Privacy policy.

This policy describes how NULLVECTOR collects, uses and protects personal data through its nullvector.red website and its services. It applies in accordance with the General Data Protection Regulation (GDPR, EU 2016/679) and the French Data Protection Act.

1. Controller

Controller

NULLVECTOR

Status

Sole trader (auto-entrepreneur)

SIREN

932 772 601

Location

Orléans · France

Privacy contact

privacy@nullvector.red

2. Data we collect

We collect strictly the data necessary to provide our services and qualify inbound commercial requests:

• Free-scan form: domain name submitted, email address, company size, context (free-text, optional), request locale.
• Technical data: visitor IP address (used solely for rate-limiting and hashed immediately after receipt), submission timestamp.
• Communications: subsequent exchanges (email, call) related to an engagement or quote.

No sensitive data (health, political opinions, religion, etc.) is collected.

3. Purposes and legal bases

• Qualify the request and send the scan report— legal basis: pre-contractual measures at the data subject's request (art. 6.1.b GDPR).
• Prevent form abuse (rate-limit) — legal basis: legitimate interest of the Controller in protecting its systems (art. 6.1.f GDPR).
• Subsequent commercial communications — legal basis: contract performance if an engagement starts, or legitimate interest for non-converted leads (with opt-out at any time).

4. Retention

• Form submissions not converted to an engagement: 12 months from last interaction.
• Data related to a completed engagement: 5 years after the end of the commercial relationship (accounting and civil prescription obligations).
• Hashed IPs (rate-limit): 24 hours rolling (technical duration required for the rate-limit window).

5. Recipients and processors

Your data is accessible only to authorized personnel of NULLVECTOR. Some technical processors handle data on our behalf:

Hosting

Vercel, Inc. — 440 N Barranca Avenue #4133, Covina, CA 91723, USA

Email sending

Resend, Inc. — 2261 Market Street #5039, San Francisco, CA 94114, USA

Rate-limit / cache

Upstash, Inc. — 651 N Broad St., Suite 201, Middletown, DE 19709, USA

All processors are bound by a sub-processing agreement compliant with article 28 GDPR.

6. Transfers outside the European Union

Some processors above (Vercel, Resend, Upstash) are based in the United States. Transfers are governed by the Standard Contractual Clauses approved by the European Commission and, where applicable, by participation in the EU-US Data Privacy Framework. Copies of these safeguards are available on request to privacy@nullvector.red.

7. Your rights

Under articles 15 to 22 of the GDPR, you have the following rights regarding your data:

• right of access and copy,
• right of rectification,
• right of erasure (“right to be forgotten”),
• right to restriction of processing,
• right to data portability,
• right to object to processing,
• right to define post-mortem directives.

To exercise these rights, write to privacy@nullvector.red. We will respond within one month maximum.

You also have the right to lodge a complaint with the CNIL (the French data protection authority, www.cnil.fr) if you believe the processing of your data does not comply with applicable regulations.

8. Cookies

The nullvector.red site does not use advertising tracking cookies. Only strictly necessary cookies (language preference) may be set; these are exempt from prior consent under CNIL guidance.

9. Security

We implement appropriate technical and organizational measures to protect your data: TLS encryption in transit (HSTS, HTTP/2), encryption at rest with our processors, restricted access, regular secret rotation, and a defense-in-depth posture consistent with our profession.

10. Changes

This policy may be updated to reflect regulatory changes or our internal practices. The date at the top of the page indicates the version in effect. Any substantial change will be notified to you by email if we hold your address.