Privacy policy
What is collected, why, on what legal basis, for how long — and what cannot be erased, said plainly.
1. Who processes your data
The data controller is the publisher of the site, Enka, whose full details appear on the legal notice page. See the legal notice
For any question about your data, write to bonjour@meute-launcher.fr.
2. The processing activities, one by one
This table describes the processing activities the product actually carries out. None is listed “just in case”: announcing processing that does not exist misleads as much as concealing processing that does.
| Processing | What is collected | Purpose | Legal basis | Duration |
|---|---|---|---|---|
| Account and public profile | email address, hashed password, username, display name, bio, avatar and banner, language, time zone, country | open and maintain the account, display the public showcase | performance of the contract | lifetime of the account, then twelve months |
| Authentication and security | session tokens, two-factor secret, hashed backup codes, last activity | log the member in and protect their account against impersonation | performance of the contract and legitimate interest | the session's lifetime; secret deleted when the second factor is removed |
| Discord linking | Discord ID, avatar and banner provided by Discord | allow one-click sign-in and carry over the account's picture | consent, withdrawn by unlinking the account | until unlinking |
| Offers and requests | title, description, price, quantity, assets, restrictions, images | publish the offer book and the quote requests | performance of the contract | life of the offer, then kept in the moderation archive |
| Transactions, Gage and ledger | amounts, assets, fees, on-chain deposit and withdrawal addresses, accounting entries | carry out transactions, hold the Gage, take the fees, pay out withdrawals | performance of the contract and accounting legal obligation | ten years — the ledger is write-only, never corrected |
| Transaction messaging | message content, attachments, read receipts | allow the exchange between buyer and seller and build the case file in the event of a dispute | performance of the contract and legitimate interest in evidence | five years after the transaction is closed |
| Disputes and evidence | statement of facts, items filed, SHA-256 fingerprint of each item, reasoned verdict, appeal | investigate the dispute, give reasons for the decision and make it open to appeal | performance of the contract and defence of legal claims | five years — the evidence is immutable and cannot be altered |
| Reviews | rating, comment, verified transaction marker | inform other members about a seller's reliability | performance of the contract | public for as long as the account exists |
| Compliance checks | name, date of birth, address, source of funds, phone; references and fingerprints of the documents, never their content in the database | verifying identity when a level requires it, and KYB for professionals | legal obligation | five years after the end of the relationship |
| Sanctions and politically exposed persons screening | name, country, date of birth, screening result and date | check that a member does not appear on a sanctions list | legal obligation | five years, with a record of every re-screening |
| Content reports | reporter's return address, nature and identifier of the content, statement of facts, evidence link | receive and investigate reports, acknowledge receipt, notify the decision | legal obligation — Articles 16 and 17 of the DSA | five years |
| Contact form messages | name given, reply address, subject, message, language of the page | receive the request, reply to it at the address left, and keep a time-stamped record of it | legitimate interest in replying, and legal obligation for the point of contact | three years after the last reply |
| Fraud detection | risk score, rule evaluations, links between accounts | spot coordinated accounts and attempted fraud | legitimate interest in the security of the marketplace | two years |
| Audit log | author, action, values before and after, reason, timestamp, IP address, user agent | make every administrative act traceable and enforceable, including against us | legal obligation and legitimate interest | five years — the log is immutable |
Providing an email address is necessary to open an account: without it, the account cannot exist. The other information is optional, except where a verification level or a legal obligation makes it necessary — and the product says so at the moment it asks for it.
3. What Meute does not do
- No data is sold, rented or transferred to third parties.
- No targeted advertising, no advertising profiling.
- No third-party trackers, no external analytics.
- No IP-based geolocation to choose the language or the currency: the language comes from the page address, never from the location.
4. Cookies and local storage
Meute stores only what is strictly necessary for the site to work. That is why no consent banner is shown: there is nothing to consent to.
| Name | Type | Role | Duration |
|---|---|---|---|
_meute_key
|
cookie | signed session: keeps you signed in and protects forms | duration of the browsing session |
meute_locale
|
cookie | remembers the language chosen in the switcher | one year |
phx:theme
|
local storage | remembers the light or dark theme; never sent to the server | until erased by the browser |
A visitor who does not log in and does not change language has no cookie set at all.
5. Who receives your data
Data leaves Meute only towards the providers necessary for the service, and for that use alone:
- the host of the server and the database, whose identity appears on the legal notice page;
- the email delivery provider, for the product's messages;
- Discord, only if you link a Discord account, and only for that linking;
- the public TRON chain, when a Gage deposit or withdrawal is written to it: addresses and amounts are public and final there.
Judicial and administrative authorities may receive data upon a duly issued order. Every transmission is logged.
6. Transfers outside the European Union
Some providers are established outside the European Union. Transfers then rely on the European Commission's standard contractual clauses or on an adequacy decision. A public chain, for its part, is global by construction: what is written to it is accessible everywhere, and cannot be brought back.
7. What cannot be erased
The right to erasure is not absolute, and Meute prefers to write it down rather than discover it when a request comes in. Three sets fall outside it, each for a specific reason:
- the ledger entries — accounts are not corrected, a reversing entry is written instead, and the law requires their retention;
- the evidence filed in a dispute — it is time-stamped, fingerprinted and locked in the database: its immutability is what gives it value, and it serves to establish and defend rights;
- the audit log — it records every administrative act, including those committed against a member. Making it erasable would amount to allowing the trace of an abuse to be erased.
Finally, a record written to a public chain is irreversible by nature: Meute can neither alter it nor delete it.
Outside these sets, closing an account entails the deletion or the anonymisation of the data that identifies it.
8. Automated decisions
Some measures are triggered without human intervention: the automatic pausing of sales after a series of incidents, and the computation of a risk score that may lead to enhanced review.
These measures are reasoned, dated and carry an expiry date. They confer the right to human intervention, to the expression of a point of view and to challenge, under the conditions set out in the terms and conditions.
9. Your rights, and how to exercise them
You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to lay down instructions on the fate of your data after your death.
They are exercised by writing to bonjour@meute-launcher.fr, from the address linked to the account. A reply is due within one month, extendable by two months for a complex request — and the extension is then reasoned.
The automated export and deletion procedures are not yet in service: requests are handled by hand, at that address, within the same time limit. This is stated here because a procedure that is announced and missing is worth less than a manual procedure owned up to.
10. Complaint
If an answer does not satisfy you, you may lodge a complaint with the Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.