Privacy policy
This is a courtesy translation. In the event of any discrepancy between this English version and the French version, the French version prevails.
PRIVACY POLICY OF MY SELF KEY (MSK)
Last updated: 24 October 2026
This policy describes how we handle your personal data when you visit myselfkey.fr, place an order or contact us. The My Self Key app (account, loved ones, alerts, locations, QR page) is covered by a separate policy: qr.myselfkey.fr/confidentialite.
1. Who is responsible for your data
MY SELF KEY (MSK), a simplified joint-stock company with share capital of €1,000, registered office at 90 bis rue de Fougères, 35700 Rennes, France, registered with the Rennes Trade and Companies Register under number 105 392 898, is the controller of the processing described below.
For any question, or to exercise your rights: contact@myselfkey.fr.
2. The data we collect
- Identity and contact details: surname, first name, email address, delivery and billing address, phone number, required for delivery (Sendcloud and Mondial Relay use it to contact you about your parcel and tell you when it arrives).
- Order data: products ordered, amount, history, delivery status.
- Payment data: handled directly by our payment provider. We never have access to your card number and do not store it.
- Browsing data: IP address, device and browser type, pages viewed, date and time of visit, collected through cookies and similar technologies.
- Content you send us: messages sent through the contact form, the talks and workshops form, or the chat assistant.
Required fields are marked in our forms; without them we cannot process your request or your order.
3. Why we process it, on what legal basis, and for how long
| Purpose | Legal basis | Retention period |
|---|---|---|
| Managing your order: payment, preparation, delivery, after-sales service | Performance of the contract | Duration of the commercial relationship, then archived for 5 years (statutory limitation period) |
| Handling your cancellation, withdrawal, return and after-sales requests | Legal obligation (French Consumer Code) | Duration of the commercial relationship, then archived for 5 years |
| Issuing and keeping invoices | Legal obligation (article L123-22 of the French Commercial Code and article L102 B of the French Tax Procedures Code) | 10 years |
| Sending you our news and advice, including information about the pre-sale | Your consent | 3 years from your last contact with us, or until you unsubscribe |
| Managing your customer account, if you create one | Performance of the contract | For as long as your account is active, then deleted on request |
| Sending you the activation code for the plan bought on the shop and linking it to your account in the app (email address, order reference, code) | Performance of the contract | Validity of the code (12 months from the order) and, if it is activated, duration of the plan, then archived for 5 years as proof of the contract |
| Replying to your messages (contact) | Our legitimate interest in replying to people who contact us | 3 years from the last exchange |
| Preparing a quote for a workshop or talk | Pre-contractual steps taken at your request | 3 years from the last exchange |
| Generating the chat assistant's replies | Our legitimate interest in informing visitors to the site | Not stored by My Self Key; for Groq, see section 4 |
| Measuring site traffic and improving our services | Your consent (non-essential cookies) | Cookies: 13 months maximum. Associated data: 25 months |
| Keeping the site secure and preventing fraud | Our legitimate interest in protecting the site and our customers | 12 months |
4. Who has access to your data
Your data is neither sold nor rented. It is accessible to our team, and to providers acting on our behalf and on our instructions:
| Provider | Role | Location |
|---|---|---|
| Shopify International Limited | Website hosting, shop and order management, email delivery | Ireland (Shopify group: Canada and United States) |
| Payment providers (Shopify Payments, Shop Pay or Apple Pay, depending on the method chosen) | Secure payment processing and fraud prevention | European Union and United States |
| Cloudflare, Inc. | Technical relay (Cloudflare Workers) of chat assistant messages to Groq; this relay keeps no log of the messages | United States |
| Intuition Machines, Inc. (hCaptcha) | Anti-bot protection of our forms, triggered by Shopify when you fill in a form | United States |
| Groq, Inc. | Generating the chat assistant's replies (model openai/gpt-oss-120b) | United States |
| Sendcloud B.V. and Mondial Relay | Preparing shipping labels and delivering your order | European Union |
| Microsoft Corporation (Microsoft Clarity) | Audience measurement: clicks, scrolling and pages viewed, to improve the site, only with your consent; input fields are masked | United States |
| Google Ireland Limited (Google & YouTube app) | Measuring visits and purchases coming from Google, only with your consent | European Union and United States |
About the chat assistant: when you write to the assistant on the site, your message goes through a technical relay run on Cloudflare, then is sent to Groq, Inc. (United States), which runs the artificial intelligence model (openai/gpt-oss-120b) and generates the reply. The relay keeps no log of the messages, and My Self Key does not keep the content of these exchanges. According to its public policy, Groq does not retain the messages it processes by default, but it may log them temporarily, for up to 30 days, to fix a fault or investigate abuse. Please do not enter any sensitive information (health, personal circumstances, details of people close to you). If you are in danger, the assistant directs you to 17, 112, 3919 or 114 by text message, without sending your message to the AI.
5. Transfers outside the European Union
Some of these providers are established in the United States or host part of their processing there. For each transfer, we rely on the legal mechanism that actually covers it: the European Commission's adequacy decision (Data Privacy Framework) where the provider has joined it, or otherwise the standard contractual clauses adopted by the European Commission, with additional safeguards where necessary. You can obtain information about these safeguards by writing to contact@myselfkey.fr.
6. Cookies and trackers
The site uses:
- strictly necessary cookies for it to work (basket, session, language and currency preference, security): these do not require your consent;
- audience measurement cookies, used to understand how the site is used;
- where applicable, advertising cookies, used to measure the effectiveness of our campaigns.
The last two categories are only set with your consent, collected through the banner displayed on your first visit. Refusing is as easy as accepting, and you can change or withdraw your choice at any time via the "Cookie settings" link in the footer, or by writing to us. When you fill in a form, a security cookie (__cf_bm, duration: the session) is set by hCaptcha, Shopify's anti-bot protection: it is strictly necessary and serves no other purpose. The _shop_app_essential cookie (shop.app domain, 12 months) is set by Shopify to recognise Shop accounts and for Shop Pay express checkout. Non-essential cookies have a lifetime of no more than 13 months.
7. Your rights
Under the General Data Protection Regulation and the French Data Protection Act, you have the following rights:
- Access: obtain a copy of the data we hold about you.
- Rectification: have inaccurate or incomplete information corrected.
- Erasure: request the deletion of your data, subject to our legal retention obligations.
- Restriction: request the temporary suspension of processing you are contesting.
- Objection: object to processing based on our legitimate interest, and at any time to direct marketing.
- Portability: receive your data in a machine-readable format.
- Withdrawal of consent: at any time, without affecting the lawfulness of processing already carried out.
- Post-mortem instructions: set out what should happen to your data after your death.
- Objection to telephone marketing: if you leave us a phone number, you can register free of charge on the French Bloctel do-not-call list (bloctel.gouv.fr). We never cold-call anyone.
These rights can be exercised by email at contact@myselfkey.fr. We reply within one month. Proof of identity may be requested in case of reasonable doubt.
You can unsubscribe from our emails in one click, using the link at the bottom of each of them.
8. Complaint to the CNIL
If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the French Data Protection Authority:
CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. www.cnil.fr
9. Security
We put in place appropriate technical and organisational measures to protect your data: encrypted connections (HTTPS), access restricted to authorised staff, and providers selected for their security safeguards. As no system is infallible, we will inform you and the CNIL of any breach likely to create a risk to your rights, in the circumstances set out in the GDPR.
10. Minors
The site is not aimed at people under 15 and we do not knowingly collect their data. If you notice that a child under 15 has sent us data without the agreement of their legal guardian, please write to us and we will delete it.
11. Automated decision-making
We do not take any decision producing legal effects concerning you on the sole basis of automated processing, and we do not carry out profiling for that purpose.
12. Changes to this policy
We may update this policy, in particular to reflect legal changes or changes in our practices. The date it was last updated appears at the top of the page. In the event of a substantial change, we will inform you by an appropriate means.
13. Contact
For any question about this policy or your data: contact@myselfkey.fr, or by post to MY SELF KEY (MSK), 63 bis rue de Sèvres, 92100 Boulogne-Billancourt, France.