Privacy policy
This policy explains how data is processed on enviz.fr and points to separate information for the browser extension.
Data controller
The data controller is Quentin Vavasseur, 18 boulevard Richard Wagner, 37000 Tours, France. Telephone: +33 6 35 77 20 75. For questions or to exercise your rights, email contact@enviz.fr.
Account, profile and security data
Enviz processes the email address, display name, a salted cryptographic password hash — never the plain-text password — account role, creation and last-activity dates, session identifiers and sign-in attempts needed to prevent abuse. Users may optionally add a photo, age, city, short biography and interests. Profile information is shown on shared lists only when the user enables that visibility.
Google, Apple and Facebook sign-in
When you choose social sign-in, Enviz receives only the authorised and necessary data sent by the provider: a technical identifier, verified email address, first name or display name and, when available, profile photo. Enviz never receives the provider password. A social identity is linked to the existing Enviz account associated with the same verified email to avoid duplicates. Google, Apple or Meta process the authentication step under their own policies. The link remains stored until it is removed or the account is deleted.
Content, collaboration and reservations
Enviz processes lists, items, links, images, descriptions, prices, merchants, selected visibility, reservations, the name entered by a guest and delivery choices. For collaborative lists, Enviz also processes the role, item author, optional invitation email address, invitation status and granted rights. A recipient’s first name, surname and address are stored only when the list owner voluntarily enables delivery to their address.
Transactional emails and notifications
Enviz may send messages required to create and secure an account, including welcome, email verification, password reset and important access information. Email invitations are sent at a list owner’s request. Collaboration and reservation activity emails are optional and can be disabled in My account. Enviz also stores in-app notifications, their date, read status and destination link. Messages sent to the owner strictly respect surprise, discreet or transparent mode. In transparent mode, a guest’s name is disclosed only with their express agreement. Reservation email subjects and previews remain neutral in every mode.
Product suggestions
Products in Enviz favourites are selected editorially. Enviz records clicks on View product and additions to lists to measure usefulness by product and merchant. Some links may be affiliate links and are labelled accordingly; Enviz may then receive a commission without changing the price paid.
User search and list templates
Friend search only shows accounts that have deliberately enabled a searchable public profile and never allows public search by email address. It may show the chosen name, city, photo and number of public lists. List templates are Enviz editorial content; copying one creates a new private list in the user’s account and never copies reservations or personal data.
Smart links and partner alternatives
Enviz retains the original link entered for a gift. With the visitor’s consent, that link may be converted at click time into an affiliate link when a compatible merchant programme is detected. If a gift’s merchant does not match the partner catalogue, Enviz may display a small number of similar editorial alternatives from its favourites. Alternatives are clearly identified and never replace the selected gift automatically.
Analytics, affiliation and support data
Enviz records the event type, page or page category, date and, for signed-in users, the account identifier on the server. Merchant clicks include the item, list and merchant. If affiliate measurement is accepted, the Awin Publisher MasterTag may process the merchant link, originating Enviz page, a click or browser identifier, IP address and technical information to attribute a possible purchase. Enviz error logs may include the route, method, technical message, date, occurrence count and related account identifier.
Purposes and legal bases
Account creation, email verification, chosen authentication, requested password resets, list management and collaboration, invitations, in-app notifications, adding items and reservations are necessary to provide the requested service. Important security alerts, abuse prevention, error diagnosis, internal statistics and internal click measurement rely on Enviz’s legitimate interest in protecting, operating and improving the service. Loading the Awin Publisher MasterTag and accessing affiliate identifiers on Enviz rely on freely revocable consent. Sharing the owner’s address, displaying a guest’s identity in transparent mode and sending optional activity emails rely on the explicit choices of the people concerned. Some data may be retained to comply with legal obligations or establish, exercise or defend legal claims.
Required information
An email address and either an Enviz password or authorisation from the chosen social provider, together with information essential to a list or reservation, are required to provide the requested function. Profile photo, age, city, biography, interests, descriptions, images, event dates, guest name and delivery details are optional unless the user chooses a feature that depends on them.
Recipients
Data is accessible to Quentin Vavasseur only for administration, support and security. OpenAI Ireland Ltd and its infrastructure subprocessors may process it to host and operate the service. Google, Apple or Meta receive the strictly necessary parameters when their sign-in method is selected. Resend, the transactional email provider, receives the recipient address, sender, subject and message content required for delivery; no Enviz secret key is sent to the browser. With the user’s consent, Awin AG and relevant advertisers receive information needed to attribute a click or purchase. When a user leaves Enviz for a merchant, that merchant processes the navigation data it receives under its own policy. Enviz does not sell or rent personal data and does not use it for behavioural advertising.
Public and private lists, profile and delivery
A public list can be viewed by anyone and indexed by search engines. A private list is not intended to be indexed, but anyone who receives its link can open it. When shared-profile visibility is enabled, the photo, age, city, biography and interests are visible to visitors to those lists; the option can be disabled at any time. The email address is never displayed. The owner’s delivery address is disclosed to a guest only after reservation and only when the owner enabled that option.
Retention periods
Account data, linked social identities, lists, collaborations, gifts and addresses are retained until the user deletes them or deletes the account. Unused invitations expire after 30 days and can be revoked immediately. Email verification links expire after 24 hours and password-reset links after one hour; they are single-use, stored as hashes and deleted after expiry or no later than seven days after use. Notifications are retained for up to 12 months, OAuth security states for 10 minutes and sessions for 30 days. Sign-in rate-limit records are deleted after 24 hours. Internal navigation statistics are retained for 13 months, merchant-click and suggestion measurements for 25 months, and technical error records for 12 months after their last occurrence. When a reservation is cancelled, the name, linked account and display consent are erased; the identity-free technical status remains associated with the gift until it is deleted. Awin identifier lifetimes vary by tracker and merchant programme; the current list is published at privacy.awin.com. Residual copies may remain for the time strictly necessary for provider backups and security.
Your rights
You can access certain data, export it and delete your account from your Enviz space. You can withdraw or restore your agreement to affiliate measurement at any time from the Cookies page. You may also request access, rectification, erasure, restriction, applicable portability, or object to processing based on legitimate interest by emailing contact@enviz.fr. A response is normally provided within one month. Proof of identity may be requested only where there is reasonable doubt. You may lodge a complaint with the French data protection authority, CNIL, at cnil.fr. For Awin’s own processing, see awin.com/privacy or email global-privacy@awin.com.
International transfers
OpenAI, Google, Apple, Meta, Awin, the transactional email provider and some of their subprocessors may process data outside the European Economic Area. Those transfers must rely on an adequacy decision, the European Commission’s Standard Contractual Clauses or another safeguard recognised under the GDPR. Applicable safeguards can be requested from contact@enviz.fr.
Security
Enviz implements proportionate measures including HTTPS, an HttpOnly session cookie, server-side role checks, cryptographically derived passwords, attempt limits, unique invitation, verification and reset tokens stored only as hashes, short validity periods, single use, session revocation after password reset, short-lived OAuth states, idempotency keys against duplicate sends and error logging. Resend, Awin and social sign-in keys are encrypted on the server and never placed in client code. No service can guarantee zero risk; suspected incidents can be reported to contact@enviz.fr.
Browser extension
Processing specific to the Enviz extension is explained in the Extension privacy policy at enviz.fr/en/legal/confidentialite-extension.
Updates
This policy may change when the service or applicable law changes. Users will be informed appropriately of any material change.
Version dated 25 August 2026 · Contact: contact@enviz.fr