Privacy Policy
Last updated: September 10, 2026
This Privacy Policy explains what personal data Bannerly collects, why, how it is used, and the rights you have under the EU/UK General Data Protection Regulation (GDPR) and French data protection law. It is separate from the Terms of Service, which govern your use of the service.
1. Who controls your data?
The data controller for the personal data described in this policy is:
Anthony Palasse EI, operator of Bannerly
SIREN: 752 116 442
France
Full business contact details are listed in the Legal Notice. For any privacy-related question or request, contact privacy@bannerly.me.
2. Scope
This policy applies to bannerly.me, the Bannerly application, account creation, subscriptions, banners and other content you generate, and any optional third-party integrations you choose to connect (such as Stripe, Meta/Instagram, or LinkedIn).
3. Personal data we collect
Account data
When you register, we collect your email address and password (stored as a salted hash, never in plain text). We do not require your real name to create an account.
User content
Banner designs you build — text, colors, uploaded images or logos, icon/template selections, and layout choices — are stored and processed to render and export your banner, and to show your banner history in your account. If you upload an image (e.g. a logo or photo) it may itself contain personal data; you are responsible for having the right to use it.
Billing data
Paid ("Pro") plans are processed by Stripe. Bannerly does not collect or store your full card number, CVC, or other card details — these are entered directly into Stripe's checkout and handled under Stripe's own privacy policy. Bannerly receives billing/subscription metadata from Stripe needed to manage your account, such as your plan, subscription status, renewal date, and invoice history.
Connected-account data
If you choose to connect an external account (Stripe, Meta/Instagram, or LinkedIn) to power live data on your banners, we store the connection itself (which provider, the connected account identifier, requested scopes, and sync timestamps) and the data fields that integration makes available for the banner fields you bind to it (see Section 4 for LinkedIn specifically).
Technical & usage data
We process standard technical data such as IP address, browser/device information, and request logs, for security and to keep the service running (for example, detecting abuse or debugging errors). Where you have consented via the cookie banner, we also use Google Analytics to understand aggregate usage (see Section 12).
Communications
If you contact us (e.g. via the in-app feedback widget or by email), we collect the content of your message and your email address to respond to you.
4. LinkedIn and connected services
Bannerly offers an optional integration that lets you connect your LinkedIn account to show live data on your banners. If you choose to connect your LinkedIn account, Bannerly may receive information authorized by you through LinkedIn's OAuth authorization process. Today, that is limited to your LinkedIn account identifier and basic profile information (name and photo); it does not currently include follower or connection counts, which require LinkedIn access Bannerly has not yet been granted. If and when additional LinkedIn permissions become available and are enabled, this policy will be updated before they are used.
- Bannerly only requests LinkedIn information required for features you explicitly enable.
- Connecting LinkedIn is entirely optional and is initiated by you, the LinkedIn member.
- Bannerly does not sell LinkedIn member data.
- You may disconnect your LinkedIn account at any time from Settings → Integrations.
5. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing your account and the core service | Performance of a contract |
| Creating, storing and rendering banners | Performance of a contract |
| Managing subscriptions and payments | Performance of a contract; legal obligations (accounting) |
| Fraud prevention and security | Legitimate interests; legal obligations where applicable |
| Customer support | Performance of a contract; legitimate interests |
| Optional analytics cookies | Consent |
| Connected-account features (Stripe/Meta/LinkedIn) | Performance of the service you requested |
Note: authorizing an OAuth connection (e.g. clicking "Connect" for LinkedIn) is a separate act from GDPR consent to processing. Where processing genuinely relies on consent (such as analytics cookies), that consent is captured separately via the cookie banner.
6. Data processors and third-party services
We do not sell your personal data. We share limited data with:
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Stripe | Payment processing, subscription management | Billing email, payment/subscription metadata, card details (Stripe only) | EU/US (Stripe infrastructure) |
| Google Analytics | Aggregate usage analytics — only after you accept analytics cookies | IP address (truncated/anonymized by Google), device/browser info, page views | US |
| Optional integration you connect (Section 4) | LinkedIn account identifier, name, photo | US/EU (LinkedIn infrastructure) | |
| Meta (Instagram/Facebook) | Optional integration you connect (follower/engagement data) | Meta account identifier, public page/profile metrics | US/EU (Meta infrastructure) |
| Hosting infrastructure | Running the application and storing account/template data | All personal data described above | [hosting location — see Legal Notice — to be provided] |
We only list processors we actually use; we do not use a separate email-delivery provider, a third-party error-monitoring service, or additional analytics tools beyond Google Analytics at this time. If that changes, this table will be updated.
7. International transfers
Some processors (Stripe, Google, LinkedIn, Meta) may process data outside the European Economic Area (EEA), including in the United States. Where this occurs, we rely on the safeguards each provider makes contractually available to its customers under GDPR, such as Standard Contractual Clauses; we do not independently certify or audit these mechanisms and refer you to each provider's own data processing terms for details.
8. Retention
- Account data and saved banners: for as long as your account is active, or until you request deletion.
- Billing/accounting records: retained for the period required by French statutory accounting and tax rules, regardless of account deletion.
- Data connected to an unresolved support request or dispute: for the time necessary to resolve it.
- Connected-account tokens/data (Stripe/Meta/LinkedIn): until you disconnect the integration or delete your account.
We have not yet defined exact retention durations for every technical log category; where no fixed period is stated above, data is kept only for as long as necessary for the purpose it was collected for.
9. Account deletion
Bannerly does not yet offer one-click self-service account deletion. To request deletion of your account and associated personal data, email privacy@bannerly.me from the address linked to your account (see also the Account page). We will delete or anonymize your personal data, except for records we are legally required to retain (such as billing records, per Section 8).
10. Your rights under the GDPR
You have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data, subject to our legal retention obligations.
- Restrict or object to certain processing, including processing based on legitimate interests.
- Portability — receive your data in a structured, machine-readable format.
- Withdraw consent at any time for processing based on consent (e.g. analytics cookies), without affecting prior lawful processing.
To exercise any of these rights, email privacy@bannerly.me. We may ask you to verify your identity where reasonably necessary before acting on a request. We will respond within one month, as required by the GDPR.
11. Supervisory authority
If you believe your data protection rights have not been respected, you may lodge a complaint with the French supervisory authority:
Commission Nationale de l'Informatique et des Libertés (CNIL) — https://www.cnil.fr/
12. Cookies
- Strictly necessary: a session/refresh cookie that keeps you signed in, and a cookie storing your cookie preference itself. These are set regardless of consent because the service cannot function without them.
- Analytics (optional): Google Analytics cookies, set only after you accept analytics cookies in the cookie banner.
- Bannerly does not use advertising/marketing cookies.
Analytics cookies are not loaded until you accept them. Rejecting them is as easy as accepting them — both are one click on the cookie banner. You can change your choice at any time using the "Manage cookies" link in the footer, which reopens the cookie banner.
13. Security
We apply reasonable technical and organizational measures appropriate to the risk, including encryption of data in transit (HTTPS), hashed password storage, and access controls limiting who can view your data. No method of transmission or storage is 100% secure, and we do not claim any specific security certification.
14. Data sale
Bannerly does not sell personal data.
15. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify you (e.g. by email or an in-app notice).
16. Contact
For any question about this Privacy Policy or your personal data, contact privacy@bannerly.me. Full business contact details are in the Legal Notice.