Privacy policy

The controller of personal data is:

CONTINUITIS SAS à capital variable
SIREN: 898 291 711
Registered office: Haut Chemin du village Austinca, 20287 Meria, France
Email: [email protected]

When you use the continuitis.fr website, we may collect the following data:

• Contact form: first name, surname, email address, subject and message
• Waiting list (closed when the service opened on 14 October 2026): email address, first name (optional), plan of interest and visit origin (campaign parameters of the landing address, e.g. “google”, and, if you accepted advertising cookies, the Google or Meta ad click identifier if present), with no cookie
• Browsing data: page viewed, referring website or campaign, device and browser type, country, and a few actions carrying no personal data, with no cookie and no stored IP address (Umami audience measurement); if you accept advertising cookies, and only on the “First letter” page, the page address, the fact that you clicked towards sign-up, your IP address and technical information about your browser are also sent to Meta and Google

You can object at any time: “Reject” button of the cookie banner, or the cookie preferences button on the cookie policy (neither audience measurement nor advertising tags are then loaded), and your browser's “Do Not Track” signal (audience measurement).

The data entrusted via the Continuitis application (messages, documents, passwords) is encrypted on your device with AES-256-GCM, before being sent to our servers. A sealed copy of the key allows it to be passed on after your death; every access is logged.

The application also processes the data needed for the death detection system: the account email address, the timestamps at which the periodic proof-of-life checks (“heartbeat”) were sent and answered, and the suspension periods you declare (“holiday mode”). This system is described in Article 4 of our general terms and conditions of sale.

Recipients. Your data is intended for Continuitis and for the technical providers that process it on its behalf (hosting with Microsoft Azure, payment by Stripe, email delivery). Audience measurement is entrusted to Umami Software, Inc. If you accept advertising cookies, Meta Platforms Ireland Ltd and Google Ireland Ltd receive the browsing data described in Article 2, which they also process on their own behalf under their own policies. For the collection and transmission of this data by its pixel, Meta and Continuitis are joint controllers (Article 26 GDPR), under Meta's Controller Addendum; Meta alone is responsible for the processing it carries out afterwards. If your subscription has ended and you have not logged in to your account since our first notice email, each trusted contact you have designated is notified by email of the upcoming deletion of your content; for a minor contact, their legal representative is notified instead. This email states your name, the end of your subscription, that you have not logged in and the deletion date, and lets the contact tell us if something has happened to you. It gives no access to any content.

• Contact data: 3 years from the last exchange
• Waiting list: until you unsubscribe, and at the latest 3 years after you signed up
• Browsing data: 6 months for audience measurement (Umami); advertising cookies: 3 months at most in your browser, the data received by Meta and Google being kept under their own policies; your cookie choice: 6 months
• User account data: for the duration of the contractual relationship, then 90 days after the account is deleted; twelve more months for an account opened with an accompanied access code, in the cases set out in Article 7 of the terms and conditions of sale
• Invoices and accounting records: 10 years (Article L.123-22 of the French Commercial Code)
• Proof-of-life check history: send and response timestamps kept for the same period as the user account data
• Beneficiary identification data: for as long as the user maintains the designation, then, after the death, until access to the content expires and a thirty-day grace period has passed, before permanent deletion; the contact details of a minor beneficiary’s legal representative are erased when the beneficiary comes of age, after the notice informing them of this where a notice is sent to them, or, if the legal representative activated access to the content before that age, when that access is permanently deleted
• Legal representative authorisation confirmation: nature of the purchase and date of the confirmation, kept for 90 days in our audit log, then one year in archive
• Content passed on to beneficiaries: six months from the activation of the beneficiary’s access, extendable up to fifty-four months depending on the options taken out, followed by a thirty-day grace period before permanent deletion (see our general terms and conditions of sale)

In accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés), you have the following rights:

• Right of access: to obtain confirmation that your data is being processed and to receive a copy of it
• Right to rectification: to correct inaccurate or incomplete data
• Right to erasure: to request the deletion of your data
• Right to data portability: to receive your data in a structured, readable format
• Right to object: to object to the processing of your data
• Right to restriction: to request that processing be suspended
• Post-mortem directives: to set directives concerning the retention and communication of your data after your death (Article 85 of Law No. 78-17 of 6 January 1978, known as the “Informatique et Libertés” Act)

To exercise these rights, contact us at: [email protected]

You may also lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés, the French data protection authority): www.cnil.fr

Your content (messages, documents, encrypted passwords) and account data are stored in the European Union with Microsoft Azure (France Central region; e‑mail and website data: Europe). Microsoft being a US company, we have entered into standard contractual clauses with it, and it participates in the EU‑US Data Privacy Framework.

Some providers may nevertheless process data outside the EU, in the United States, under the European Commission's adequacy decision of 10 July 2023 (Data Privacy Framework) and, failing that, standard contractual clauses:

• Stripe (card payments). Stripe Payments Europe Ltd (Ireland) processes your payment; data may be transferred to Stripe, Inc. (United States). For fraud prevention and its own regulatory obligations, Stripe acts as a data controller: see its privacy policy. Continuitis neither receives nor stores your card number.
• Cloudflare (Turnstile anti‑bot service on the contact form): your IP address and technical browser information are sent to Cloudflare, Inc. (United States).
• Umami (cookie-free audience measurement). Umami Software, Inc. (United States) and its hosting sub-processors, in the European Union and the United States. This transfer relies on the standard contractual clauses built into Umami's data processing agreement.
• Meta and Google (advertising tags, only if you accept them). Meta Platforms, Inc. and Google LLC (United States).

You may obtain a copy of the applicable safeguards by writing to [email protected]. The content you entrust to us is not sent to any of these providers.

We implement appropriate technical and organisational measures to protect your personal data against any unauthorised access, modification, disclosure or destruction. To find out more, see our security page (in French).

Continuitis is available from the age of fifteen (15). In accordance with Article 45 of the French Data Protection Act, a user aged fifteen consents alone to the processing of their personal data in connection with the service; they may also set directives regarding what happens to their data after their death (Article 85 of the same Act). The date of birth entered at sign-up is used to check this threshold.

Any purchase made from an account whose holder is under eighteen requires the authorisation of their legal representative (see our general terms and conditions of sale). The holder confirms it by ticking a box at each payment. The confirmation is timestamped on the order at our payment provider and in our audit log, which records only the nature of the purchase and the date of the confirmation; this entry is kept for 90 days, then one year in archive. No data about the legal representative is collected on this occasion.

When a user designates a minor beneficiary, we collect, at the time of that designation and as entered by the user, the beneficiary’s name, date of birth and email address, as well as the contact details of their legal representative. The date of birth is used to determine whether the beneficiary is a minor and, consequently, to whom the transmission must be addressed.

This processing is based on the performance of the contract entered into with the user (Article 6.1.b of the GDPR), the designation constituting a specific directive within the meaning of Article 85 of the French Data Protection Act. It does not rely on the minor beneficiary’s consent: Article 45 of that Act therefore does not apply. In accordance with Article 14.5.b of the GDPR, the beneficiary is not informed of their designation during the user’s lifetime, as this information would defeat the purpose of the service; they receive full information at the time of the transmission.

The beneficiary’s identification data is kept for as long as the user maintains the designation, then, after the death, until access to the content expires (six months after its activation, unless extended) and a thirty-day grace period has passed, before permanent deletion. The contact details of a minor beneficiary’s legal representative are erased when the beneficiary comes of age, after the notice informing them of this where a notice is sent to them; where the legal representative has already activated access to the content, they are kept until that access is permanently deleted. Only a record of the designation, without contact details, remains.

While the beneficiary is a minor, receiving the content intended for them requires the involvement of their legal representative at the time of the transmission: the notification, the activation of access and the unlocking of the content are addressed to the legal representative.

Last updated: October 2026