Spektrografy Privacy Policy — GDPR

> Language note: This is an informational English translation. In case of any discrepancy, the French version prevails.

1. Data controller

The data controller is:

Vincent Blot, sole trader (entrepreneur individuel, micro-enterprise regime) trading under the commercial name Baggero SIRET: 107 556 896 00010 France

The Spektrografy service is available at https://spektrografy.com. Spektrografy is one of the products / tools published under the Baggero commercial name. No Data Protection Officer (DPO) has been appointed; requests go to the contact below.

Contact (privacy policy and GDPR rights): contact@baggero.com Spektrografy product support (bugs, feature feedback): contact@spektrografy.com

2. Data collected

We process in particular:

3. Purposes and legal bases

We do not sell your personal data. We do not use Google Analytics, nor remarketing / targeted advertising tools (Meta Pixel, Google Ads, etc.).

4. Emails

We may send you emails in the following cases:

Automatic Spektrografy emails are sent from noreply@spektrografy.com. Any automatic multi-product Baggero communications may use noreply@baggero.com.

Inbox separation:

Two delivery channels (see sub-processors):

- Resend — authentication emails (magic link, confirmation, recovery) via Supabase Auth custom SMTP; - Hostinger — product emails (e.g. "export ready") and domain mailbox hosting.

5. Retention periods

6. Sub-processors

We use the following providers acting on our behalf:

The list may evolve; sub-processors are chosen with sufficient guarantees under GDPR Article 28.

7. Transfers outside the European Union

When sub-processors process data outside the EU, Standard Contractual Clauses (SCC) or other appropriate safeguards are implemented under GDPR Chapter V.

8. Your rights (GDPR)

Under the GDPR, you have rights of access, rectification, erasure, restriction, objection, and portability where applicable.

### Self-service (Studio)

Account deletion erases all data stored with Spektrografy (including Cloudflare R2 / object-storage files). An active Pro subscription is cancelled for the next billing date (no renewal); data is erased immediately (no access kept until the end of the paid period). To keep your projects while stopping renewal: Stripe portal "Manage subscription". Stripe may retain billing data on its side under its legal obligations.

### Human contact (legal, bugs, suggestions)

- contact@baggero.com — legal and GDPR / data-subject rights requests (data controller = Baggero publisher). - contact@spektrografy.com — Spektrografy bug reports and feature feedback. - These are not the addresses used to send automatic notifications (`noreply@spektrografy.com` / optionally `noreply@baggero.com`).

For GDPR requests by email: include a copy of ID if needed for verification.

You may lodge a complaint with the CNIL (France): www.cnil.fr.

9. California resident rights (CCPA / CPRA)

Spektrografy is operated from France. If you are a California consumer, the following information supplements this policy under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA / CPRA"), to the extent those laws apply.

In the past 12 months, we may have collected the categories of personal information described in section 2 (identifiers, account data, user content, payment data via Stripe, technical usage activity, communications).

We do not "sell" or "share" your personal information within the meaning of the CCPA / CPRA (including for cross-context behavioural advertising). We do not use remarketing cookies or targeted advertising.

Subject to legal exceptions, you may request: (i) to know what personal information we hold about you; (ii) deletion of your personal information; (iii) correction of inaccurate data; (iv) not to be discriminated against for exercising your rights.

To exercise these rights: contact@baggero.com (recommended subject: "CCPA request"). We may verify your identity before responding. You may also delete your account and data via Settings → Delete my account.

10. CalOPPA

Under the California Online Privacy Protection Act ("CalOPPA"), to the extent applicable:

- this privacy policy is accessible from the Spektrografy website; - you may contact us about this policy at contact@baggero.com; - users may review, update, or delete certain information via the Studio (account, projects, exports) or by contacting us; - if this policy changes materially, the update date appears at the top of the page and, where required, registered users may be notified and asked to accept the new version (see section 14).

11. Cookies and local storage

We use only cookies and storage essential to the service (auth session, language preference, optional promo code, etc.). No cookie banner is shown while no non-essential trackers are set.

Details are in the cookie policy.

12. Security

Measures include: encryption in transit (HTTPS), restricted data access, RLS (Row Level Security) on the Supabase database, private file storage, rate limiting on uploads and feedback submission.

13. Minors

The service is not intended for persons under 16 without parental authorisation.

14. Updates

This policy may be updated. The last update date appears at the top of the page. In case of material changes, users may be notified and, if required, asked to accept the new version.