Privacy policy
Last updated: April 19, 2026
This policy describes how LetsPlan collects, uses and protects your personal data, in line with the GDPR and the French Data Protection Act.
1. Data controller
Olivier Maréchal, founder of the LetsPlan project (under the Oléa Tech brand, a company in formation).
Address: 104 route de Croissy, 78110 Le Vésinet, France.
For any question about your data: use the contact form and select the subject "GDPR request".
2. Data collected
Data collected when joining the waitlist:
| Data | Required | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Yes | Launch notification, newsletter | Consent | 3 years after last activity or until unsubscribe | |
| First name | No | Personalisation | Consent | Same as email |
| Locale (FR/EN) | Auto | Sending in the right language | Legitimate interest | Same as email |
| Marketing consent | Yes | GDPR proof | Legal obligation | 3 years after unsubscribe |
| Hashed IP (SHA256) | Auto | Anti-spam | Legitimate interest | 6 months |
| User-agent | Auto | Diagnostics, anti-spam | Legitimate interest | 6 months |
| Signup date | Auto | Waitlist management | Legitimate interest | Same as email |
Contact form data
When you use the contact form, we keep your name, email and message for up to 3 years to process your request and maintain a history of our correspondence, after which the data is automatically deleted.
Hashed IP (SHA256) and user-agent are kept for 6 months for anti-spam purposes.
Legal basis: legitimate interest (handling incoming requests). Email is stored in plain text to allow us to reply. You can request deletion at any time via the contact form (subject "GDPR request").
3. Your rights
All rights below can be exercised via the contact form (subject "GDPR request"):
- Right of access (GDPR article 15).
- Right to rectification (article 16).
- Right to erasure / right to be forgotten (article 17).
- Right to restrict processing (article 18).
- Right to data portability (article 20).
- Right to object (article 21).
Response time: 1 month from receipt of the request, in line with GDPR.
If you believe your rights are not respected, you can lodge a complaint with the CNIL — www.cnil.fr — 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07.
4. Data recipients
Your data is processed by:
- The site publisher (controller): Olivier Maréchal, on behalf of Oléa Tech (in formation).
- Lovable Inc. (infrastructure host, GDPR processor).
- Supabase (database, processor, EU / Ireland region).
- Resend (transactional email sending, processor — activated at production launch).
No data is sold, rented, or transferred to third parties for commercial purposes.
5. Transfers outside the EU
Data is hosted in Ireland (EU). No transfer outside the EU takes place at this time.
6. Security
Measures in place:
- Encryption at rest (AES-256 on Supabase).
- Encryption in transit (HTTPS / TLS on every page).
- SHA256 hashing of IP addresses (never stored in clear text).
- Anti-spam (honeypot, IP rate limiting).
- Restricted admin access with strong authentication.
7. Cookies
See the Cookies policy page for full details.
8. Minors
The site is not intended for minors under 16. If you are a parent or guardian and believe your child shared data with us, contact us via the form for immediate deletion.
9. Policy updates
This policy may be updated at any time. The last-updated date is shown at the top of the page. Registered users will be notified of substantial changes by email.
10. Evolution of the legal structure
Once Oléa Tech is officially registered, this policy will be updated to reflect the new controller. Registered users will be informed by email.
11. Contact
For any question or to exercise your rights: letsplan.fr/contact (subject "GDPR request").