Privacy policy

Last updated: 29 October 2026

This policy explains how Time signature ("we") processes the personal data of visitors and users of Time signature and its pre-order page, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act.

1. Controller

Time signature, France. Contact for any question about your data: [email protected].

2. Data processed, purposes and legal bases

• Account and access to services — email, first and last name, nickname, country, date of birth, time zone, optional profile picture, password (stored with irreversible hashing): account creation and management, delivery of courses. Basis: performance of the contract.
• Subscription and payment — subscribed offer, payment history, invoices, refund or withdrawal requests, consent to immediate performance: order management, invoicing, evidence of our obligations. Card data is processed exclusively by Stripe. Bases: contract and legal obligations (accounting and tax).
• Learning progress — content viewed and completed, playback positions, quiz results, badges, favourites: tracking your learning and resuming where you left off. Basis: performance of the contract. Our teaching team may view this tracking to support you.
• Reactions and saved content — the reaction you choose on a piece of content or a post (one at a time, which you can change or remove at any time), the history of its changes, the content you save: letting you find your content again, measuring how content is received and improving it. Basis: legitimate interest in improving our content. Other members never see your reactions by name (at most an anonymous total, if we enable it); authorised members of our team may view them. They are kept for the life of the account, then anonymised when it is deleted.
• Content protection and fraud prevention — log of access to protected content (date, content, pseudonymised IP address), number of sessions: preventing account sharing and piracy. Basis: legitimate interest in protecting our content and members.
• Support and contact — messages, subject, exchanged files: answering your requests. Basis: legitimate interest or contract.
• Pre-registration and launch information — email, name, country, date of birth: informing you about the opening and the pre-order offers you asked about. Basis: your request (pre-contractual steps); consent for any marketing.
• Newsletters and marketing emails — email, preferences, opens if enabled: sending our news. Basis: your consent (or, for our customers, legitimate interest for similar services), which you can withdraw at any time through the unsubscribe link.
• Audience measurement — without cookies before your choice (aggregated counting, non-persistent technical identifier), with cookies only after your consent: traffic statistics and site improvement. Bases: legitimate interest for cookieless measurement; consent for cookies (see the Cookie policy).
• Security and operation — technical logs (pages requested, errors, IP address replaced by a pseudonymous identifier renewed daily), cookieless anti-bot protection, anonymous presence signal: security, outage detection, maintenance planning. Basis: legitimate interest.

Mandatory fields are marked with an asterisk; without them the request cannot be processed. No decision producing legal effects is based solely on automated processing.

3. Recipients

Your data is accessed by our team, within the limits of their duties, and by our processors acting on our instructions: hosting (infomaniak), content delivery and security (Cloudflare), payment (Stripe, which also acts as a controller for its own obligations), email delivery (transactional email provider), interactive score player (Soundslice), audience measurement (PostHog — hosted in the European Union, and Google Analytics if you accept it), community (Discord, if you link your account). It may be disclosed to authorities upon lawful request. We never sell your data.

4. Transfers outside the European Union

Some providers are established in, or may access data from, the United States. These transfers rely on the EU–US adequacy decision (Data Privacy Framework) where the provider is certified, or on the European Commission's standard contractual clauses.

5. Retention periods

• Account and progress: for the life of the account; an account inactive for three years is deleted or anonymised after prior notice.
• Accounting records and invoices: ten years (article L123-22 of the French Commercial Code).
• Evidence of the order, acceptance of the Terms of sale and consent to immediate performance: duration of the contract plus five years (limitation period).
• Support requests: three years after closure.
• Prospects and pre-registered non-customers: three years after their last contact.
• Log of access to protected content: twelve months. Technical logs: limited period, at most twelve months.
• Audience measurement cookies: at most thirteen months; your cookie choice: six months.

6. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection (including, at any time, to marketing), the right to withdraw consent at any time and to set instructions regarding your data after your death. You can update your information from your profile and exercise your rights by writing to [email protected]; proof of identity may be requested in case of doubt. We reply within one month.

You may lodge a complaint with the French data protection authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr), or with the authority of your country of residence.

7. Minors

For a minor under fifteen, processing based on consent requires the joint consent of the minor and the holder of parental authority.

8. Security

We implement appropriate technical and organisational measures: encrypted communications (HTTPS), hashed passwords, role-based access control and logging for our team, backups, pseudonymisation of technical logs.

9. Changes

This policy may change; the last update date appears at the top. Significant changes are brought to your attention.