Quelles données, et pourquoi
- Email address (you provide it when you register) — to log in (email plus password, and reset-password links) and to send subscription and renewal notices.
- A password hash (never the password itself) — to check logins.
- Billing country (returned by Paddle after payment) — to apply the right tax. It does not decide which language of the course you can watch.
- Subscription and purchase records (from Paddle) — to decide what you can watch.
- Watch history (created as you use the service) — for the continue-watching feature.
- Referral codes (URL parameters when you arrive via a dealer link) — to calculate dealer commission.
- Comments and tickets you submit — to show other members and to answer you.
- If you subscribe to practice-reminder email: the address, language, time of consent and IP at that moment — to prove the consent exists.
Nous ne collectons pas : le mot de passe en clair, les données de carte (Paddle les traite ; nous ne les voyons jamais), ni d’informations de santé.
Bases juridiques (article 6 du RGPD)
- Providing the service you bought: contract (Art. 6(1)(b)).
- Transactional email (login, renewal reminders, invoices, purchase confirmation): contract.
- Keeping accounts and tax records: legal obligation (Art. 6(1)(c)).
- Marketing email: your consent (Art. 6(1)(a)), which you can withdraw at any time.
- Showing comments you wrote: your consent (Art. 6(1)(a)).
- Moderating comments: legitimate interests (Art. 6(1)(f)) — to keep false claims about disease and results off the site.
- Dealer attribution: legitimate interests (Art. 6(1)(f)) — to calculate commission we owe dealers. You may object.
Cookies
We use only two cookies. One is an httpOnly session cookie that keeps you logged in; without it login cannot work. The other stores the interface language you chose on the home page, as a language code only (for example de), so you do not have to choose again; you can change it on any page. Both are strictly necessary, so we do not ask for consent.
We do not use tracking, advertising or third-party analytics cookies. Dealer attribution does not use cookies either — the referral code travels in the URL, or is the discount code you actually used.
Sous-traitants et lieu de conservation
- Paddle — payments, tax, invoices.
- Supabase — database, stored in the EU (Frankfurt, eu-central-1).
- Bunny — video delivery, stored in the EU (Frankfurt).
- Render — the website, in the EU (Frankfurt).
- Resend — transactional email, EU region (Ireland).
- MailerLite — practice-reminder and similar marketing mail, data centres in Germany and the Netherlands. Only if you subscribed to those emails.
Each processor is bound by a data-processing agreement (Supabase's DPA takes effect with its terms). Where a transfer outside the EU is needed, we rely on Standard Contractual Clauses.
Durée de conservation
Les données de compte sont conservées pendant l’existence du compte. Après suppression, un délai de 30 jours permet d’annuler une suppression accidentelle, puis elles sont effacées sauf obligation légale. Les pièces comptables sont conservées 10 ans à compter de la fin de l’année concernée.
Vos droits
Vous pouvez accéder à vos données, les rectifier ou les effacer, limiter ou vous opposer au traitement, et en obtenir une copie portable. Écrivez à service@hxfdaoyin.com. Nous répondons sous 30 jours.
Nous sommes établis hors de l’UE et désignons un représentant dans l’UE au titre de l’article 27 du RGPD. Tant que cette désignation n’est pas publiée ici, adressez les demandes liées à service@hxfdaoyin.com. Ensuite, le nom et les coordonnées du représentant figureront dans cette section.
L’exploitant de ce service peut changer. Nous vous en informerons par courriel.
