Privacy policy
Version 1.0 — effective 23 October 2026
This English version is provided for convenience. In the event of any discrepancy, the French version prevails.
Confidentiality is not an option at Like a Jester: it is the reason it exists. This policy explains which data we process, why, for how long, and how to exercise your rights, in accordance with Regulation (EU) 2016/679 (“GDPR”) and the French Data Protection Act.
1. Data controller
Rémi Aubert, Particulier, -. Personal data contact: rgpd@likeajester.com.
We act as a data controller independent of your employer. Your employer has no access to our databases or to the identity of people who ask questions — including when it is a company managed by the publisher of the service.
2. Data processed, purposes and legal bases
| Data | Purpose | Legal basis |
|---|---|---|
| Name, work email address, technical identifier from Google (sign-in provider), organisation, role, language, sign-up and last sign-in dates | Creating and managing the account, attaching it to the organisation, securing access | Performance of a contract (art. 6.1.b) |
| Content of questions and messages (encrypted), visibility, supports (▲) as fingerprints | Providing the anonymous dialogue service | Performance of a contract (art. 6.1.b) |
| Encrypted link between a question and your account, when email notifications are on (default setting, can be turned off for each question) | Emailing you at your work address when management replies | Performance of the contract and legitimate interest (art. 6.1.b and f); you can object at any time by turning notifications off |
| Managers' names and emails, published replies | Publishing management's replies | Performance of a contract (art. 6.1.b) |
| Organisation billing data (company name, address, VAT number, invoices) and the monthly count of active users (a technical identifier, the month and the role, never linked to any question) | Invoicing and accounting | Legal obligation (art. 6.1.c) and contract |
| Session cookie, language cookie, in-memory anti-abuse counters | Keeping you signed in, remembering your language, preventing abuse | Legitimate interest (art. 6.1.f) |
Depending on what you write, your questions may contain sensitive data (health, union views…). We recommend not including any. If you do, it is on your own initiative, and this information is protected by the same encryption and anonymisation measures.
We make no automated decisions about you and carry out no profiling.
3. What we do not collect
- No passwords: authentication is delegated to Google, which only sends us your identifier, name and email address.
- No access to your email, calendar, files or contacts.
- No advertising trackers, no audience measurement tools, no third-party pixels.
- No application log linking an IP address or an account to a question or message.
4. Recipients
- Your organisation's managers: the content of all questions (without the authors' identity), and the list of accounts in the organisation (name, email, role, active or deactivated) so they can manage access and billing — never sign-in times or activity.
- Your colleagues: the content of questions their authors have made public (without the authors' identity).
- Our technical processors, bound by commitments compliant with article 28 GDPR:
- Server hosting: Scaleway;
- Transactional email delivery: [SMTP provider, country];
- Payment (Managers only): Stripe Payments Europe Ltd (Ireland);
- Authentication: Google Ireland Ltd.
Some of these providers may transfer data outside the European Union (notably to the United States). Such transfers are governed by the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses. The content of questions is never sent to these providers, except the host, which only stores encrypted data.
We do not sell or rent any data. We disclose no data to your employer beyond what is described above.
5. Retention periods
| Data | Period |
|---|---|
| User account | Until you delete it, or 24 months after the last sign-in (automatic deletion after notice) |
| Questions and conversations | Until deleted by their author or until the organisation's space is deleted |
| Notification link | Until notifications are turned off, or the question or account is deleted |
| Sign-in session | 8 hours of inactivity |
| Language preference (cookie and account) | 12 months (cookie); lifetime of the account |
| Email sending queue | 7 days after sending (30 days maximum) |
| Invitations | Valid 14 days, erased 30 days after expiry |
| Billing data (invoices) | 10 years (French accounting obligation) |
| Monthly record of active users | 13 months |
| Backups | Rolling 30 days, encrypted |
6. Security
Encryption of communications (TLS) and content (AES-256-GCM), no author/question link accessible to your organisation, encrypted notification link, keys kept outside the database, deliberately imprecise timestamps, delayed content-free notifications, protection against common web attacks (CSRF, XSS, SQL injection, brute force), restricted administrator access, encrypted backups, regular security updates. Details are on the Anonymity & security page.
7. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent and to set instructions regarding your data after your death.
- Self-service: from the “Account” page, download all your data (including the content of your questions) or delete your account, with or without your questions.
- By email: rgpd@likeajester.com. To protect your anonymity, write from the address linked to your account: we will never confirm to a third party that a person has asked a question.
We reply within one month. You may lodge a complaint with the French data protection authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr), or with the supervisory authority of your country of residence.
8. Cookies
We use only two cookies: a session cookie, strictly necessary for the service to work (keeping you signed in, 8 hours), and a cookie remembering the language you chose (12 months). Both are exempt from consent (article 82 of the French Data Protection Act, ePrivacy Directive). No other cookie or tracker is set, which is why you are not shown a consent banner.
9. Changes
You will be notified of any substantial change to this policy at least thirty days before it takes effect.