Account data protection policy

Last updated on September 30, 2026

This text is a translation, provided for information purposes. Only the original French version is authoritative: in the event of any discrepancy, it shall prevail.

Applies to everyone who signs up on the site

People who sign up on randraw.studio are referred to below as ORGANIZERS, in the sense of the organizer of an event. The randraw.studio site, published by Philippe BILLAULT, is referred to as the PUBLISHER.

To summarize what follows: we process only what is strictly necessary to make your account work, and we share your data only with the data processors on the public list.

Who processes account data?

The PUBLISHER, and the PUBLISHER alone, is the data controller for the ORGANIZERS' personal data described here. The data of your events and of your participants is a separate matter: see the participant data protection policy.

Data collected and purposes

  • the email address: so that you can sign in, to verify your address, and to write to you (account security, support);
  • the password: so that you can sign in. We keep it only in an irreversibly encrypted form. An account created with Google has no password;
  • the first name and last name, and the company if you provide it: to identify your account and personalize our exchanges;
  • the language of your account: to display the site to you in the right language;
  • the date of your last sign-in;
  • the two-factor authentication secret, if you enable it: we keep it encrypted;
  • the “Likes” you give to scenes: the account, the scene and the date.

If you sign in with Google, Google sends us your email address and your first name, and nothing else. We keep neither a Google identifier nor an access token.

Other data collected and purposes

  • your purchases: the plan, the amount, the currency, the dates, the status, the identifiers of your subscription at Stripe, the brand of your card and its last four digits. We never keep your card number or your billing address;
  • your messages to support and through the contact forms: name, email address, message, language, and your truncated IP address (see the visitor policy);
  • the log of the emails we send you: to limit abusive sending and to verify that a message has indeed been sent.

The emails we send to your account (address confirmation, forgotten password, security, invitations, support) contain an invisible image that tells us whether the message has been opened.

Cookies

  • the session cookie, which makes the site work;
  • a cookie that keeps you signed in for one year, on this device;
  • if you enable two-factor authentication: a 30-day cookie that recognizes your device;
  • on your studio's server, one-year access cookies (studio, entry station, kiosk) that save you from re-entering a code.

Where is your data stored?

Your account data is stored on the main site's server, hosted by OVH. Your events and your participants are stored on your studio's server, in the region of your plan: Europe, North America or Asia.

So that you can sign in to your studio, we copy to it your email address, your password in its encrypted form and the encrypted two-factor authentication secret. Your last name, first name and company remain on the main site.

Rights of access, rectification and objection

To exercise your rights, write to us through the contact form or, if you are signed in, through your account's support.

Data sharing

We do not sell your data and we do not transfer any of it to any commercial partner. Our payment provider, Stripe, receives the data necessary for payment, strictly within the scope of its role. The authorities may request data from us in the cases of strict necessity provided for by law.

Retention period and right to erasure

Unless otherwise indicated, data is kept until your account is closed.

You close your account from your account area. Deletion is scheduled for 30 days later, or for 30 days after the end of your paid plan if it is still running. During this period, you can reactivate your account. Where no paid plan is running, the data of your events and of your participants is erased as soon as the account is closed, and does not come back if you reactivate.

On deletion, we erase your account, your profile, your plans, your events and their participants, your exchanges with support, the log of the emails sent to your address and your “Likes”.

The following remain after deletion:

  • your purchases (plan, amount, dates, Stripe identifiers): the law requires us to keep accounting data for 10 years;
  • the messages sent through the contact form, which are not linked to an account: you can request their erasure by writing to us.

Data backup

Every night, the database is backed up to a Dropbox space reserved for us. We keep the last 90 backups, as well as the first of each month, with no time limit. A deleted account may therefore remain in an old backup.

DPO

The DPO is the data protection officer. We process a small amount of personal data, we do not trade in it, we receive none from any partner and we send none to any. We have chosen not to appoint a DPO.

Complaints

For any request concerning data protection, write to us in the first instance through the contact form or through your account's support. If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the CNIL.