← Home

Privacy Policy

Last updated: août 2026

This page explains what data Ouvella collects, why, and how you can control it.

Data controller

The data controller can be contacted at contact@ouvella.com.

Data you entrust to us

To create a gift, you may provide: a title and some text, photos, a voice recording or music, a date, and — if you choose that option — a secret word. An email address is requested at payment so we can send your links back to you. If your creation is still awaiting payment, we may use this address once to send you the link to resume it; you can opt out by simply replying to that email.

How this data is protected

If you choose a secret word, it's never stored in plain text (it's hashed). The surprise's content is then revealed only after the correct word is entered. Your content is never used for advertising purposes or resold to third parties.

Retention period

Your gift stays accessible for at least 5 years, unless you disable it or request its deletion. You can disable a gift at any time from your private management link.

Subprocessors and data transfers

Ouvella entrusts certain technical operations to the providers below. No bank card data passes through Ouvella (payment is handled by Stripe). Any transfers outside the European Union are governed by the EU Standard Contractual Clauses (SCC) and/or the EU-US Data Privacy Framework:

  • Vercel Inc.Application hosting. Location: United States (EU regions available, including Frankfurt). Transfers outside the EU governed by: EU Standard Contractual Clauses (SCC) 2021/914 + EU-US Data Privacy Framework. DPA
  • Neon Inc. (groupe Databricks)Database. Location: European Union — Frankfurt (AWS eu-central-1). Transfers outside the EU governed by: EU Standard Contractual Clauses (SCC) 2021/914 + EU-US Data Privacy Framework. DPA
  • Cloudflare, Inc.Media storage (photos, audio). Location: European Union (R2 "eu" jurisdiction). Transfers outside the EU governed by: EU-US Data Privacy Framework + EU Standard Contractual Clauses (SCC) 2021/914. DPA
  • Stripe Payments Europe, LtdPayment (no card data passes through the site). Location: Ireland (EU); processing may involve the United States. Transfers outside the EU governed by: EU Standard Contractual Clauses (SCC) 2021/914 + EU-US Data Privacy Framework. DPA
  • Plus Five Five, Inc. (Resend)Transactional emails. Location: United States. Transfers outside the EU governed by: EU Standard Contractual Clauses (SCC) 2021/914 + EU-US Data Privacy Framework. DPA
  • Upstash, Inc.Rate limiting (Redis). Location: European Union — Frankfurt (AWS eu-central-1). Transfers outside the EU governed by: EU-US Data Privacy Framework + EU Standard Contractual Clauses (SCC) 2021/914. DPA

Your rights

Under the GDPR, you can request access to, correction of, or deletion of your data by writing to contact@ouvella.com. You can also edit or disable a gift directly from your management link. You have the right to lodge a complaint with the French data protection authority (CNIL).