Privacy policy
Version of July 19, 2026.
1. Controller
Agoraios Application (SAS), enseigne Agora Studio, French company registration (SIREN) 908 978 653, 6 impasse de l'Église, 42580 L'Étrat, France. Data questions: bonjour@menestrel.dev.
One important distinction: for the content of your sites and the accounts of the editors you invite, YOU (or your organization) are the controller; Menestrel then acts as processor under the data processing agreement.
2. Data, purposes and legal bases
- Account (email, name, hashed password or passkey, interface language): providing the service, session security. Legal basis: performance of the contract.
- Billing (billing email, subscription history; card data is handled by Stripe and never reaches our servers): subscription management and accounting obligations. Legal bases: contract, legal obligation.
- Site content and media: hosting and publishing on your behalf. Legal basis: contract (as processor).
- Activity log (who changed what, per organization): traceability for you and security. Legal basis: legitimate interest. Retention: 12 months.
- Internal product analytics (product events: editing session, publish requested, activation milestones), with no IP address, no user agent, no content, never shared with third parties: product improvement. Legal basis: legitimate interest. Retention: 13 months.
- Technical logs: security and diagnostics. Legal basis: legitimate interest. Short retention with automatic rotation.
On the menestrel.dev showcase site, audience measurement runs on Plausible, self-hosted in the European Union, cookie-free and without personal data: that is why there is no consent banner.
3. Cookies
The app.menestrel.dev application only uses session cookies strictly necessary for authentication (exempt from consent). No advertising cookies, no third-party trackers, on any of our domains.
4. Recipients and processors
Data is hosted and processed in the European Union:
- Scaleway SAS (France): servers, database, media and content storage, transactional emails. Region: Paris.
- BunnyWay d.o.o. (Slovenia): CDN for media and published content.
- Stripe Payments Europe Ltd (Ireland): card payments; transfers to Stripe Inc. (United States) may occur, covered by the Data Privacy Framework and standard contractual clauses.
- Vercel Inc. (United States): hosting of the menestrel.dev showcase site only, which has no accounts and no forms.
We never sell or rent any data. No data is used for advertising.
5. Retention
- Account: while active, then full purge 30 days after deletion.
- Deleted sites and content: purged after 30 days (trash included).
- Activity log: 12 months. Product analytics: 13 months.
- Invoices and accounting records: 10 years (legal obligation).
- Encrypted backups: automatic rotation.
6. Security
TLS in transit on all domains, sensitive secrets encrypted at rest (AES-256-GCM), hashed passwords (scrypt), strict isolation between organizations verified by a dedicated test suite, encrypted backups with tested restoration, two-factor authentication available.
7. Your rights
You have the rights of access, rectification, erasure, portability, restriction and objection under the GDPR. Exercise them by writing tobonjour@menestrel.dev; we answer within one month. Portability of your content is immediate and permanent through the export command (markdown, JSON, media). You may lodge a complaint with the French supervisory authority, the CNIL (cnil.fr), or your local authority. If you are an editor invited into a customer's workspace, address that customer first, as controller; we assist them in answering.
8. Changes
Any substantial change to this policy is announced by email to account holders before it takes effect.