Your data, your control

Privacy policy

Last updated: 18 May 2026

This policy explains how Bourselo (published by Infinity Aurora Sàrl) collects, uses and protects your personal data when you interact with our website, and in particular when you fill in the signup form to join the waiting list or apply to the 2026 pilot.

1. Data controller

The data controller is:

2. Data we collect

When you submit the signup form, we only collect information you provide voluntarily:

Category	Data collected
Identity	First name, last name
Contact	Email, phone (optional)
Association	Association name, country, city, postal code
Activity	Sale types, frequency, estimated volume
Application type	Project follow-up or pilot application
Pilot motivation	Free text (pilot applications only)
Source	How you heard about us (optional)
Signup date	Automatic timestamp
Consent records	Exact consent timestamp, version of the accepted text, partially anonymised IP address (last octet zeroed for IPv4, last 80 bits zeroed for IPv6)

We collect no sensitive data within the meaning of GDPR Article 9 (health, political opinion, religion, etc.).

The site uses no advertising cookies and no profiling tools. Consent records are kept solely for compliance purposes (GDPR Art. 7.1) and are not used for any other purpose.

3. Purposes

• Inform you of Bourselo project progress (occasional newsletter, app launch, key dates).
• Review your application to the 2026 pilot programme if requested.
• Reach out to clarify your needs or schedule a conversation.
• Segment our communications (by country, by association type, by sale frequency) to send relevant content.

4. Legal basis

Processing is based on your explicit consent, given by ticking the acceptance box when submitting the form (GDPR Article 6.1.a). You may withdraw this consent at any time.

5. Retention period

Your data is kept for 3 years after our last interaction (email opening, reply, direct exchange). After that, it is automatically deleted or anonymised.

You can request earlier deletion at any time.

6. Recipients

Your data is strictly reserved for Infinity Aurora's use. It is never sold, rented or transferred to third parties for commercial purposes.

We rely on the following processors, chosen for their GDPR compliance:

Processor	Role	Hosting location
Brevo (formerly Sendinblue, Sib SAS)	Contact list hosting and email delivery	European Union (France)
Infomaniak Network SA	Hosting of the Bourselo website	Switzerland

For more details on transfers and security, see our GDPR page.

7. Your rights

Under GDPR Articles 15 to 22, you have the following rights at any time:

• Right of access: obtain a copy of the data we hold.
• Right to rectification: correct inaccurate or incomplete information.
• Right to erasure ("right to be forgotten"): request deletion of your data.
• Right to restriction: temporarily suspend processing.
• Right to portability: receive your data in a structured, machine-readable format.
• Right to object: refuse processing of your data.
• Right to withdraw consent at any time, without justification.

To exercise any of these rights, write to bonjour@bourselo.fr. We commit to respond within a maximum of 30 days.

8. Complaint with the CNIL

If after contacting us you feel your rights are not respected, you may lodge a complaint with the French data protection authority (CNIL) or your local EU supervisory authority:

9. Security

We implement technical and organisational measures to protect your data: HTTPS encrypted connection, limited access to authorised Infinity Aurora staff, hosting with certified European providers, regular backups.

10. Policy updates

This policy may evolve. Any substantial change will be flagged on this page with a new revision date. In case of significant changes, you will be notified by email.