Privacy notice

Who is responsible

Multiplatforge is the data controller for everything described here. No data protection officer has been appointed.

In short

• We measure visits with analytics software that we host and operate ourselves, in France, without cookies and without keeping your IP address in the stored statistics; no third party receives the measurement data. You can turn the measurement off for your browser with the switch in section 8, and nothing is measured if your browser sends the Global Privacy Control signal.
• Cloudflare sits in front of the site as a content delivery network and protection layer. It sets one security cookie, used only to tell browsers apart from automated traffic.
• The contact form sends your message to our mailbox and to our private team messaging service. The website keeps no copy.
• The site is hosted on Amazon Web Services in the Paris region.
• We do not sell data, show advertising, track you across other sites, or make automated decisions about you.

1. Delivering and protecting the site: Cloudflare

Every request to multiplatforge.com, and to our analytics address t.multiplatforge.com (section 2), passes through Cloudflare, Inc., which we use as our content delivery network, TLS endpoint and protection layer (web application firewall, DDoS protection, a rate limit on form submissions, bot detection). Like any intermediary carrying the connection, Cloudflare receives your IP address, the address of the page you request and your browser's request headers. Cloudflare also produces aggregate traffic statistics for the site on its side. Cloudflare's optional features that only measure visits or report network errors from your browser (Web Analytics and Network Error Logging) are switched off.

Three Cloudflare mechanisms run in your browser:

• Bot detection. Cloudflare loads a small script on each page and sets a cookie named cf_clearance on multiplatforge.com and its subdomains, valid for one year. It tells browsers apart from automated traffic. We use it for nothing else. Being strictly necessary to protect the site, it needs no consent; it is the only cookie the site sets.
• Turnstile. The contact form uses Cloudflare Turnstile, loaded from challenges.cloudflare.com on the home page, to block automated submissions (every page opens a connection to that address in advance so that the form loads quickly). Our server accepts a message only after Cloudflare has confirmed the Turnstile token.
• Email address protection. On pages that show an email address, such as this one, Cloudflare obscures the addresses written in the page's HTML (links and text), which keeps them from the simplest automated harvesters (the address still appears in plain text in the page's embedded data, so the protection is partial), and loads a small script from our own domain (email-decode.min.js, under /cdn-cgi/) that displays it. The script sets no cookie.

Purpose: serving the site quickly and protecting it against abuse. Legal basis: our legitimate interest in the security and availability of the site (GDPR article 6(1)(f)).

2. Measuring the audience: our own analytics

We count visits with self-hosted product analytics software that we operate ourselves on our own servers in Tours, France. No third party receives the measurement data. The measurement requests your browser sends to t.multiplatforge.com do travel through Cloudflare (section 1), which terminates the encrypted connection and forwards it to our servers through a private tunnel: Cloudflare therefore carries your IP address, your browser's request headers and the content of each measurement event in transit, as it does for the rest of the site.

How it counts without cookies. The measurement script on this site runs in cookieless mode: it sets no cookie and writes nothing to your browser's storage. To tell visits apart, our server computes a hash from your IP address, your browser's user-agent string, this site's domain, and a random secret value that is generated for each day and deleted 96 hours after it was created. On the same day your visits produce the same hash; the next day they produce a different one. Once a day's secret is deleted, the hashes made with it can no longer be traced back to an IP address or linked to those of other days. Your IP address and raw user-agent string are removed before the event is stored. Until then they are held in our incoming queues, which delete data after 24 hours. [PENDING: the 24-hour window is being put in place; until it is live, the queues delete data after 72 hours, in blocks that can each span up to 7 days, so an IP address can remain there for up to about 10 days, or about 14 days for the rare events that fail processing] If a request to our analytics server fails, the server's error log may also record your IP address; our server logs are kept for about one month. Before your IP address is removed, our server looks up the country it belongs to in a database stored on our own servers (no outside service is asked), and keeps only that country with the event. [PENDING: the country lookup is being put in place; until it is live, no location is derived from your IP address] Session recording (replay) is switched off. Measurement runs only on multiplatforge.com, never on our development site.

What a stored event contains. The time of the event; the page address, including any query string in the link you followed; the page you came from (referrer); the page title; browser and operating system names and versions; device type and, where your browser reveals it, device model (for example the model name of a phone); screen and window sizes; time zone and browser language; the country derived from your IP address [PENDING: once the country lookup is live]; a page-view identifier; session, device and visitor identifiers that our server derives from the daily hash above; how long you stayed on the previous page and how far you scrolled through it; and, for a click, the element clicked and its visible text (for example a button or link label), together with the technical description of that element and of the elements containing it (their tag names, their position among neighbouring elements, and their HTML attributes such as style classes, inline styles, identifiers, accessibility labels and link targets; for form fields only their name, identifier, classes and accessibility label). The events recorded are page views, page exits, clicks on page elements, repeated rapid clicks ("rage clicks"), form submissions, and changes to form fields (which element was clicked, changed or submitted, never what you type). Page loading timings (web vitals) are not captured.

Purpose: knowing which pages are visited, how the site performs and where it breaks. Legal basis: our legitimate interest in measuring the audience of our own site (article 6(1)(f)). You can object: see section 8, which holds the switch that turns the measurement off for your browser. If your browser sends the Global Privacy Control signal, the measurement script is never started and nothing about your visit is sent to our analytics.

3. The contact form

The form asks for your name, email address, a subject and your message, together with a Turnstile token (section 1). All fields are needed to answer you; nothing else is collected.

When you submit the form, our server:

1. checks the Turnstile token with Cloudflare;
2. emails your message, through Amazon SES in the Paris region, from [email protected] to our mailbox [email protected], with your address as the reply-to address;
3. posts a copy (name, email, subject, message and time) to a private channel of our team messaging service, so that we see it quickly.

The website itself keeps no copy of your message: it has no database. If sending fails, our server logs which step failed and the type of error, never your message or contact details. We keep a delivery record of each message for 30 days in our AWS account: when it was sent, its message identifier, the sending address, our receiving address and whether it was delivered (with the receiving server's technical response), never your address, the subject or your message. We typically answer within 48 hours. Your message stays in our mailbox and in our team messaging service until we delete it: neither deletes it automatically. You can ask us to delete it at any time at [email protected].

Purpose: answering your request. Legal basis: steps taken at your request before a possible contract (article 6(1)(b)), and otherwise our legitimate interest in answering correspondence (article 6(1)(f)).

4. Hosting: Amazon Web Services

The site's files and the server code that handles the contact form run on Amazon Web Services in the Paris region (eu-west-3), delivered through Amazon CloudFront's edge locations in Europe, North America and Israel. CloudFront access logging is switched off. The form server writes technical logs (start, end and duration of each run, and error reports that name the failure only), kept for 90 days; they contain no IP addresses, messages or contact details. Fonts and images are served from our own site; no font or image is fetched from a third party.

Purpose and legal basis: making the site available, our legitimate interest (article 6(1)(f)).

5. What the site stores in your browser

• Nothing from the measurement script.
• The cf_clearance security cookie from Cloudflare, one year (section 1).
• An email address you type in the field at the top of the home page only pre-fills the contact form on the same page: the site does not store it, and it reaches us only if you submit the form. Earlier versions of the site kept it in your browser's local storage under heroEmail; the site now deletes that leftover the next time you open the home page.
• If you turn the measurement off (section 8), a single entry, analytics-opt-out, in your browser's local storage, so that the site remembers your choice on every page and visit. It holds no identifier, is never sent to us, and needs no consent because it only records your objection. It stays until you turn the measurement back on or clear the site's data (which turns the measurement back on).

6. Where your data goes

We share no personal data with anyone for their own use. The service providers that process data on our behalf for this site are:

Analytics data (section 2) is stored only on our own servers in France, with a backup copy in the AWS Paris region (section 7); Cloudflare only carries it in transit to those servers. No third party receives it.

You can ask us at [email protected] for a copy of the safeguards that cover a transfer outside the European Union (the European Commission's standard contractual clauses, or the provider's certification under the EU-U.S. Data Privacy Framework, which is public on dataprivacyframework.gov).

7. How long we keep data

8. Your rights

Under the GDPR you may ask for access to the personal data we hold about you, have it corrected or erased, ask us to restrict its use, object to its use, and receive the data you gave us in a portable format. Write to [email protected]; we may ask you to confirm your identity. You may also lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr). We make no decision about you by automated means.

Objecting to audience measurement. You may object at any time:

• The switch above turns the measurement off for this browser at once: no further event is recorded, on this page or any later one, and the measurement script is no longer started on the pages you open (events recorded just before you turn it off may still be sent). The choice is kept in your browser as described in section 5; it applies to this browser only, so repeat it on each browser you use.
• Until that day's secret is deleted, which happens about 2 to 4 days after your visit depending on the time of day you visited, your events can be found again from the IP address and the exact user-agent string your browser used: if you send us both within that time, we will look for those events and erase them; copies in our backups expire with those backups (section 7). Once the secret is deleted, the stored events hold no identifier that we can match to you, so an objection then takes effect for your future visits.
• The site honours Global Privacy Control, a signal some browsers send by default and others after a setting or an extension: when your browser sends it, the measurement script is never started, so nothing about your visit reaches our analytics, on every visit, for as long as the signal is on. The older Do Not Track signal is not read.
• Blocking requests to t.multiplatforge.com (our analytics) with a content blocker or your browser's settings also stops the measurement entirely. The site works without it.

9. Changes

We update this page and its date before a change in practice takes effect.