Privacy Policy
This notice explains what personal information Paronga collects, why we use it, who we disclose it to, how we disclose it, and the security practices we apply. It is written for GDPR Article 13 and the CNIL information-notice models.
1. Who is the controller
The controller is Valentin Marchaud, entrepreneur individuel, registered in France under SIREN 850496480, whose registered office is at 32 rue des Jeûneurs, 75002 Paris (in this notice, "Paronga", "we", "us").
Paronga is a Chrome extension and an API. The extension clips furniture products from shop pages into project moodboards and exports them (CSV, PPTX, PDF, PNG). The API stores the account, the projects, and the subscription that unlocks presentation copy written by a model.
Privacy questions and GDPR requests: hello@studioparonga.com. We have not appointed a data protection officer.
2. What we collect
Information you give us
- Email address, used for magic-link sign-in.
- Projects, rooms, products, comments, and images you save. A project may include a client name if you type one.
- The brief sent when you ask for presentation copy: project and product fields needed to write the deck text.
Payment data
We do not collect full payment card numbers. The subscription is billed by Stripe. We store Stripe customer and subscription identifiers and the subscription status. Stripe processes the card or other payment method on file.
What stays on your computer
The extension reads the shop page in your browser to prefill a product. We receive only the fields and images you save. An optional extraction key you type in the extension options stays in the extension. It is not sent to the API.
Information collected automatically
- A bearer session token after you sign in. We store only a hash of it. It keeps you signed in for 30 days.
- Magic-link tokens, stored hashed, and valid for a few minutes.
We do not run third-party advertising or analytics scripts.
3. How we use it (purposes and legal bases)
Your email is required to create an account. If you do not provide it, we cannot open the account.
- Contract: create and keep your account, send the magic link, store your projects, and provide presentation copy while your subscription is active.
- Legitimate interests: keep the service secure and prevent abuse.
- Legal obligation: keep billing records and respond to lawful requests.
We do not sell personal information. We do not use your information for interest-based advertising. We do not make automated decisions that produce legal or similarly significant effects.
4. Who we disclose it to, and how
We disclose personal information to the processors below so they can run their part of the service. We do not sell lists.
- Stripe: subscription billing. Stripe processes the payment method on file.
- Resend: delivery of the magic-link email.
- Vercel AI Gateway: presentation copy. The prompt is the brief for that deck. We use the gateway so that prompt is not kept for training.
- Our own servers: accounts, sessions, projects, products, and images.
We may also disclose information to professional advisors under confidentiality, to a buyer or successor if we transfer the business, or to authorities when the law requires it.
5. Transfers outside the European Economic Area
We are based in France. Stripe, Resend, and Vercel AI Gateway may process data in the United States or other countries. Where GDPR requires a transfer tool, we rely on that processor's published mechanism (adequacy decision and/or standard contractual clauses). You can ask us for more detail at hello@studioparonga.com.
6. How long we keep it
- Account, projects, products, and images: while the account is open. You can wipe the catalog from the extension. Write to us to delete the account itself.
- Sessions: 30 days, then they expire.
- Magic-link tokens: minutes.
- Billing identifiers: as long as needed to bill, then as long as French accounting rules require us to keep invoices.
7. Security practices
- HTTPS on the public API in production.
- Session tokens stored hashed. The extension keeps the token locally.
- Projects, products, and images are readable only by the signed-in account.
- The extraction key, if you set one, stays in the extension.
No internet service is perfectly safe. We use commercially reasonable technical and organisational measures; we cannot guarantee that unauthorised access will never occur.
8. Cookies
The API does not set a cookie. Sign-in is a bearer token stored by the extension. There is no third-party advertising cookie.
9. Your rights
Under GDPR you may ask us to access, correct, delete, or restrict personal information, to receive a portable copy, and to object to processing based on legitimate interests. Write to hello@studioparonga.com. We may need to verify it is you (for example by asking you to use the signed-in account or to confirm the email we hold).
You may lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), https://www.cnil.fr, or with your local supervisory authority if you live elsewhere in the EEA or UK.
10. Children
The service is for people preparing furniture projects for clients. It is not directed at children under 18. If you believe we have collected a child's data, contact hello@studioparonga.com and we will delete it.
11. Changes
We will update the date at the top of this page when the notice changes. Material changes will also be posted on the service or emailed to the address on the account when that is practical.
12. How to contact us
- Privacy and product: hello@studioparonga.com
- Post: Valentin Marchaud, 32 rue des Jeûneurs, 75002 Paris