Privacy policy
In short: reading the site and downloading the free pack do not ask for any personal data. When you buy the full pack, we keep your email address and the details of your order, to deliver the files, send you a new link when you ask for one and announce updates. We do not sell your data and do not use it for advertising.
Who is responsible
Mathieu Benoit LLOBERE EI, trading as The Grain Archive, hello@thegrainarchive.com, is responsible for the data described on this page (the “controller” under the GDPR). See the legal notice.
Reading the site
- No cookies. The site sets no cookies and stores nothing in your browser.
- No trackers. There is no analytics, advertising or social media script. Fonts, scripts and images come from this site only: while you read it, your browser contacts no other site.
- Server logs. Like most web servers, the servers that deliver the site may keep technical logs of requests (IP address, date and time, page requested, browser type), used for security and troubleshooting.
Free pack
The free pack is a direct download: no account, no email address, no form.
Buying the full pack
Payment: Link and Stripe
You pay on a Stripe Checkout page, on Stripe’s own domain. The full pack is “Sold through Link”: Stripe, through its Link service, acts as merchant of record. It collects what it needs for the payment, the tax and fraud prevention (such as your email address, name, payment method and billing country or address) and processes it under the Link privacy policy and the Stripe privacy policy. Stripe may use cookies on its checkout page, as described in its cookie policy.
Link shares the order details with us, and we can see them in our Stripe account (for example your name, email address, country and the amount paid). We never receive your full card number.
What we store
Our own database, on the site’s server, keeps only the following.
| Data | Why |
|---|---|
| Your email address | To send you the download link, and a new link when you ask for one; to answer you |
| Your order: Stripe session and payment identifiers, amount, currency, date, pack version, status (paid, refunded, disputed) | Proof of purchase |
| Download links: a hash of each link (never the link itself), its expiry date and how many times it was used | To limit each link to 30 days and 10 downloads |
| Emails sent to you: type (delivery, new link), pack version, date, Resend message identifier | To avoid duplicate emails and to answer support questions |
No postal address, no payment card data.
Emails
Our emails (delivery, new link) are sent through Resend.
Getting your download link again
On your account page you type an email address. If it matches an order, we send a new download link to that address. The page gives the same answer whether or not the address was used for a purchase, so it does not reveal who bought. To prevent abuse, the number of requests per IP address and per email address is limited. These counters stay in the server’s memory for one hour at most and are never written to disk.
Legal bases
- Contract (GDPR article 6(1)(b)): delivering the full pack, new links and product support.
- Legal obligation (article 6(1)(c)): keeping accounting records.
- Legitimate interest (article 6(1)(f)): security, abuse prevention and server logs.
Who receives your data
| Recipient | Role | Where |
|---|---|---|
| Link and Stripe | Payment, tax, receipts, refunds and payment support for the full pack, as merchant of record, under their own privacy policies. | See the Link privacy center |
| Resend (Plus Five Five, Inc., San Francisco, United States) | Sends our emails, as our processor, under a data processing agreement | Stores data in the United States. Transfers under the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework (Resend GDPR page) |
| OVH SAS | Hosts the site, the server and the database | Registered office in Roubaix, France |
Nobody else receives your data.
How long we keep it
- Orders and email address: 5 years after the purchase, as proof of purchase
- Download link records: deleted 30 days after the link expires
- Email log: 1 year
- Accounting records: 10 years, as the law requires
- Server logs: 6 months
Your rights
You can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. Write to hello@thegrainarchive.com from the address you used for your purchase. We answer within one month. If we delete your email address, we can no longer send you new links or updates.
For the data Link and Stripe hold as merchant of record, you can also contact them through the Link privacy center.
If you think your rights are not respected, you can complain to the CNIL, the French data protection authority: cnil.fr/fr/plaintes (in French).
Security
Download links are random, contain no email address or identifier, and only their hash is stored. The database is not reachable from the internet. The site is served over HTTPS.
Changes
We will update this page if the way we handle data changes. The date at the top shows the last update.