Privacy policy

The data controller under the General Data Protection Regulation (GDPR) is Matejicekme SASU, registered office at 12 T Rue Principale, 57580 Vatimont, France (SIREN 989 089 032).

Contact for any question relating to personal data: jordan@matejicek.me.

2.1 User account

When creating a Fyncha account on the site, we collect: email address, password (hashed via Firebase Authentication, never stored in clear), first name, last name, and Etsy shop URL. This data is used to identify the user, to contact them about the service, and to configure their integration.

2.2 Payments

Payments are processed by Stripe (Stripe Payments Europe Limited, Ireland). No card data transits through or is stored by Fyncha. We retain the technical identifiers returned by Stripe (Customer ID, Payment Intent ID, Subscription ID) to manage the licence and billing.

2.3 Etsy connection (OAuth)

When the user connects their Etsy shop via OAuth, we store: Etsy access and refresh tokens (encrypted with AES-256-GCM in Firestore), Etsy user ID, shop ID. We access the shop's listings on demand (titles, descriptions, tags, photos) for the rewrite feature, with no permanent cache beyond the working session.

2.4 Server logs

Our hosting provider (Google Cloud Run) keeps technical logs by default for 30 days (IP address, user-agent, timestamp, HTTP status). These logs are used for security and debugging.

2.5 Chrome extension

The Fyncha Chrome extension is a local companion to the desktop application: it sends no data to any Fyncha server. Data read from Etsy via the extension is sent only to the desktop application installed on the user's machine. See the dedicated extension privacy policy for the full list of fields read, data stored in chrome.storage.local, and manifest permissions.

The above processing operations rely on the following legal bases (GDPR art. 6):

• Performance of a contract (art. 6.1.b): providing the Fyncha service, managing the account, payments and the Etsy connection.
• Legal obligation (art. 6.1.c): bookkeeping and invoice retention.
• Legitimate interest (art. 6.1.f): system security, fraud and abuse prevention.

To deliver the service, we use the following sub-processors, all bound by a data-processing agreement compliant with article 28 of the GDPR:

• Google Ireland Limited (Ireland, EU) — hosting, database (Firestore), authentication (Firebase Auth), storage (Firebase Storage). Data processed within the EU.
• Stripe Payments Europe Limited (Ireland, EU) — payment and subscription processing.
• Anthropic, PBC (United States) — calls to the Claude model from the desktop application with the user's personal API key. No call transits through Fyncha servers.

Calls to the Claude model (Anthropic, United States) are made directly by the user's desktop application, with their personal API key. The transfer is governed by the Standard Contractual Clauses adopted by the European Commission (decision 2021/914) and Anthropic's adherence to the EU-U.S. Data Privacy Framework.

Other processing (Google, Stripe) remains within the European Economic Area.

• Active account: as long as the account exists.
• Deleted account: effective deletion within 30 days, save contrary legal obligations.
• Billing data: 10 years (French Commercial Code art. L. 123-22).
• Etsy tokens: until the user disconnects the shop or terminates the account.
• Technical logs: 30 days.

In accordance with articles 15 to 22 of the GDPR, you have the following rights over your data:

• Right of access and copy
• Right of rectification
• Right to erasure (“right to be forgotten”)
• Right to portability
• Right to restriction of processing
• Right to object
• Right to withdraw your consent at any time, without affecting the lawfulness of previous processing

To exercise these rights, write to jordan@matejicek.me. We will respond within one month (extendable by two months for complex requests).

If you believe your rights are not respected, you can lodge a complaint with the French data-protection authority, the Commission Nationale de l'Informatique et des Libertés:

CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

The fyncha.com site uses a minimal set of cookies and local storage. You can change your choice at any time via the "Manage cookies" button at the bottom of every page.

Strictly necessary (no consent required, art. 82 of the French Data Protection Act)

• Firebase Authentication — keeps your session active when you access your account area. Duration: session.
• `mcm.consent` (browser local storage) — stores your cookie consent choice. Duration: until manual deletion or consent version change.
• Google Tag Manager — script that conditionally loads other tags based on your consent. Does not set any cookies of its own.

Audience-measurement cookies (set only after your consent)

Google Analytics 4 (measurement ID G-MY71C17TB0) — anonymized traffic and user-journey measurement. Cookies set: _ga, _ga_PF7C3779. Maximum lifetime: 13 months. Provider: Google Ireland Limited; transfer to the United States covered by the European Commission's Standard Contractual Clauses and the Data Privacy Framework.

The consent mechanism uses Google Consent Mode v2: until you consent, no user data is transmitted to Google. If you refuse, Google Analytics sets no cookies on your device and receives no identifying information.

Payments via Stripe

When you click "Buy", you are redirected to checkout.stripe.com (a domain operated by Stripe Payments Europe Limited). Stripe sets its own fraud-prevention cookies there (__stripe_mid, __stripe_sid), strictly necessary for secure transaction processing and not requiring prior consent (art. 82 LIL). These cookies are not set on fyncha.com.

This policy may be updated to reflect regulatory or technical changes. The date of the last modification is shown at the top of the page. In case of substantial modification, active users are informed by email.