until you remove the domain or delete your account |
| Moderation and reports | The report (page address, reason, reporter's name and email), our decision and our exchanges with the people concerned | Handle reports of unlawful or prohibited content. Legal obligation and legitimate interest | Up to 3 years after the case is closed |
| Support | Your emails to us and our replies | Answer your questions and requests. Legitimate interest | Up to 3 years after our last exchange |
| Request logs | IP address, date and time, requested address, referrer, browser user agent, response status, for every request to profylit.furybee.org | Operate the service, investigate errors and abuse, rate limiting. Legitimate interest | 30 days |
| Error reports | Error message and technical context (page address, browser and system version, performance timings) when the app fails | Find and fix bugs. Legitimate interest | Up to 90 days, under Sentry's retention rules |
We do not use your data for advertising, we do not sell it, and we do not make automated decisions about you.
3. Visitors of published profiles
If you are visiting someone's profile page, here is what happens.
- Page views. Each published page includes an invisible 1×1 image. When your browser loads it, we record: which profile was viewed, the date and time, the domain of the referring site (only the domain, for example linkedin.com, not the full address), your browser's user-agent string, the device type derived from it (mobile, tablet or desktop), and a hash of your IP address.
- Link clicks. Links on a published page normally go through a short redirect on profylit.furybee.org. It records which link was clicked (its label, type and destination), together with the same information as a page view, then sends you to the destination.
- IP address. Your IP address is combined with a secret key that changes every day, then hashed (SHA-256). Only the hash is stored in the statistics. It is used to count unique visitors in a day and cannot be used to link your visits from one day to the next. The plain IP address is only held briefly in memory, for rate limiting and until the hash is computed, and it appears in the request logs, which are kept for 30 days (section 2).
- No location, no profiling. We do not determine your country or city, we do not build a profile of you, and we do not follow you across sites.
- No cookies. Published pages contain no scripts, and nothing is stored on or read from your device for these statistics. That is why there is no consent banner.
- Who sees it. The page owner sees aggregated statistics in their dashboard (on Pro and Teams plans): numbers of views and unique visitors, top referring sites, devices and most-clicked links. The raw records stay in our analytics database (ClickHouse, on our server in Paris) and are deleted automatically after 180 days.
- Legal basis. Our legitimate interest, and the page owner's, in basic audience measurement for the page. You can object at any time by writing to us. Because we cannot recognise you, the simplest way is to block images from profylit.furybee.org in your browser or use a content blocker.
Some content on a profile page is loaded from other providers, who receive your IP address like for any web request:
- fonts are loaded from Google Fonts (Google);
- the owner's photos and images are delivered by Amazon CloudFront;
- link preview images may be loaded directly from the website the link points to;
- if the owner has added a video or music player, it is loaded from YouTube, Vimeo, Spotify, SoundCloud, Twitch or Apple Music. These providers may set their own cookies and apply their own privacy policies.
4. Cookies and local storage
profyl.it sets no analytics or advertising cookies. The app uses only the following, which are strictly necessary and do not require consent:
| Name | Type | Purpose | Duration |
|---|---|---|---|
| __Secure-better-auth.session_token | Cookie | Keeps you signed in | 30 days, renewed when you use the app |
| __Secure-better-auth.session_data | Cookie | Short-lived copy of your session, to avoid a database lookup on every request | 5 minutes |
| pendingInviteToken | Local storage | Remembers a team invitation while you sign in | Removed once the invitation is accepted |
Cloudflare may set strictly necessary security cookies to tell people from bots. Stripe's checkout and billing pages run on Stripe's own domain and use Stripe's cookies, under Stripe's policy.
5. Service providers and other recipients
We use the following providers, who process data on our behalf and under our instructions, except Stripe, which also acts as an independent controller for payment and anti-fraud obligations.
- Scaleway SAS (France): hosts the server in Paris that runs the application, its PostgreSQL and ClickHouse databases and the request logs.
- Cloudflare, Inc. (United States): content delivery and protection for all traffic to profylit.furybee.org. Processes IP addresses and request data.
- Amazon Web Services (AWS EMEA SARL, Luxembourg): Amazon S3 in Ireland stores published pages and uploaded images; Amazon CloudFront delivers images worldwide and serves custom domains; AWS Certificate Manager issues certificates for custom domains (it receives only the domain name). Encrypted backups are stored in Amazon S3 in Paris.
- Mailgun (Mailgun Technologies, Inc., EU region): sends sign-in and team invitation emails. Receives your email address and the content of the message.
- Stripe (Stripe Payments Europe, Ltd., Ireland): payments, subscriptions, invoices and the billing portal. Receives your email address and name from us, and collects your payment details directly.
- Sentry (Functional Software, Inc., United States): error monitoring for the app (not for published profile pages). Error reports are stored in the United States.
- Google (Google Fonts): serves the fonts of the app and of published pages, and receives your IP address when they load.
Other recipients: anyone who visits your published page; team owners and admins, who see their members' name, email and photo; and public authorities, only when the law requires it.
6. Transfers outside the EU
Our server and the main data stores are in the EU (Paris, and Ireland for AWS S3). Some providers are based in the United States or may access data from there: Cloudflare, Sentry, Google, and the US parent companies of AWS, Mailgun and Stripe. These transfers rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission's standard contractual clauses. You can ask us for more information.
7. Deletion and backups
- Unpublishing removes your page from its public address. The storage keeps earlier versions of your published page for rollback until your account is deleted.
- Images you upload stay stored, and reachable at their image address, until you remove or replace them or delete your account. Images removed from a block may remain in storage until your account is deleted.
- Account deletion is done on request by email for now (see section 9). Within 30 days we delete your account, sessions, profile, published pages including earlier versions, images, team memberships, invitations you sent and the statistics of your page, and we cancel any subscription.
- Backups of the databases are encrypted. They are kept for 7 days on the server and for 90 days in Amazon S3 in Paris, after which deleted data disappears from them too.
- Billing records (invoices, payments) are kept for 10 years as required by French accounting rules, by us and by Stripe.
8. Security
All traffic is encrypted (HTTPS). There are no passwords to leak: sign-in uses single-use links. The server only accepts traffic coming through Cloudflare, the databases are not exposed to the internet, and backups are encrypted before they leave the server. Published pages contain no scripts.
9. Your rights
Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. Where processing relies on our legitimate interest, you can object to it.
- In the dashboard you can edit or remove your profile content, remove your photo, unpublish your page and leave a team. Invoices, payment methods and cancellation are in the Stripe billing portal (Billing, then Manage).
- There is no self-service export or account deletion yet. For those, and for any other request, email [email protected] from your account's address. We answer within one month.
If you think we have not respected your rights, you can lodge a complaint with the French data protection authority, the CNIL, or with the authority of the EU country where you live.
10. Children
profyl.it is meant for professionals and is not directed at children. You must be at least 15 to create an account. We do not verify age; if you believe a child has created an account, write to us and we will delete it.
11. Changes
If this policy changes, the new version is published here with a new date. If a change significantly affects how we use your data, we will also email account holders before it applies.