Ludip waitlist — privacy

Version 1.4 — 26 October 2026. Version française.

At a glance

We use your email address to keep you informed about Ludip. Signing up is optional, for adults only, and you can unsubscribe at any time. We use your address for the emails you have consented to receive.

Controller

Iliasio, Ludip’s publisher, is the data controller: 24 avenue Joannès Masset, bâtiment 5, bureau 5, 69009 Lyon, France. Contact: contact@ludip.app.

Why we email you

Your consent lets us announce Ludip’s release on iPhone, iPad and Android and send updates before release. If release dates differ, we announce each release.

A second optional checkbox lets you receive news and commercial offers from Iliasio about Ludip. These two consents are independent and withdrawal applies regardless of language: “Manage my preferences” in our emails lets you withdraw either one; “Unsubscribe from all emails” withdraws both. You can also email us. Not signing up has no effect on access to the app; you simply do not receive these emails.

Consents collected under earlier wording retain their original scope and frequency, including the limit to news and offers after release for v2 consents. The extension to commercial offers applies only to future signups under the new wording; fresh consent is needed to broaden an earlier consent.

Legal bases

• Consent (GDPR Article 6(1)(a)) for waitlist emails and, separately, news and commercial offers about Ludip.
• Legal obligation (Article 6(1)(c), Articles 7 and 21) to demonstrate consent, respect withdrawals and handle rights requests.
• Legitimate interests (Article 6(1)(f)) to display and secure the site, prevent abusive signups and answer your messages.

You may withdraw consent at any time, without giving a reason. Withdrawal does not affect the lawfulness of processing carried out beforehand.

Data we use

We use your email address, chosen language, consents and their evidence (accepted wording, request and confirmation dates, chosen lists), subscription status and email delivery information. If you email us, we receive your message.

Cloudflare receives your IP address and technical connection data. Our program uses fingerprints calculated with a secret key from the IP and email address to prevent abuse and reuse of links. It does not send your IP address to Mailjet.

Confirmation

After the form, the link emailed to you opens a page with a confirmation button. Only this button confirms your choices. The link expires after 30 days; without confirmation, we send no marketing emails or reminders. Your address and choices are encrypted in the link: keep it private. Mailjet receives your address to send this email before you join any marketing list.

Adults

Use your own adult email address. We do not ask for any information about your child.

Who processes your data

Iliasio and its processors: Mailjet (Sinch group) for contacts and email delivery, Cloudflare, Inc. (United States) for the site, form and security, and OVH SAS (OVHcloud, France) for the contact@ludip.app mailbox. Their subprocessors may help provide these services. Mailjet also uses routing and usage data to secure and improve its service, as described in its notice. Authorities may receive data where required by law.

Data storage: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, United States; Mailjet SAS (Sinch group), 43 rue de Dunkerque, 75010 Paris, France, for contacts and emails; OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, for email hosting.

Iliasio does not share contacts from this list or messages sent to contact@ludip.app with AI assistants, or grant them access to this data.

Hosting and transfers

Mailjet states that data is hosted on Google Cloud in Frankfurt (Germany) and Saint-Ghislain (Belgium). Access from outside the EU, including the United States for support, is possible. The Sinch DPA provides European Commission Standard Contractual Clauses for relevant transfers.

Cloudflare’s global network may process your connection and form data outside the EU, including in the United States. Cloudflare, Inc. is an active participant in the EU–US Data Privacy Framework (DPF). Transfers to this entity are covered by that framework; its DPA provides Standard Contractual Clauses for other relevant transfers. Rate limiter fingerprints are stored in the European Union.

OVHcloud may use group companies, including in Canada and the United Kingdom, for security and maintenance. Its DPA provides Standard Contractual Clauses for transfers to countries without an adequacy decision. You may ask us for a copy of transfer safeguards.

Site and emails

The page sets no cookies and loads no third-party resources. Program application logs are disabled. Cloudflare also processes network data for its own security under its policy. The confirmation email is sent without individual tracking of opens or clicks. Personal links serve to confirm your subscription or manage your choices.

Using Workers Analytics Engine, we record timestamped send, confirmation and withdrawal events, together with the language and signup category, to produce statistics. Our program sends no IP address, email address or contact identifier with these events. They are retained for three months and are separate from your consent evidence.

Retention

• Waitlist and consent evidence: until 3 months after the last release on the announced platforms, and no later than 24 months after signup.
• News, commercial offers and separate consent evidence: until withdrawal, and no later than 3 years after signup or your last contact concerning this marketing. Merely opening an email does not extend this period. Earlier subscriptions keep the deadline stated when they were collected.
• Withdrawal: withdrawal stops the relevant emails and the use of your data for that marketing purpose. Data needed for another consent remains in use for that purpose. We separately retain a minimal suppression record for three years after withdrawal, solely to prevent unwanted re-subscription. Evidence needed for an identified dispute is retained until its final resolution. Other data that is no longer needed is deleted. You can request erasure at contact@ludip.app: Mailjet deletion immediately anonymises the contact and fully removes its records within 30 days.
• Unconfirmed request: the link expires after 30 days. Once it expires, we delete request data that is no longer needed, unless it remains necessary for another valid subscription. Delivery records needed for delivery monitoring and security are retained for up to 90 days. Security fingerprints follow the periods stated below.
• Security fingerprints: IP 24 hours, email address 30 days; single-use protection until link expiry and blocking of an old link for 30 days after withdrawal. Cloudflare’s recovery history may keep them for another 30 days. Following a signup or withdrawal incident, the fingerprint and date are kept until the incident is checked and resolved to respect your choices.
• Messages and rights requests: 12 months after the last exchange.
• Cloudflare security events (including IP and connection information): up to 31 days in its dashboard.
• Statistical events: 3 months in Analytics Engine.

Your rights

Email contact@ludip.app to access or correct your data, request erasure, portability or restriction of processing. You may withdraw consent and object to emails without giving a reason, using their unsubscribe link or by email. You may object to processing based on our legitimate interests on grounds relating to your particular situation. You may give instructions about your data after your death. We respond within one month, with an extension possible under the GDPR.

Complaints

You may complain to the CNIL or your country’s data protection authority.

Updates

The version date is shown at the top. Before processing your data for another purpose, we will provide the required information and obtain your consent where necessary.

Contact

contact@ludip.app — Iliasio, at the address above.