Privacy
Who is responsible
The controller of the data described here is Henri Bernard, entrepreneur individuel, 81 avenue de Clichy, 75017 Paris, France. For any question about your data: henri@vocatly.com.
This page covers two situations. That of the professional who opens a Vocatly account: for their data, we are the controller. And that of the visitors and clients of their site: their data is processed on the professional’s behalf, the professional is the controller, and we are the processor.
The professional’s data
The account: your e-mail address, your password, your language and the date the account was opened. The password is held by Supabase, our authentication provider, in a form that cannot be read. Legal basis: performance of the contract. Retention: as long as the account exists.
The site: what you say about your activity in the conversation, the content written from your instructions and your corrections, your contact details, your opening hours, your services and prices, your photos. Legal basis: performance of the contract. Retention: as long as the account exists. The text of the conversation is sent to the provider of the model that writes the site, see below.
Billing: your billing identity, the state of your subscription and the payment history. Card details are entered with Stripe and never pass through our servers. Legal basis: the contract, then the legal obligation to keep invoices. Retention: ten years after each invoice.
The e-mails we send you serve the operation of the service: sign-up confirmation, payment notices, appointments booked on your site. We send you no promotional e-mail; should that ever change, every message will carry an unsubscribe link.
The data of your site’s visitors and clients
A booking: the name, e-mail address, phone number, optional message and chosen slot. They are used to hold the appointment, confirm it and send a reminder by e-mail the day before. Legal basis: the client’s request. Retention: as long as the professional’s account exists; they are erased with it.
A message sent through the contact form: the name, e-mail address and message. It is passed on to the professional and kept in their inbox. Retention: as long as the professional’s account exists.
A newsletter sign-up: the e-mail address, confirmed by a second click. Legal basis: consent, which every issue lets you withdraw through an unsubscribe link. Retention: until you unsubscribe.
Audience measurement: a count of visits per day and per page, with no cookie and no identifier. This count cannot identify a visitor.
For all of this data, the professional is the controller and Vocatly acts on their instructions. We use it for nothing but running their site, we do not sell it and we pass it on to no one but the providers listed below. A visitor who wishes to exercise their rights contacts the professional; we help them respond.
Who processes this data for us
We sell no data. The following providers process part of it, on our behalf and on our instructions.
Supabase — database and authentication. All account and site data. European Union (eu-central-1 region, Frankfurt).
Vercel Inc. — hosting of the service and of the sites. Everything displayed passes through its servers. United States.
Stripe Payments Europe — subscription payment. The billing identity and the card details, which we do not see. Ireland, with processing in the United States.
Resend — sending e-mails: confirmations, reminders, newsletter. Addresses and message content. United States.
Vercel AI Gateway and Anthropic — writing the site. The text of the conversation in which you describe your activity, and the corrections you ask for, are sent to the model. United States. Anthropic undertakes, in its commercial terms, not to train its models on what is sent through its API.
Transfers outside the European Union
Vercel, Stripe and the model provider process all or part of the data in the United States. These transfers are governed by the European Commission’s standard contractual clauses, included in our contracts with these providers and, for those certified under it, by the EU–U.S. Data Privacy Framework.
Your rights
You can access the data that concerns you, have it corrected or erased, receive a copy in a machine-readable format, object to a processing or ask for it to be restricted. Write to henri@vocatly.com; we answer within a month.
A professional can also act alone from the settings: correct their site, download their subscriber list, delete their account.
If you believe your rights are not respected, you can lodge a complaint with the CNIL, cnil.fr, or with the data protection authority of your country.
Cookies
The studio, where you edit your site, sets a single cookie: the session cookie that keeps you signed in to your account. It is necessary to the service and requires no consent. The vocatly.com site and the professionals’ sites set none: audience measurement is done without cookies and without identifiers.
Deleting the account
From the settings, at any time. Deletion erases the site, its content, the messages, the subscribers and the upcoming appointments; clients who had an appointment are notified by e-mail. Invoices are kept for as long as the law requires, and nothing else.
Updates to this page
This page evolves with the service. Last updated: 16 September 2026.