Privacy policy
Version 1.2 of . The French version is authoritative.
In short
- You type in one required piece of information: your email address, and you tick a box.
- It is used to note your pre-order without payment and to write to you when something real happens: the sample, the measurements, then the date and the price, plus brand news and, at most, one or two questions about your needs.
- If you answer the questions asked after signing up (profile, city, use, quantity in mind, sample test, and for professionals the name and type of venue), those answers are kept with your address. They are optional.
- No resale, no profiling, no cookies, no analytics, no tracking pixels in emails. One exception, and only if you tick a second, optional box: we tell Meta that your sign-up happened, with your address sent in hashed form.
- One click cancels your pre-order and stops the emails, in every email. To have everything deleted, write to nissielthomas@avafirstai.com: it is done the same day.
1. Who is responsible for your data
Nissiel Thomas, natural person, trading as NISSIYO.
- Status and registration: natural person, pre-launch activity, registration in progress.
- Address: Biarritz, France (full postal address on request by email).
- Contact for any question about your data: nissielthomas@avafirstai.com
2. What we collect
When you pre-order, we store:
| Data | Where it comes from | What it is for |
|---|---|---|
| Your email address | You type it in | Writing to you, finding your pre-order |
| Date and time of sign-up, and the version of the consent text you ticked | Added automatically | Proving your consent and knowing which text you read |
| The language of your browser or of the page (French or English) | Added automatically | Writing to you in your language |
A "source" label (for example site, friend, or the code of an outreach link) | Added automatically from the link you used | Knowing which way you arrived. It does not follow you on other sites |
Campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and the Meta click id (fbclid) present in the address of the page you land on, plus the country inferred from your connection (two letters, never the IP address) | Read from the page address; nothing is stored in your browser | Knowing which ad brought a sign-up |
| Your optional answers: profile (I practise, I teach, studio or shop), zone, use, quantity in mind by range, sample test; for professionals, name and type of venue, city, practitioners per week | You choose them, one question at a time, or from the /pro page or the "Answer in three taps" link in the email | Deciding who practises on the sample, setting the weight to aim for, and writing to you about what concerns you |
We do not collect: your name (except the name of a professional venue, if you give it), phone number, postal address, payment details, location (beyond the two-letter country above), or any data about your browsing.
Technical logs. Like any website, our host Vercel's servers briefly record connection data (IP address, time, page requested, browser). It is used to run and secure the site. We do not use it to identify or track you.
3. Why we use it
- To note your pre-order without payment.
- To write to you when something real happens: the sample, the measurements, then the date and the price, brand news, and at most one or two questions about your needs. Every email includes a one-click link to cancel.
- To prepare Series 01 with your answers: choosing the cities the sample travels to, aiming for the right weight, writing to professionals with conditions that concern them.
- To answer your requests (questions, deletion, access).
- To protect the site against abuse (technical logs).
- To measure our ads, if you accept. If you tick the optional "Meta" box, we send Meta Platforms Ireland, from our server, a "sign-up" event and then, if you answer the quantity question, an "intent" event. That call contains your email address hashed (SHA-256, irreversible), the ad click id if there is one, your IP address and browser name at the time of sign-up, and the country. Meta uses it to count sign-ups that came from our ads and to stop showing them to people already signed up. Without the box, nothing is sent, not even anonymously.
We do not:
- sell, rent or swap your address;
- profile you, or run targeted advertising beyond the case in point 6, which depends on a box only you tick;
- make automated decisions;
- put tracking pixels in emails.
Any use beyond this list would first require a new, explicit consent.
4. Legal basis
| Use | Legal basis |
|---|---|
| Pre-order and emails | Your consent (Article 6(1)(a) GDPR), given by ticking the box under the form, unticked by default. We record the version of the text you ticked and the date. You can withdraw it at any time, without giving a reason, through the link in every email or in writing. Withdrawal does not affect what was done before. |
| Preparing Series 01 with your answers | Your consent, given by answering; every question can be skipped. |
| Reporting the sign-up to Meta | Your consent (Article 6(1)(a) GDPR), given by a second, separate box, unticked by default, whose version and date we record. Withdrawable at any time in writing; an event already sent cannot be recalled, but nothing is sent afterwards. |
| Answering your requests | Our legal obligations (Articles 12 to 22 GDPR) |
| Site security | Our legitimate interest in protecting the site (Article 6(1)(f) GDPR) |
Under Israeli law, this processing also rests on your consent under the Privacy Protection Law 5741-1981.
5. Do you have to give us your address?
No. No law requires it, and you can browse the site without signing up. If you do not give it, the only consequence is that you will not receive the Series 01 price and date email.
6. Who can access your data
Only the publisher uses your data. Technical providers have access on the publisher's behalf, only on the publisher's instructions and never for their own purposes:
| Provider | Role | Where |
|---|---|---|
| Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 | Database of pre-orders and answers, in a project opened in Nissiyo's name | Servers in Paris, France, on Amazon Web Services infrastructure. Support and maintenance may happen from Singapore and the United States |
| Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States | Site hosting and running the form | Global network; the form runs in Paris, France. The site currently uses Vercel's free "Hobby" plan, with no signed data processing agreement; as Vercel Inc. is a US company, access from the United States remains possible. This will be settled when moving to a professional plan |
| Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, United States | Sending the emails (welcome, news, date and price) and keeping the list of unsubscribed addresses | Sent from the European Union region (Ireland); US company, access from the United States possible |
| Notion Labs, Inc., 2300 Harrison Street, San Francisco, CA 94110, United States | Pre-order tracking table (address, language, source, answers), the publisher's working tool | United States |
| Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland | Receives the sign-up event described in point 6 of section 3, only if you ticked the box. Joint controller for this measurement under Article 26 GDPR | Ireland; transfers to Meta Platforms, Inc. (United States) possible, see section 7 |
We may also disclose data where a court or public authority lawfully requires it.
7. Transfers outside the European Union
Your data is stored in France (database) and in Ireland (email sending). Three US providers access it from the United States to run and support the service: Vercel Inc., Resend, Inc. and Notion Labs, Inc. These transfers rest on the European Commission's standard contractual clauses built into their terms and, for those certified under it, on the EU-U.S. Data Privacy Framework, found adequate on 10 July 2023. You can get a copy by writing to nissielthomas@avafirstai.com.
If you ticked the Meta box, the sign-up event goes to Meta Platforms Ireland Limited; transfers to Meta Platforms, Inc. (United States) are possible, on the basis of the EU-U.S. Data Privacy Framework and the standard contractual clauses.
8. How long we keep it
Your address, your answers, the date and the source are kept while Series 01 is being prepared, then deleted at the first of these events:
- the same day you ask for deletion;
- 12 months after Series 01 is delivered;
- 3 years after you signed up if Series 01 has not been delivered.
One-click cancellation. When you cancel, the emails stop the same day and your address is marked as left. The row (address, version of the ticked text, sign-up date, leave date) is kept as proof of your consent and of your withdrawal, then deleted with the list. To have everything removed right away, write to us: it is done the same day.
Backups. After deletion, your address may still exist for up to 7 days in the database's automatic backups, which are not accessed. It then disappears on its own.
Vercel's technical logs. The site's runtime logs are kept by Vercel for 1 hour. They do not record your email address.
Database logs. An address signed up twice is silently ignored by the database; no error message containing the address is written to the logs.
Your requests. We keep only the date and type of request, without your address, to prove we answered. The exchange itself is deleted once the request is handled.
9. Your rights
At any time you can:
- access your data and get a copy;
- have it corrected;
- have it deleted;
- withdraw your consent;
- restrict its use;
- receive it in a common format (portability);
- leave instructions about your data after your death (French law).
Right to object (Article 21 GDPR).
- You can object at any time, without giving a reason, to your address being used to write to you about our products. We then stop immediately.
- You can also object to the processing of connection data for site security, on grounds relating to your particular situation.
Meta box. You withdraw that consent by writing to nissielthomas@avafirstai.com: nothing is sent afterwards. You can also exercise your rights with Meta directly, through the advertising settings of your account.
Israeli law. The Privacy Protection Law 5741-1981 gives you, among other rights, the right to see your data, to have it corrected or deleted, and to be removed from any list used to contact you.
10. How to exercise your rights
- Write to nissielthomas@avafirstai.com, or by post to the address given on request (section 1).
- Ideally write from the address you signed up with: this lets us confirm the request is yours without asking for ID.
- Deletion: the same day. Other requests: within one month at the latest.
- It is free.
11. Complaints
If you think your rights are not respected, please write to us first. You can also go directly to a supervisory authority:
- France: Commission nationale de l'informatique et des libertés (CNIL), Service des plaintes, 3 Place de Fontenoy, 75007 Paris. Online: https://www.cnil.fr/fr/adresser-une-plainte
- Israel: Privacy Protection Authority (הרשות להגנת הפרטיות), Ministry of Justice: https://www.gov.il/en/departments/the_privacy_protection_authority
- Or the data protection authority of your country of residence in the European Union.
12. Cookies
The site sets no cookies. It uses no browser storage, no analytics, no advertising, no pixels, and no social media buttons or embeds. Fonts are served from the site itself. No cookie banner is needed.
The site reads the campaign parameters in the page address; it writes them nowhere in your browser.
One technical detail: code supplied by Vercel checks whether a cookie reserved for the site's own technical team is present, to show their preview tool. For visitors, that cookie does not exist and nothing is stored.
If this changes, this policy will be updated first, and your consent will be asked where the law requires it.
13. Security
- All connections to the site are encrypted (HTTPS enforced).
- The database is hosted in the European Union, in a project in Nissiyo's name.
- The site can only add an address and answers, mark a departure, and record a profile: it cannot read, list or delete the list. Answers can only be added from the personal link in the email or the screen that follows sign-up.
- Access to the list is reserved to the publisher.
- If a data breach puts you at risk, we notify the competent authorities and, where required, the people affected, within the legal deadlines.
14. Minors
Pre-ordering is for people aged 18 and over. We do not check age, but if we learn that a minor has signed up, we delete the address.
15. Changes
We will update this policy if the way we use your data changes, for example when sales open and terms of sale are published. The date and version number at the top change with every update. Any new use of your address will require your consent first.
Version 1.2, .