Privacy policy

1. Data controller

Xavier Vignon, sole proprietor (SIRET 514 390 881 400 41), 200 rue de la Croix Nivert, 75015 Paris, contact@ohmessage.com, is the controller of the personal data collected on ohmessage.com.

2. Data collected

When you place an order, we collect: the character and language chosen, the recipient's first name(s), the occasion, the optional anecdote and the text of the message (which may contain information about third parties), the customer's email address, and payment information, processed exclusively by Stripe and never stored by OhMessage.

To limit abuse, technical request counters per IP address are used; they are not linked to an order.

3. Purposes

This data is used to: suggest a message from the customer's answers; automatically check the content of the message before payment; produce the personalised video (image, voice, animation) and send it by email; send the order receipt; provide support and prevent abuse.

The emails sent are transactional only (confirmation, delivery). No advertising emails are sent.

4. Legal basis

Processing the data needed to produce and deliver the video is based on the performance of the contract with the customer. Content checks and abuse prevention are based on OhMessage's legitimate interest in preventing the use of its services for unlawful purposes. Keeping payment and invoicing data is based on a legal obligation.

5. Recipients of the data

Order data is stored in a Supabase database hosted in the European Union. The website is hosted by Vercel. Payment data is processed exclusively by Stripe. Emails are sent through Brevo.

The message, the first names and the character image may be sent to providers specialised in generating content with artificial intelligence: OpenAI (message suggestion and checking, generation of the personalised image), ElevenLabs (voice generation) and WaveSpeed (video generation).

Some of these providers, including OpenAI, ElevenLabs and WaveSpeed, are located outside the European Union (notably in the United States); these transfers are covered by the appropriate safeguards provided by these providers (European Commission standard contractual clauses or an equivalent mechanism).

Access to order data is restricted to the data controller, through an administration interface protected by authentication. No data is sold or passed to third parties for commercial purposes.

6. Retention

The text of the message, the recipient's first name(s) and the email address are automatically erased 30 days after the order, including for orders that were started but never completed. Only non-identifying data (status, amount, date) is kept afterwards; payment records are kept for the legal period applicable to accounting documents.

The video is deleted from our storage when the link expires, 90 days after delivery.

7. Your rights

Under the GDPR, you have the right to access, rectify, erase and object to the processing of your data. To exercise them, contact contact@ohmessage.com. You also have the right to lodge a complaint with the CNIL (cnil.fr).

8. Cookies and analytics

The website does not set any cookie and uses no tracker subject to consent. No consent banner is therefore needed. If an analytics tool were added, this policy would be updated.