Este texto jurídico só existe em francês e inglês; prevalece a versão francesa.
erase4me.com Privacy Policy
Version 1.0 - effective 13 novembre 2026
erase4me.com is a free service in beta. This page explains in plain terms what personal data we process, why, who receives it and how to exercise your rights.
1. Who is responsible for your data?
The data controller is Lucas MARQUES, a natural person, publisher of erase4me.com, 2A chemin de la Basse Taye, 54110 Rosières-aux-Salines, France, France. Contact for any question about your data: [email protected]. The service runs on a server owned by the publisher in France, with no third-party hosting provider. No Data Protection Officer (DPO) has been appointed; the law does not require one for this service at this stage.
2. What the service does
With your mandate, erase4me sends, in your name and by e-mail, GDPR requests (erasure, objection, notification of recipients: Articles 17, 21 and 19) to data brokers (companies that collect and resell personal data). It tracks replies, sends reminders at day 30 and day 45, and creates a task at day 60 reminding you that you may complain to the CNIL. Automatic sending happens only if you ticked the mandate box at sign-up and explicitly activated automatic sending. You can turn it off at any time.
Enter only your own data, or that of a person who has given you a mandate to act for them. Do not enter sensitive data (health, opinions, etc.).
3. Data, purposes and legal bases
| Why | What data | Legal basis |
|---|---|---|
| Create and secure your account | login e-mail (stored encrypted, with an HMAC fingerprint to find it), password (hashed with Argon2id), two-factor authentication (TOTP) if enabled | Providing the service you request (contract) |
| Build your vault of identifiers | name and variants, e-mails (verified by link), phone numbers, postal addresses; encrypted with AES-256-GCM using a key specific to your account | Providing the service (contract) |
| Send and follow requests to brokers | requests sent, encrypted copies of messages, encrypted excerpts (600 characters, no links) of replies received, tracking events | Providing the service (contract); your mandate and your explicit activation of automatic sending (consent) for sharing your name and verified e-mails with brokers |
| Find where your data appears | e-mail, phone or "name + city" sent to search engines, XposedOrNot and the Recherche d'entreprises API; we keep, encrypted in your account and visible to you only, the address and title of the public pages found (at most three per site), the type of data visible and, for breaches, the name of the breached service and the categories of data exposed; never the page excerpt or its content | Your consent, separate and withdrawable at any time |
| Keep a log of cold calls | calling numbers, dates, notes | Providing the service (contract); legitimate interest for third parties' numbers |
| Keep the service secure | sessions (hashed fingerprints of IP and user-agent), audit log with no personal content | Legitimate interest in security |
| Prove your consent | version accepted, date, hashed IP fingerprint | Duty to be able to demonstrate consent; legitimate interest |
| Answer your requests and handle incidents | data strictly needed | Legal obligation |
Brokers receive only your name and verified e-mails. They do not receive your phone numbers or postal addresses.
No automated decision with legal effect on you is made.
4. Who receives your data?
- Brevo (Sendinblue SAS, France): SMTP relay for service e-mails and your requests. Processor.
- Google (Gmail): mailbox receiving brokers' replies, read via IMAP. Processor.
- Cloudflare: DNS, proxy, tunnel and inbound e-mail routing. Processor.
- Search engines (Bing, Yahoo, Brave, DuckDuckGo, Google), queried from our server through a self-hosted meta-search engine with your e-mail, phone or "name + city", if you consented to searches. They process these queries for their own purposes.
- XposedOrNot: breach check from your e-mail (if you consented to searches).
- Recherche d'entreprises API (data.gouv.fr): queried with your name (if you consented to searches).
- The data brokers you ask us to contact: they receive your name and verified e-mails. They are located in the European Union, the United States and elsewhere.
We do not sell your data. We use no advertising, no audience measurement and no tracker.
5. Transfers outside the European Union
Some recipients are outside the EU, notably in the United States (for example Google, Cloudflare, some search engines and brokers). Depending on the recipient, the transfer relies on a European Commission adequacy decision (for example the Data Privacy Framework for certified US companies, or the United Kingdom, Switzerland, Japan...), on standard contractual clauses, or, failing that, on your explicit consent after being informed of the risks (the lack of equivalent protection). Details of the safeguards applying to each recipient are available on request. You can refuse web searches or turn off automatic sending; to obtain a copy of the safeguards, write to us.
6. How long do we keep your data?
- Active account: your data is kept to provide the service. An account with no login for 24 months is deleted automatically, after an e-mail warning one month before.
- If you delete your account (yourself, or automatically): the vault, requests, detected exposures, messages and replies, call log, consents, sessions and tracking events are erased immediately. Audit logs contain no personal data (the link to your account is removed).
- Sessions: 12 hours at most. Confirmation and reset links: 24 hours and 1 hour. Audit logs (no personal data): 12 months. Proof of your consent and mandate: as long as the account exists.
- Broker replies: the encrypted excerpt is kept in your account; messages received in the service's technical mailbox are deleted after 30 days.
- Backups: a daily backup is made to an external disk; at most three copies are kept. Your data is encrypted field by field there (the key is not in the backup) and disappears from backups within three days of deletion.
- Brokers apply their own retention periods to the requests they receive.
7. Your rights and how to exercise them
You have the right to access, rectify and erase your data, to restrict its use, to object to processing based on legitimate interest, to receive it in a reusable format, to withdraw consent at any time without affecting what happened before, and to set instructions for your data after your death (where applicable). What you can do yourself in the service: export your data (JSON file), delete your account, turn off automatic sending at any time, enable two-factor authentication. For any other right: write to [email protected]. We answer within one month, extendable by two months for complex requests, and we tell you if so. We may ask for proof of identity if in doubt. Withdrawing consent to automatic sending stops future sending; it does not recall messages already sent to brokers.
8. Complaints
You can lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés): https://www.cnil.fr/fr/plaintes. You are welcome to contact us first, but you do not have to.
9. Security
Your identifiers are encrypted (AES-256-GCM, a key specific to each account, master key on the server). Your password is hashed (Argon2id). Two-factor authentication is available. Sessions and logs keep only hashed fingerprints. No processing is risk-free; in case of a data breach presenting a risk to you, we notify the CNIL within 72 hours and inform you if the risk is high.
10. Cookies
We only use strictly necessary or preference cookies, which are not used to track you and do not require consent: a session cookie (stay signed in), a CSRF token (form security), an information-message cookie (confirmations shown after an action) and a language cookie (remember the language you choose). No trackers, no advertising, no audience-measurement tools.
11. Minors
The service is reserved for people aged 18 or over. If you believe a minor has signed up, write to us and we will delete the account.
12. Updates
We may amend this policy, in particular during the beta. The date and version appear at the top; in case of a significant change, we inform you by e-mail or in the service before it takes effect.