hej.
Discover hej
This English text is a courtesy translation. Only the French version is legally binding.

Privacy policy

SARL ACTION GIRATOIRE (« we ») processes your personal data in the course of providing the hej service accessible via hej.fr. This policy describes the data collected, the purposes, the retention periods and your rights in accordance with the GDPR and the French Data Protection Act (loi Informatique et Libertés).

Data controller

SARL ACTION GIRATOIRE — 6 impasse George Sand, 83136 Garéoult. Data protection officer: dpo@hej.fr.

Data collected

  • Account: email, name, password (hashed), language.
  • Organization and billing: workspace name, subscribed plan, Stripe customer identifier. Payment card data neither passes through nor is stored by us: it is handled directly by Stripe.
  • Content: sites, pages, media and text that you create on the platform.
  • Technical logs: IP address, user-agent, timestamps of sensitive actions. The IP address is used solely to detect abuse and is hashed (salted SHA-256) before being stored in the statistics.
  • Visit statistics: aggregated page views, referrers (no third-party cookies, no advertising tracker).

Purposes and legal bases

  • Performance of the contract: account creation, editing and publishing of sites, billing.
  • Legitimate interest: security (fraud prevention, rate limiting), customer support, service improvement.
  • Legal obligation: retention of invoices and connection logs.
  • Consent: optional marketing communications (you may unsubscribe at any time).

Retention periods

  • Active account: for the entire duration of use.
  • After account deletion: purged within a maximum of 30 days, except for invoices which are kept for 10 years (accounting obligation).
  • Security logs: 12 months.

Recipients and sub-processors

  • Hosting: Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, États-Unis).
  • Payments: Stripe, Inc.
  • Transactional emails: Resend, Inc.
  • Media storage: S3-compatible provider (EU preferred).

Transfers outside the EU are governed by the European Commission's standard contractual clauses.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. You can:

  • export your data from your workspace (menu My account → Personal data);
  • delete your account from that same workspace;
  • write to dpo@hej.fr for any other request.

You may lodge a complaint with the CNIL (www.cnil.fr) if you believe your rights are not being respected.

Cookies

This site (hej.fr and the client area) uses only cookies strictly necessary for operation (authentication session, theme preferences, storage of your cookie choices). No advertising or third-party tracking cookie is set.

Cookies on sites created with hej

Sites published by our customers may use, in addition to strictly necessary cookies, two personalization cookies: cscs-vid and cscs-ab. Their purpose is experience comfort: content personalization and A/B testing (showing a page variant). They contain a random identifier, are kept for 30 days and are specific to the site you visit: they are never shared across sites and cannot be used to follow a visitor from one site to another.

These cookies are not set if you refuse via the site's consent banner ("Marketing & personalization" category); they are deleted if consent is withdrawn. They are not used for the live activity view, the visitor map, cart tracking or the recommendations shown to site editors — those features rely on aggregated, short-lived data without cookies.

Last updated: 05/10/2026