Privacy

What this site collects, why, and what you can ask me to do about it.

Who is responsible

MIKATUX SAS, 46 avenue Daumesnil, 75012 Paris, France, is responsible for the personal data this site collects: the controller, in GDPR terms.

Registered address: 46 avenue Daumesnil, 75012 Paris, France
Contact: contact@mikatux.com

What I collect and why

Data	Purpose	Legal basis	Retention
Your IP address and the details your browser sends with each request, when you load a page	PurposeTo deliver the site. Google’s Firebase Hosting also uses IP addresses to detect abuse.	Legal basisMy legitimate interest in running the site securely (GDPR Art. 6(1)(f))	RetentionGoogle keeps IP data for a few months.
Your email address, when you signed up, the page you signed up on, and the version of this notice, if you ask for my code review note	PurposeTo send you the code review note once, when it is published	Legal basisYour consent (Art. 6(1)(a)), which you can withdraw at any time	RetentionUntil you ask to be removed; deleted after 3 years without contact.
A count of sign-up attempts from your connection, filed under a salted hash of your IP address. My code never stores the address itself.	PurposeTo keep the sign-up form from being flooded: 5 tries per 10 minutes per connection	Legal basisMy legitimate interest in preventing abuse (Art. 6(1)(f))	RetentionIt expires after 10 minutes, and the database then deletes it, typically within 24 hours.
Your name, email, and the answers you give in the booking form (for example company, role, stage, timeline, budget range, what you’re working on, how you heard about me, and the campaign you came from). Cal.com also records your time zone and language.	PurposeTo arrange the call and prepare for it. The booking is stored on my Cal.com server in Germany. Cal.com sends you a confirmation and a calendar invitation by email from contact@mikatux.com, through my email provider (Gandi). The booking is also added to my Google Calendar (your name, email and answers), and the call takes place on Google Meet.	Legal basisSteps you ask for before a possible contract (Art. 6(1)(b))	Retention3 years from our last contact.
Your IP address and the requested address (which can include the campaign tags and your time zone from the link), in the access log of the booking server, when the calendar loads or you book	PurposeTo keep the booking server secure and running	Legal basisMy legitimate interest in security and operations (Art. 6(1)(f))	RetentionAbout 1 day. Hetzner hosts the server. The application log can contain your name if a confirmation email fails to send; it is rotated automatically (3 files of 10 MB).
Your email address and what you write, if you email me	PurposeTo reply to you	Legal basisMy legitimate interest in answering you (Art. 6(1)(f))	Retention3 years from our last contact.

Once a day I get an email with the number of new sign-ups. It never contains the addresses.

If I contacted you first

Sometimes I write to people I haven’t worked with, about something that concerns their job: a framework their company’s website still runs past its end of life, for example. If I wrote to you that way, this is what I hold about you, and how to make it stop.

What I hold: Your name, work email, company and role, and publicly available technical information about your company’s website or stack, such as the framework version it runs.
Where it comes from: Public company websites, professional profiles, public job posts, and public technology-detection information. Ask me, and I’ll tell you exactly where I found yours.
Why: To offer you services relevant to your professional role.
Legal basis: My legitimate interest in offering my services to businesses (GDPR Art. 6(1)(f)). Weighed against yours: I write only about your work, using public information, and one reply stops it.
How long: 3 years from our last contact, then I delete it. That is the last time you contacted me, or when I found your details if you never did; an email from me does not restart the clock. If you object, I delete everything except your email address, which I keep on a suppression list so that I never contact you again.
Controller: MIKATUX SAS46 avenue Daumesnil, 75012 Paris, France

You can object at any time: reply “stop” to my message, or email contact@mikatux.com. You can also ask me where your details came from, and use any of the rights listed under Your rights, including complaining to the CNIL.

Prospection commerciale (FR)

Si je vous ai écrit sans que nous ayons travaillé ensemble, je traite vos nom, adresse e-mail professionnelle, entreprise et fonction, ainsi que des informations techniques publiques sur le site ou la stack de votre entreprise. Ces données proviennent de sites d’entreprise publics, de profils professionnels, d’offres d’emploi publiques et d’informations publiques de détection de technologies. Je les utilise pour vous proposer des services en rapport avec votre fonction, sur la base de mon intérêt légitime (RGPD, art. 6.1.f). Je les conserve 3 ans à compter de votre dernier contact avec moi, ou de leur collecte si vous ne m’avez jamais écrit, puis je les supprime ; si vous vous y opposez, je ne garde que votre adresse e-mail, dans une liste d’opposition, pour ne plus jamais vous contacter. Vous pouvez vous opposer à tout moment en répondant « stop » ou en écrivant à contact@mikatux.com, et me demander l’origine de vos données. Vous pouvez aussi saisir la CNIL (cnil.fr). Responsable du traitement : MIKATUX SAS, 46 avenue Daumesnil, 75012 Paris, France.

Processors

These companies handle data for me, under my instructions.

Website and sign-ups: Google Cloud France SARL8 rue de Londres, 75009 Paris, FranceFirebase Hosting serves the site. Cloud Firestore stores the sign-up list and the counters in the EU, and Cloud Functions runs the sign-up code in Belgium.
Lead list: Google Cloud France SARL8 rue de Londres, 75009 Paris, FranceGoogle Sheets holds my private lead list (prospects and contacts).
Booking calendar: Hetzner Online GmbHIndustriestr. 25, 91710 Gunzenhausen, GermanyRuns the server in Germany where my own installation of Cal.com, cal.mikatux.com, stores bookings and keeps its access log.
Calendar and video call: Google Cloud France SARL8 rue de Londres, 75009 Paris, FranceGoogle Workspace (Google Calendar and Google Meet) schedules the call and hosts the video call.
Email: Gandi SAS63-65 boulevard Masséna, 75013 Paris, FranceHosts my email, contact@mikatux.com, and sends the booking confirmation emails.

International transfers

Google may process data outside the European Economic Area, wherever it or its subprocessors have facilities. Its data processing terms for Firebase, Google Cloud and Google Workspace cover those transfers with the European Commission’s Standard Contractual Clauses, and with the EU-U.S. Data Privacy Framework for its certified US companies.

MIKATUX is a French company, based in Paris. Data is hosted in the EU where configurable (Firestore location eur3). Google may process some data outside the EEA under the EU–US Data Privacy Framework and the Standard Contractual Clauses in its data processing terms. Hetzner (Germany) and Gandi (France) process within the EU.

Cookies and local storage

This site sets no cookies and runs no analytics or advertising scripts. Only the booking page loads anything from elsewhere: the calendar, from cal.mikatux.com.

Your browser keeps two things for this site, on your device:

Your light or dark choice, in local storage, once you use the switch. Nothing is stored before that.
Your scroll positions, in session storage, so Back and reload return you to the same place. After an update to the site, it may also note when it last reloaded a page. Both are gone when you close the tab.

Campaign tags from the link you followed (such as utm_source or ref) are passed to the booking form, so that if you book a call, the booking records which post or email brought you. Nothing is stored on your device for this: the tags are held in the page’s memory and are gone when you reload or close the tab.

The calendar on /book is a frame from cal.mikatux.com. When it loads, Cal.com stores these in your browser, for cal.mikatux.com only:

Two cookies, both deleted when you close your browser: __Secure-next-auth.csrf-token, which protects Cal.com’s forms against forged requests, and __Secure-next-auth.callback-url, the page to return to after signing in to Cal.com.
In local storage, the calendar’s theme, your 12- or 24-hour clock setting, and a sign-in status note.
A service worker, which Cal.com uses for notifications to its own account holders.

None of these is used for analytics or advertising.

Your rights

Under the GDPR, you can ask me to:

show you the data I hold about you (access)
correct it (rectification)
delete it (erasure)
limit what I do with it (restriction)
stop using it where I rely on my legitimate interest (objection)
give you what you provided, in a reusable format, where I use it on the basis of your consent or a contract (portability)

Where I rely on your consent, you can withdraw it at any time. That does not affect what I did with it before.

To do any of this, email contact@mikatux.com. You can also complain to the CNIL, the French data protection authority, at cnil.fr, or to the authority where you live.

Changes

When this page changes, I update the date below. Each sign-up for the code review note records the version of this notice it was made under. This is version 2026-11-05.

Last updated 6 November 2026