Privacy & cookies

Last updated: 3 October 2026

1. What we store, and why

Your account

• Email address, and the name and photo of your Google or GitHub account if you sign in with them (you can replace both on your profile).
• Your profile: display name, handle, photo, title, bio and links you choose to add.
• Why: to run your account and show you as the founder of your stores (performance of the contract).

What you do on the mall

• Stores you create, upvotes, reviews, boosts, bids and leases, and your visit streak when signed in.
• Why: these are the features of the site (performance of the contract), and protecting votes against fraud (legitimate interest).

Payments

• Your coin balance and wallet history, and for each purchase the Stripe references, pack and amount. Card details are handled by Stripe only; we never see them.
• Why: to deliver coins and keep accounting records (legal obligation).

Audience

• Page views, outbound clicks and boost impressions are counted per store, not per person.
• Visitors per day are counted with a fingerprint of the IP address and browser, mixed with a random key that changes every day and is erased at the end of the day: the counts cannot be linked back to you, and no cookie is used.
• Why: to show founders their stats and set boost prices from the mall's real audience (legitimate interest).

Newsletter

• Your email address, only if you subscribe. Every email has a one-click unsubscribe link.
• Why: your consent, which you can withdraw at any time.

Emails you send us

• Messages to hello@saasmall.fun, to answer them.

2. How long we keep it

• Account, profile and activity: as long as your account exists. Deleted on request, within one month.
• Purchase records: 10 years, as required by French accounting law (Commercial Code, art. L123-22), even after the account is deleted.
• Newsletter: until you unsubscribe.
• Daily visitor fingerprints: the random key is erased at the end of each day; only the daily count is kept.

3. Who processes it

We do not sell or share personal data. These providers process it on our behalf, only to run the site:

• Railway: Hosting of the website and application.
• Supabase: Database, sign-in (accounts and sessions) and file storage (logos, screenshots, photos).
• Stripe: Payment of MallCoins (card details are handled by Stripe only).
• Resend: Sending emails (sign-in links, newsletter, notifications).
• Google and GitHub: Sign-in, only if you choose to sign in with them.
• Sentry: Error reports (the technical details of a crash, without cookies or IP addresses).
• ImprovMX: Forwarding of emails sent to hello@saasmall.fun.

Some of them are based in the United States or use servers there. These transfers rely on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

4. Cookies and browser storage

• Sign-in cookies (set by Supabase, our sign-in provider): keep you signed in. Strictly necessary, set only when you sign in.
• Browser storage (local storage, never sent to us): your day or night theme, Calm mode, and small counters that stop the same effect or popup from showing you too often.

That is all: no advertising, analytics or social media cookies. As everything above is strictly necessary or a preference you set yourself, no consent banner is needed.

5. Your rights

You can ask to see, correct, export or delete your data, object to its use or limit it, and withdraw a consent at any time. Most of your profile can be changed directly on the site. For everything else, write to hello@saasmall.fun; we answer within one month. If you think your rights are not respected, you can complain to the CNIL (cnil.fr), the French data protection authority.

6. Security

Data is sent over HTTPS only, payments are handled by Stripe, profile photos are re-encoded and stripped of their metadata (such as location), and access to the database is restricted to the service itself.

7. Changes

We will update this page if what we collect changes; the date at the top shows the latest version.