This English translation is provided for information only. Only the French version is legally binding.
Data controller
The site publisher, whose details are given in the legal notice. For any question about your data: Contact page.
Data collected
- Account: name, email address, password (stored only in irreversibly encrypted form), account type (personal or business), site language and, if you provide them, username, bio and picture.
- Acceptance of the terms: version of the terms of use and of this policy accepted at sign-up, and its date.
- Sign-in and security: sessions (identifier, IP address, browser), date of last activity and, if you enable it, the secret and backup codes of two-factor authentication (encrypted).
- Billing: for an individual, name, address (optional) and country; for a business, company name, representative's name, SIREN, EU VAT number and registered office address.
- Projects: information in your listings, declared figures and their visibility, links, technologies and keywords, and proofs of ownership of your sites.
- Payments and invoices: amount, date, status and Stripe payment identifiers, and invoices issued in your name. Your bank details are entered at Stripe and are never sent to Spooke.
- Moderation: decisions taken on your projects and your ranking entries, their author and their reason.
- Emails: messages related to your account (verification, password, payments and invoices, moderation decisions, inactivity warning).
Purposes and legal bases
- Providing the service (account, ranking, publishing and managing your projects, payments): performance of the terms of use.
- Issuing and keeping invoices: legal obligation (French General Tax Code, French Commercial Code).
- Verifying site ownership and a company's SIREN in the public register, moderating content, securing the site and preventing abuse: legitimate interest.
- Keeping proof of acceptance of the terms: legitimate interest.
- Answering your requests and handling your rights: legal obligation.
Your data is neither sold nor used for advertising, and is not subject to any automated decision-making.
Recipients and processors
- The Spooke team, within the limits of its tasks (moderation, support, accounting).
- The host: see the legal notice.
- The email delivery provider, which receives your address and the content of the messages.
- Stripe (Stripe Payments Europe, Limited, Ireland) for payments, which receives your email address and the payment information.
- The public company register (Recherche d'entreprises API, French administration), queried with only the SIREN entered for a business.
The name, tagline, address and amount of a ranked site are public. The information in a published listing, and the figures made public and verified, are visible to everyone.
Transfers outside the European Union
Stripe may transfer payment data to its parent company in the United States, under the EU–US Data Privacy Framework and the European Commission's standard contractual clauses. No other transfer outside the European Union is planned; any new transfer would be governed in the same way and indicated here.
Retention periods
- Account and projects: as long as the account is used. An account with no sign-in for 3 years receives a warning email, then is deleted 30 days later without a new sign-in.
- Account whose email address was never confirmed: deleted after 30 days.
- Sessions: they expire at the latest seven days after their last use; verification and reset links: one hour.
- Invoices and payments: ten years after the end of the financial year (article L123-22 of the French Commercial Code), even after the account is deleted, without any link to it.
- Log of moderation and payment actions: 5 years (general limitation period).
- Project deleted by its owner: removed from the site; its data is kept for the moderation history and erased with the account.
- Database backups: fourteen days, after which deleted data disappears from them too.
Cookies and local storage
Spooke only uses strictly necessary cookies: the session cookie that keeps you signed in, and the one that remembers the language you chose for one year. No advertising or analytics cookie is set, so no consent is requested. The browser also keeps, locally, the draft of a project or site being added. Payment takes place on Stripe's page, which is subject to its own privacy policy.
Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability over your data, whether your account is a personal or a business account.
- From Settings → My data: download all your data (JSON file) and delete your account, immediately.
- From your settings: correct your profile, your billing details and your projects.
- For any other request, write from your account's email address to Contact page. We answer within one month, which may be extended by two months for a complex request, in which case you will be informed.
You can also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr/fr/plaintes).
Security
The site is served exclusively over HTTPS. Passwords are at least 12 characters long, as recommended by the CNIL, and are irreversibly encrypted. Two-factor authentication is offered to everyone and is mandatory for administration, whose access is restricted and logged.
Last updated: 27 September 2026