Privacy Policy
Writizzy respects your privacy and is committed to protecting your personal data. This policy explains what we collect, why, on what legal basis, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).
Data controller
The data controller is Hugo Lassiège (Writizzy), 15 Rue Hector Berlioz, 69410 Champagne-au-Mont-d'Or, France. For any privacy request, contact contact@writizzy.com. We have not appointed a Data Protection Officer (not required for our size), but the contact above handles all data matters.
For the audience of a blog (its subscribers, members and visitors), the creator of the blog is the controller and Writizzy processes the data on their behalf, under our Data Processing Agreement. We remain the controller of the reader accounts themselves, and of the features we run across blogs, such as Discover and blog recommendations.
What we process, and why
We only collect what we need to run the service. The table below lists each purpose, whose data it concerns, the data involved, the legal basis, and how long we keep it.
| Purpose | Whose data | Data | Legal basis | Retention |
|---|---|---|---|---|
| Account & authentication | Creators, readers with an account | Email, username, password hash | Performance of contract | Life of the account, then deleted |
| Hosting your content | Creators | Posts, media, blog settings | Performance of contract | Life of the account; backups rotated |
| Reader & newsletter subscriptions | Subscribers and members of a blog | Email, name, tier, sign-up source, newsletter opens and clicks | Processed on behalf of the creator (see our DPA) | Until unsubscribe or account deletion |
| Blog analytics | Visitors of a blog | Pages viewed, referrer, country, device, browser. The IP address is only used to derive the country and is not stored | Processed on behalf of the creator (see our DPA) | 90 days, 12 months or the life of the blog, depending on the creator's plan |
| Paid subscriptions | Creators on a paid plan | Billing metadata (payments handled by Stripe) | Performance of contract; legal obligation | Up to 10 years (accounting law) |
| Service emails | Creators, readers with an account | Email address, delivery events | Performance of contract | Life of the account |
| Product analytics | Visitors of writizzy.com, creators | Usage events, approximate location, device | Legitimate interest / consent | Up to 12 months |
| Error monitoring & security | Anyone using the service | Technical logs, IP address | Legitimate interest | Up to 90 days |
| Support | Anyone who contacts us | Messages you send us, email | Legitimate interest | Up to 3 years after last contact |
Newsletter consent
Newsletter subscriptions collected through our subscription forms follow a double opt-in process: the subscription only becomes active once the reader has confirmed their address from the email we send them. Consent is given to a single blog and can be withdrawn at any time, with immediate effect, from the unsubscribe link present in every newsletter or from the one-click unsubscribe header (RFC 8058).
Who we share data with (sub-processors)
We never sell your data. We rely on a small number of vetted processors who act on our instructions:
| Processor | Purpose | Location |
|---|---|---|
| Stripe | Payment processing for paid subscriptions | Stripe Payments Europe, Ltd. — Ireland (EU) |
| Hetzner Online GmbH | Application & database hosting (servers, storage, backups) | Germany (EU) |
| Scaleway | Backups, Transactional email delivery (TEM) | Scaleway SAS — France (EU) |
| Amazon Web Services (SES) | Newsletter email delivery | Amazon Web Services EMEA SARL — Paris region, France (EU) |
| Mistral AI | Spam moderation, similar post suggestions, automatic translation | Mistral AI SAS — France (EU) |
| Sentry | Application error monitoring | Functional Software, Inc. — United States (SCCs) |
| bunny.net | Content delivery network (CDN) & media storage | BunnyWay d.o.o. — Slovenia (EU) |
International transfers
We host data in the EU wherever possible. Where a processor operates outside the EU (such as Sentry in the United States), we rely on the EU-U.S. Data Privacy Framework when the processor is certified, and keep the European Commission's Standard Contractual Clauses (SCCs) in place as a fallback.
Your rights
Under the GDPR you can:
- Access the data we hold about you
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict or object to certain processing
- Receive your data in a portable format
- Withdraw consent at any time
You can delete your account from your settings at any time, or contact contact@writizzy.com. You also have the right to lodge a complaint with the French data protection authority, the CNIL.
Security
We protect your data with industry-standard measures: encryption in transit, hashed passwords, access controls, and daily backups. No system is perfectly secure, but we work to keep your data safe.
Cookies
For details on cookies and analytics, see our Cookie Policy.
External links
Our site and user blogs may link to external sites we don't control. We are not responsible for their privacy practices.
Changes
We may update this policy. Material changes will be communicated through the service.