2.1 Data controller
The data controller is GMD Ventures, a company in the process of registration, publisher of Fjord (“Fjord”, “we”). For any question about your data: contact@fjord.so.
Fjord is intended exclusively for professionals.
2.2 Data we collect
On the fjord.so website:
- the website address you enter;
- your work email, so that we can get back to you;
- first name, last name, company, the function of the buyers you sell to, the offer you are interested in, and booking information;
- technical data (IP address, connection logs) needed for the operation and security of the Site.
In the app.fjord.so application:
- the login email and, where applicable, the names of account users;
- your campaign settings (your brand, your competitors, your buying intents) — this information concerns companies and is not, in principle, personal data;
- connection and usage logs.
Billing:
- your billing details. Payment data is processed directly by our payment provider; we have no access to it.
We do not collect any sensitive data.
2.3 Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention period |
|---|---|---|
| Processing your request, preparing the analysis of your market and arranging a meeting | Pre-contractual measures taken at your request (Art. 6(1)(b) GDPR) | 3 years after the last contact |
| Sending you information about our offers related to your professional activity | Legitimate interest (Art. 6(1)(f) GDPR); you may object at any time | 3 years after the last contact |
| Providing the service, managing your account, providing support | Performance of the contract (Art. 6(1)(b) GDPR) | Term of the contract, then 5 years (limitation period) |
| Billing and accounting | Legal obligation (Art. 6(1)(c) GDPR) | 10 years |
| Site security and protection against automated submissions | Legitimate interest (Art. 6(1)(f) GDPR) | 12 months |
| Measuring audience on the fjord.so website | Consent (Art. 6(1)(a) GDPR), collected through the cookie banner | 13 months maximum |
| Improving our measurement using aggregated statistics | Legitimate interest (Art. 6(1)(f) GDPR) | Anonymized data, with no possible identification |
2.4 Recipients and subprocessors
Your data is processed by the Fjord team and by the following providers, who act on our instructions. We do not sell any data.
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, authentication | European Union (Ireland) |
| Vercel | Hosting of the website and application | United States |
| Resend | Sending emails (login links, summaries, notification of requests received) | United States |
| Google (Gmail) | Receiving requests | United States |
| Slack | Internal notification of requests received | United States |
| Booking tool | Scheduling meetings | United States |
| Payment provider | Subscription payments | European Union or United States |
| OpenAI, Anthropic | Website analysis and measurements: they receive the website address, brand names and buying intents, never account data (email, name) | United States |
| GitHub | Running automated checks and sending summaries | United States |
| PostHog | Audience measurement on fjord.so, only if you accept it | European Union |
| Namecheap | Domain names and forwarding of contact emails | United States |
When data is transferred outside the European Union, the transfer relies on the adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, or otherwise on the European Commission’s standard contractual clauses.
2.5 Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, in particular to direct marketing, as well as the right to set instructions regarding what happens to your data after your death. To exercise them: contact@fjord.so. We respond within one month.
You may lodge a complaint with the CNIL (www.cnil.fr).
2.6 Security
We implement appropriate technical and organizational measures: encrypted communications, passwordless login via single-use links, and access to data restricted to those who need it.
2.7 Cookies
The Site uses two types of trackers:
- trackers strictly necessary for its operation: login session, remembering your cookie choice and the language you choose, keeping what you type in the form for the duration of your visit, last campaign viewed. They are exempt from consent (Article 82 of the French Data Protection Act);
- audience measurement cookies set by PostHog, hosted in the European Union, only on fjord.so and only if you accept them. Until you accept, PostHog is not loaded and no data is sent to it. They help us understand how the site is used, including by recording how visits unfold (pages, clicks, scrolling), with every form field masked.
No advertising cookies are set.
On your first visit, a banner lets you accept or decline audience measurement. Declining has no effect on your access to the Site. Your choice is kept for 6 months, after which you are asked again. You can change it at any time using the “Manage cookies” link at the bottom of every page; if you withdraw your consent, PostHog’s cookies are deleted.
| Name | Site | Role | Duration | Set by | Consent |
|---|---|---|---|---|---|
| sb-tnsezdwjmslbaoeknndx-auth-token (local storage) | app.fjord.so | Login session | Until logout | Supabase | Not required |
| deo.campaign (local storage) | app.fjord.so | Last campaign viewed | Until logout | Fjord | Not required |
| fjord-consentement (local storage) | fjord.so | Remembering your cookie choice | 6 months | Fjord | Not required |
| fjord-lang (local storage) | fjord.so | Remembering the language you choose in the selector | 6 months | Fjord | Not required |
| fjord-brouillon (session storage) | fjord.so | Keeping what you type in the form during your visit | Until the tab is closed | Fjord | Not required |
| ph_…_posthog (cookie) | fjord.so | Audience measurement: anonymous visitor identifier | 12 months | PostHog | Required |
| ph_…_posthog, ph_…_window_id, ph_…_primary_window_exists, ph_…_session_registered_properties (session storage) | fjord.so | Audience measurement: tracking the current visit | Until the tab is closed | PostHog | Required |
2.8 Changes
We may update this policy. The update date appears at the top of the page; in the event of a significant change, we will notify you by email.