Confidentiality policies

Information notice on the processing of personal data

Version as of September 8, 2025

1. Introduction

The purpose of this Privacy Policy is to inform users of the site. www.reflet.co (the “Site”) belonging to the company SAS REFLET on the way in which we collect, use, store and protect their personal data, in accordance with the General Data Protection Regulation (RGPD).

By using our site, you are accepting the practices described in this Privacy Policy.

2. Responsible for the treatment

The person responsible for processing the data collected on www.reflet.co is:

Society : REFLET — SASU with a capital of 5,000€ — RCS Strasbourg 943902833
Adress : 20 Avenue du Neuhof, 67200 Strasbourg, France
Contact email (RGPD/DPO) : hello@reflet.co

3. Data collected

3.1. Login and account details

When creating an account on the Site, we collect your identification information: first name, email address, and, if applicable, the information necessary for authentication and account management.

Memberstack: saves your registration and login details.
Google: shares your login data (Name, First name, email address, profile photo) if you choose to create an account with Google).

3.2. Form and registration data

When using forms (contact, registration, questionnaires), we collect the following data: first name, email address, age, city, and any other information voluntarily provided.

User accounts and subscriptions are managed via Memberstack (United States). The data processed only concerns your identification information (email, name) and your subscription information. Memberstack is certified under the Data Privacy Framework (DPF), guaranteeing an adequate level of protection for data transfers to the United States.

3.3. Content preferences

We collect your content preferences (e.g. topics of interest, type of programs followed).
This information is only used to personalize your experience and our communications.
👉 This data does not in any way constitute a medical diagnosis Or health data within the meaning of the RGPD.

3.4. Navigation and tracking data

Plausible : collection of anonymized navigation data (pages visited, duration, geographical origin).
Facebook Pixel : measurement of advertising effectiveness and personalization of campaigns.
Vimeo: Anonymized video playback for members who are not logged in.

3.5. Using Webflow and Brevo

Webflow (hosting and forms) : the forms go through Webflow before being sent to Brevo.
Brevo : management of newsletters and marketing communications (email, first name, city, preferences).

3.6 Feedback Data

Hyvor Talk : management of comment spaces. The data collected includes the email address, nickname, and comment content. No personal profile photos are collected (only generated default avatars). The data is hosted in Europe (Germany) and used only for posting and moderating comments, in accordance with the GDPR.

3.7. Other third party tools

Tally : questionnaire management, service provider based in Belgium.
Calendly : online appointment booking, service provider based in the United States (certified Data Privacy Framework).
Stripe: stores your payment details securely.

3.8. Necessary cookies (always active)

Some cookies are essential for the functioning of the site and our services.
For example, they allow:

to ensure the authentication and security of your account,
to keep your session active after login,
to save your essential preferences,
to work effectively with our professional partners.

These so-called “functional” or “strictly necessary” cookies do not require your consent and cannot be deactivated, because without them the service you requested (connection to your user area) cannot function.

Here are functional cookies:

Plausible: collection of anonymized navigation data (pages visited, duration, geographical origin). Since this data is anonymized, it does not require your specific consent.
Memberstack (or Google if you use Google Login): registration and login data (required to be able to use your account).
Stripe: email address and payment information (required to be able to make a purchase on our Site).
Vimeo : in order to ensure the proper functioning of our platform, we must measure the viewing of videos hosted via the Vimeo service. This measure is essential to guarantee the provision of the service to users and professionals. For this reason, these video tracking cookies are considered to be strictly necessary and cannot be deactivated.

4. Purposes of the treatment

Your personal data is collected and used for the following purposes:

Creation and management of your user account.
Response to your requests via forms.
Managing newsletter subscriptions and sending marketing information.
Audience analysis and improvement of the Site (via Plausible).
Monitoring of advertising campaigns (Facebook Pixel).
Customizing the user experience according to your content preferences.
Management of appointments (Calendly).

Reflet will never ask you for personal data related to your health situation in order to use your account or to view Reflet programs.

5. Legal bases for processing

Execution of the contract : account management, provision of purchased services.
Consent : subscription to the newsletter, content preferences, advertising cookies.
Legitimate interest : site analysis and continuous improvement (Plausible), marketing optimization.

6. Data retention period

User account : retained as long as the account is active. Deleted 6 months after account deletion.
Forms/registrations : kept for 3 years after the last contact.
Newsletter (Brevo) : until unsubscribed, or 3 years after inactivity.
Content preferences : retained as long as the account is active.
Navigation data (Plausible) : anonymized and kept only for statistical purposes.
Calendly : appointment data stored according to Calendly rules, then deleted.

7. Data sharing

Your data can be transmitted to our technical service providers:

Webflow (hosting, forms — USA, Data Privacy Framework certified)
Memberstack (registration, subscription - USA, Data Privacy Framework certified)‍
AWS (Amazon Web Services) (hosting — USA, Data Privacy Framework certified)‍
Brevo (Sendinblue) (emailing — EU)
HyvorTalk (comment - Germany)‍
Tally (questionnaires) — Belgium
‍Calendly (planning — USA, Data Privacy Framework certified)‍
facebook (advertising tracking — USA, Data Privacy Framework certified)

👉 These transfers are supervised by the Data Privacy Framework, guaranteeing a level of protection equivalent to that required by the RGPD.

Transfers governed by the Data Privacy Framework (DPF)

In order to guarantee the protection of your personal data when transferred to service providers located in the United States, we have chosen to work only with certified services under the EU-U.S. Data Privacy Framework (DPF), approved by the European Commission in July 2023.

This certification guarantees that the American companies concerned (in particular Webflow, AWS, Calendly, facebook) respect strict confidentiality and data protection rules, equivalent to those required by the RGPD in the European Union.

You can consult the official list of certified companies on the American Department of Commerce website: https://www.dataprivacyframework.gov/.