Privacy Policy

1. Who is responsible for your data

The data controller is:

FC TANCREDO, société par actions simplifiée
21 rue de la Paix, 75002 Paris, France
SIREN 912 610 334 — RCS Paris
Contact: privacy@ceica.co

Ceiça is a brand operated by FC TANCREDO. If the brand is transferred to another company — for example on the incorporation of a dedicated entity — that company becomes the data controller, this page is updated, and the change is announced to you by email before it takes effect. Your data would not be used for any new purpose.

We have not appointed a Data Protection Officer; our processing does not meet the thresholds of Article 37 GDPR. Write to the address above for anything concerning your data.

2. What we collect and why

Only what the form asks for. No tracking, no profiling, no data bought from anyone.

Joining the waitlist — your email address. We use it to reserve your number in the founding thousand and to write to you when there is something to say about the launch. Legal basis: your consent, Article 6(1)(a) GDPR. It is required — without an address we cannot hold a number for you.

SMS updates — your mobile number. Optional, with its own separate tick box. Stored in international E.164 format, together with the country the number belongs to, so we can apply the SMS rules of that country. Legal basis: your consent, Article 6(1)(a) GDPR and Article L.34-5 of the French Code des postes et des communications électroniques. Declining changes nothing about your number or your place on the waitlist.

These are two separate purposes. Consenting to one never implies the other, and each can be withdrawn on its own.

Proof of your consent. When you tick a box we record, alongside your address or number: the exact wording you agreed to, the date and time, the IP address the request came from, and the version of this policy then in force. Article 7(1) GDPR requires us to be able to demonstrate consent; without this record we could not, and an unprovable consent counts as no consent. The IP address serves that single purpose. It is never used to locate you, profile you, or link you to anything else.

What we do not collect. No advertising or analytics cookies. No Google Analytics, no Meta pixel, no third-party tracker. No name, postal address, age, gender, hair type or any other personal detail. We do not know who you are beyond what you gave us.

We do not currently use any analytics tool. Before we do, this page is updated and the provider named. Any analytics we add will be cookieless, hosted in the European Union, and will count visits without identifying anyone — no email address, and no hash of one, will ever leave the page.

3. How long we keep it

The three-year period follows CNIL guidance on prospect data. At the end of it we delete your data or ask whether you want to stay.

If you withdraw consent or ask for erasure, we delete your address or number without delay. We keep only the record of the consent that existed and of its withdrawal, for the five years above — that record protects you as much as us.

4. Where it is stored and who else sees it

We do not sell your data. We do not share it for anyone else's marketing. Ever.

Your data is stored in the European Union — in Ireland, on infrastructure operated by Lovable, our hosting and database provider. The database region is fixed and cannot be changed. Backups are made and held by that provider. On the service we use they are kept in the same region; that is the provider's stated practice rather than something we can verify ourselves, and we will say so here if it changes.

When you submit the form, your request passes through a global content delivery network, which may process it transiently outside the European Union depending on where you are; that processing is covered by the Standard Contractual Clauses in our providers' data processing agreements. The data itself is only ever written to, and stored in, the European Union.

We will use Klaviyo to send our emails and to manage our subscriber list. We are not using it yet; we are naming it here in advance so that you know, before you sign up, who will hold your address.

Klaviyo is a United States company and stores data in the United States. Transfers are covered by Klaviyo's certification under the EU–U.S. Data Privacy Framework, with the European Commission's Standard Contractual Clauses applying should that framework cease to be available.

Klaviyo will receive only your email address, your consent record, and — if you chose it — your mobile number. Nothing else.

Each provider is bound by an Article 28 GDPR processing agreement and acts only on our instructions.

We may also disclose data where the law requires it — a court order, or a lawful request from an authority. Nothing else.

5. Your rights

Under the GDPR and the French loi Informatique et Libertés you can access your data, rectify it, have it erased, restrict its use, receive it in a portable format, object to a processing, and withdraw your consent at any time without giving a reason. Withdrawal does not affect what we lawfully did before it.

How. Write to privacy@ceica.co. We answer within one month. If a request is complex we may extend by two months and will tell you why within the first month.

Faster, for the two commonest cases. Every email carries a one-click unsubscribe link. Every SMS can be stopped by replying STOP. Neither requires writing to us, and neither costs you your number.

If we get it wrong. You can complain to the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or cnil.fr. You can go to them directly; you do not have to contact us first.

6. What happens to your number

Numbers 1 to 1,000 are assigned in the order signups arrive and are never reassigned. The number is not a contract and grants no purchase right: it marks your place for first access when the first drop opens.

Your number is not shown publicly. It is displayed to you when you sign up and appears nowhere else. We never publish a list of subscribers.

7. Automated decisions

There are none. No decision producing legal or similarly significant effects for you is taken automatically. Your number is assigned in order of arrival, which is arithmetic, not a decision about you.

8. Security

Data is held in an access-controlled database. Writes pass through a server-side function; the page itself has no direct write access. Connections are encrypted end to end. Access is limited to those who need it.

No system is perfect. If a breach occurs that is likely to result in a high risk to your rights, we will tell you without undue delay, as Article 34 GDPR requires.

9. Children

The waitlist is not intended for anyone under 15, the age of digital consent in France. We do not knowingly collect data from children. If you believe a child has signed up, write to privacy@ceica.co and we will delete it.

10. Changes to this policy

If we change this policy we update the version number and the date at the top. For a change that materially affects you — a new purpose, a new recipient, a longer retention — we email you before it takes effect, and where the law requires it, we ask for your consent again.

Earlier versions are kept, so we can always show which text applied when you consented. Version 1.0 remains available.

11. Cookies and storage on your device

There is no cookie banner on this site. That is not an oversight: we use no tracker that would require one.

Three cookies exist. All three are exempt from consent under article 82 of the French Data Protection Act, because they are strictly necessary either to the service you asked for or to its security. We must still tell you about them — the exemption removes the need for consent, not the need to inform.

None of them carries an advertising identifier, follows you from site to site, or feeds a profile. ceica_wl cannot be read by the page itself. None is shared with an advertiser.

If we ever add a tracker that is not exempt, we will ask for your consent before setting it, and this page will be updated first.

12. Contact

privacy@ceica.co
FC TANCREDO — 21 rue de la Paix, 75002 Paris, France