Privacy policy

The data controller is Paul Hilmarcher (sole trader, trade name Echo Studio Agency), publisher of the Echo TCG website — 29 Route du Revoireau, 38790 Saint-Georges-d'Espéranche, France — contact@echo-studio-agency.fr.

Through the “Request a demo” form, we collect: shop name, contact name, email address, and — optionally — phone number and message. When you subscribe to a plan: name, email address and billing information (processed by our payment provider Stripe — we never store your card number). For audience measurement, we record anonymous navigation statistics (page visited, language, device type, country) WITHOUT cookies or any stored IP address. No data is collected without your knowledge.

Form data is used solely to respond to your demo request and to get back to you (legal basis: your consent and the legitimate interest in handling a commercial enquiry). Subscription data is used to perform the contract (workspace creation, billing, support) — legal basis: the contract (art. 6.1.b GDPR) and our legal obligations (accounting).

We contact trading-card shops by email (generic or named professional addresses) as part of business-to-business prospecting directly related to their activity. These contact details come from public sources: the official French company register (government open data) and OpenStreetMap (open data, ODbL licence). Legal basis: legitimate interest (art. 6.1.f GDPR), in line with the CNIL's guidance on B2B prospecting. In accordance with article 14 of the GDPR, this section serves as information about the origin of such data. Every email contains a one-click unsubscribe link: any objection takes effect immediately and permanently (your address is excluded from all future mailings). You may also object at any time by writing to contact@echo-studio-agency.fr.

Prospect data (demo form, B2B prospecting) is kept for 3 years from the last contact, then deleted. Subscription-related data is kept for the duration of the contract, then archived for as long as legally required (10 years for accounting records and invoices).

The data is intended solely for the Echo Studio Agency teams. Technical sub-processors: Stripe (secure payment — PCI-DSS certified), Resend (email delivery), Supabase (database hosting, European Union — Paris region), Vercel (website hosting + cookieless audience and performance measurement) and Cloudflare Turnstile (form anti-bot protection). If you consent, Google Analytics (Google Ireland Ltd) measures detailed audience. No data is sold or shared with third parties for commercial purposes.

In accordance with the GDPR, you have the right to access, rectify, erase, restrict and object to the processing of your data. To exercise them: contact@echo-studio-agency.fr. You may lodge a complaint with the relevant supervisory authority (in France, the CNIL).

The site uses no advertising cookies. Performance measurement (Vercel Speed Insights) and basic audience are COOKIELESS. Detailed analytics via Google Analytics only sets cookies IF you consent through the dedicated banner: you can decline, and change your choice at any time via “Manage cookies” in the footer. Until you accept, no measurement cookie is set. The Cloudflare Turnstile anti-bot protection works without any tracking cookie.