Privacy and cookie policy

Vicou Studio · Last updated: 2 August 2026

This page sets out what personal data is collected on vicou.studio, why, how long it is kept and what rights you have over it. Your data is used to reply to you and to build your website; it is neither sold, nor rented, nor passed on. Any question: contact@vicou.studio.

1. Who is responsible for your data

Victor Rouvreau, sole trader (entrepreneur individuel, EI), micro-entreprise regime, trading as Vicou Studio SIREN 901 766 451 · SIRET 901 766 451 00016 68 rue de la Gare, 45000 Orléans, France · contact@vicou.studio VAT not applicable, article 293 B of the French General Tax Code (code général des impôts)

No data protection officer has been appointed.

One point of transparency, said plainly: Victor Rouvreau lives in Bangkok, Thailand. The business is registered in France, French law and the GDPR apply, but your data is consulted daily from a country outside the European Union (section 7).

2. What this page covers, and what it does not

It covers the vicou.studio website and its demonstration mock-ups (presentation pages, not the delivered website), the call-back form, the personal space, the exchanges that follow, the service itself and its invoicing.

It does not cover the website delivered to you. On that website, you decide what data you collect and why: you are the controller for it and you must publish your own policy. The hosting, the domain name and, where applicable, the professional email addresses are opened on accounts in your name. When I work in your administration area, I act for you and on your instructions, as a processor within the meaning of the GDPR.

My undertakings as a processor are written into article 19 of the terms and conditions of sale: I act on your instructions alone, I use your data for no purpose of my own, and I keep no copy of it beyond what performance requires. I keep no access to your administration area once the site is live: on that date I stop using it and I invite you to change the password.

3. The data collected

3.1 The call-back form. It records your first name, surname and telephone number, which are required, plus your email address, your trade, your preferred time slot and a description of your project, which are optional. Without the first name, surname and telephone number the request cannot be handled; the optional fields may be left empty, with no consequence. Added automatically are the template viewed, the package and platform being considered, and the page you came from. Do not write anything sensitive in the free-text field: no health data, no opinions, no bank details.

3.2 What is recorded technically. Each submission adds the date, the time and your IP address. An IP address is personal data: kept in the clear in the log of requests, on the server, it serves to identify the origin of an abusive submission and to establish that a request was indeed received. An anti-abuse counter limits the number of submissions per hour without keeping any IP address, only a truncated fingerprint erased after one hour. Submissions from robots are set aside: a request judged doubtful is still recorded but may not be passed on to me, so write to me again if you receive no reply.

3.3 The personal space and the videos. It gives access to the videos that show you how to change your website yourself: they are included in the package where you build the site yourself, and available as an option on the other two; without them, no account is created. The account records your email address, your first name, a fingerprint of your password and of any invitation link in progress (never their value in the clear), the dates of creation and of last sign-in, and how far you have watched. The latter serves to pick up where you left off, and to establish, in the event of a dispute, that the content was indeed supplied to you.

3.4 Payment, WhatsApp, exchanges. Payment is handled by Stripe, on its own servers: your bank details never pass through vicou.studio and are never recorded by Vicou Studio, only the identity, the amount, the date and the status are. The WhatsApp Business button is optional; if you use it, Meta processes your number and your messages under its own terms. Finally, the exchanges relating to the project are kept: emails, call notes, items supplied (text, photographs, logo), quotes, invoices, payment tracking. This data is stored on the website’s server or in the business mailbox, with restricted access. In the event of a breach likely to give rise to a high risk to your rights, you will be informed.

4. Why this data, and on what basis

Where processing rests on legitimate interest, you may ask for the balancing test carried out and object to it (section 9).

What is not done: no sale, rental or transfer to a data broker or an advertiser, no newsletter, no advertising profiling, no tracking of your browsing, no bank data kept. Your address is never added to a canvassing list bought or built elsewhere, and if your request goes unanswered I may write to you once more, about the project you told me about: one word is enough for me to stop writing.

5. How long your data is kept

Said plainly: only the anti-abuse counter and the session cookie erase themselves. The log of requests, the emails and the client files are erased by hand, and no scheduled deletion is in place to date. You may ask for erasure at any time (section 9).

6. Who else has access to your data

Your data is not disseminated. The following have access to it, each within the scope of their own task alone:

• Victor Rouvreau, the only person handling requests and client files, as controller;
• IONOS SARL (France), which hosts the website files, the log of requests and the business mailbox, and routes the emails from the form, as a processor;
• Abby (France), which issues the quotes and the invoices, as a processor;
• Stripe (payment, receipts) and Meta (WhatsApp) if you choose that channel, which act as independent controllers for their own purposes, including fraud prevention;
• where applicable a chartered accountant, the tax or social security authorities, or a legal officer, under a legal obligation or in defense of my rights.

7. Access and transfers outside the European Union

1. Access from Thailand. Victor Rouvreau lives in Bangkok and consults from that country the requests received, the client files, the business mailbox and, during set-up and support, the administration area of the website delivered to you. Thailand is not the subject of an adequacy decision of the European Commission. This is nonetheless not a transfer within the meaning of the GDPR: your data remains hosted in France, with IONOS, and it is the controller himself who consults it remotely, not a third-party recipient. Guidelines 05/2021 of the European Data Protection Board hold that a transfer presupposes two distinct entities, an exporter and an importer, which is not the case here. Access is over an encrypted connection, from accounts protected by a password specific to each service.
2. Stripe (payment) and Meta (WhatsApp) if you use that channel: part of their processing takes place in the United States. These transfers are governed by the adequacy decision of the European Commission of 10 July 2023 on the EU-US Data Privacy Framework, to which both companies have self-certified, and, in addition, by the Commission’s standard contractual clauses.

You may obtain a copy of the safeguards covering these transfers by writing to contact@vicou.studio, and you can avoid point 2 by not using WhatsApp.

8. Cookies

The Site places no audience measurement tool, no advertising tracker and no social network button: no Google Analytics, no Meta pixel. Fonts are hosted on the site itself. No consent banner is therefore shown to you: there would be nothing to consent to. Were a measurement or advertising tool ever added, a banner would be put in place and this page updated before anything was placed.

The only two cookies placed:

Strictly necessary for the service you request, namely signing in to your space, they are exempt from prior consent under the French rules on trackers, whose CNIL guidelines cover authentication cookies. They are placed only if you use the personal space; blocking them in your browser makes it unusable.

9. Your rights

Over the data concerning you, you may: obtain a copy of it; have what is inaccurate corrected; ask for its erasure; ask for processing to be frozen while a check is carried out; retrieve, in a machine-readable file, the data you provided and have it sent elsewhere; object to processing based on my legitimate interest; withdraw your consent where it rests on consent, for example the presentation of your website as a reference. These are the rights set out in articles 15 to 21 of the GDPR.

You may also give directions on what is to happen to your data after your death and appoint a person to see them carried out (article 85 of French Act No. 78-17 of 6 January 1978 as amended).

To exercise them, write to contact@vicou.studio or to the address in section 1, stating which right is concerned. Proof of identity is asked for only where there is reasonable doubt, and only so far as necessary to remove it. Reply within one month, extendable by two months for a complex request, with notice and reasons given.

If, after contacting me, you consider that your rights are not respected, you may refer the matter to the CNIL: www.cnil.fr, or CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

10. Minors, changes, language and governing law

The Site is not intended for minors and does not knowingly collect their data. Data concerning a minor sent by mistake is deleted on simple notification.

The applicable version of this policy is the one published on this page, at the date shown at the top. Should a tracker or a new recipient be added, you will be informed before it is put in place.

The Site is available in French and in English. In the event of a discrepancy, the French version prevails; and in the event of doubt as to the interpretation of a clause, that clause is interpreted in the sense most favorable to the consumer, in accordance with the French Consumer Code (code de la consommation). This policy is governed by French law, the GDPR (Regulation (EU) 2016/679) and French Act No. 78-17 of 6 January 1978 as amended. If you are a consumer residing in another Member State of the European Union, that choice does not deprive you of the protection of the mandatory provisions of the law of your country of residence.