[01]Legal notice
01. Site publisher identification
- Site Publisher: Armand WALLE • Independent Fullstack Developer & Software Engineering Student (Université de Technologie de Belfort-Montbéliard - UTBM).
- Location: Belfort, France (business address shown alongside).
- Publication Director: Armand WALLE (responsible for editorial content).
- Direct contact: Encrypted channel at root (/#contact) or via direct email: [email protected].
02. Hosting & network infrastructure
- Hosting Architecture: Direct self-hosting on autonomous, private dedicated bare-metal infrastructure operated by the publisher.
- Physical Hardware Nodes: Dedicated secure multi-architecture servers (ARM64 and x86_64) hosted in France by Armand WALLE.
- Edge Delivery & Security Network: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Phone: +1 (650) 319-8930) • Reverse proxy, TLS 1.3 termination, secure DNS, and WAF / DDoS mitigation.
03. Intellectual property & artist credits
- Architecture & Source Code: Software architecture, Futuristic User Interface (FUI) visual design, cybernetic animations, and Nuxt 4 source code are the exclusive intellectual property of Armand WALLE.
- Open Source Licenses: Third-party components, frameworks, and libraries operated under the permissive MIT Open Source License (Vue.js, Nuxt, Tailwind CSS, Pinia, Vitest).
- Royalty-Free Music Selection: Tracks streamed via the FUI audio player are royalty-free music carefully curated from independent artists (synthwave, darksynth, cyberpunk).
- Artist-Compliant Attribution: Each track is streamed and credited in strict compliance with copyright regulations, attribution licenses, and the express requirements formulated by the original creators themselves (including Karl Casey @ White Bat Audio, Aim To Head, etc.).
- Live Attribution Inspection: Detailed attribution notices, complete credits, and official streaming links are directly accessible in real time within the audio player information modal (AudioCoverModal).
- Takedown Right & Artist Inquiries: Any artist, composer, or rights holder may request an update to their attribution or the immediate removal of a track at any time via [email protected].
04. Liability & outbound hyperlinks
- Editorial Liability: The publisher disclaims any liability regarding external third-party content, accuracy, or availability reachable via hyperlinks (GitHub repositories, CVE vulnerability feeds, multimedia platforms).
[02]Privacy (GDPR)
01. Data processing framework & controller
- Data Controller: Armand WALLE ([email protected]).
- Applicable Legal Framework: General Data Protection Regulation (GDPR - Regulation EU 2016/679) and French Data Protection Act.
- Last revision date: October 19, 2026.
02. Collected data, purposes & legal bases
Contact Form:
- Collected Data: Full name, email address, message body, timestamp, and anti-spam timing telemetry (submitDelay).
- Purpose: Processing professional inquiries, contact requests, and collaboration proposals.
- Legal Bases: Explicit user consent (Art. 6.1.a GDPR) and Legitimate Interest (Art. 6.1.f GDPR).
- Zero Host Storage: No record is stored in any local database (SQL/NoSQL) on the web server.
Server Technical Logs:
- Collected Data: connection IP address, browser User-Agent string, timestamp, HTTP method, requested path (without query parameters), HTTP status code, response time and response size. For security events (rejected request, form submission filtered as automated, rate limit reached, invalid signature), only the event type and a technical reason are added. Message contents, email addresses and tokens are never logged.
- Purpose: infrastructure security, detection of intrusions and abuse, prevention of denial-of-service (DDoS) attacks, and incident analysis.
- Legal Basis: legitimate interest of the controller in ensuring the security and availability of its systems (Art. 6.1.f GDPR).
- Retention Period: 12 months maximum, in line with the CNIL recommendations on logging. Logs are kept on the hosting server, chained with cryptographic hashes and timestamped every hour by a third-party timestamping authority, which only receives a hash and no personal data, so that any later modification is detectable. They are accessible only to the site administrator and automatically deleted after 12 months.
03. Transmission via Telegram relay & no database storage
- Local Anti-Bot Filtering & Validation: Inquiries undergo strict initial filtering (honeypot decoy field, minimum submission delay, domain DNS MX/A validation) and client-side resolution of the Breach Protocol cryptographic puzzle executed 100% locally in the browser.
- In-Transit Encryption: Upon successful validation, the message is instantly encrypted in transit (HTTPS / TLS 1.3) and relayed via the official Telegram Messenger Inc. Bot API to the publisher's private administration channel.
- Processor Role: Telegram Messenger Inc. acts strictly as a technical in-transit instant messaging processor, with no commercial indexing or profiling access to your data.
- Access & Deletion: Messages are accessed exclusively by Armand WALLE on a secure private device and are retained only for the duration strictly necessary to formulate a response, then permanently deleted.
04. IP address, geolocation & rate limiting
- FUI Coordinates Display (System Menu): To render approximate geographic coordinates (Latitude / Longitude) within the HUD system menu, the server first extracts edge network headers provided by Cloudflare Edge (cf-iplatitude, cf-iplongitude). If these headers are unavailable and for public IP addresses, the server queries the public FreeIPAPI HTTPS service (freeipapi.com) to retrieve approximate city- or region-level coordinates. No IP address or coordinate is persistently stored in any database by the application for this display function.
- Rate Limiting (Anti-Abuse Protection): Client IP addresses are temporarily tracked in volatile memory (RAM) by the Overseer module (/api/overseer) to restrict automated spam calls (4 requests/minute/IP), protecting infrastructure and conserving compute quotas. These memory keys are automatically purged after 60 seconds.
- Server Logs & Security: connection IP addresses are recorded in the technical logs of the web server (Nginx) and of the application for at most 12 months, for intrusion detection and denial-of-service prevention (GDPR Art. 6.1.f). Cloudflare, which delivers and protects the site, also processes these addresses under its own privacy policy.
05. Data recipients & subprocessors
Strict Non-Commercialization Guarantee: No personal data is ever sold, leased, transferred, or exchanged with third parties for commercial or marketing purposes.
- Telegram Messenger Inc.: Messaging subprocessor providing encrypted in-transit (TLS 1.3) relay of contact form notifications.
- Cloudflare Inc.: Network subprocessor providing edge WAF security, DDoS mitigation, TLS 1.3 termination, and CDN caching.
- FreeIPAPI: Secure public service queried for one-time IP-to-coordinates conversion without persistent data retention.
06. Full catalog of data subject rights (art. 15 to 22 GDPR)
Pursuant to Articles 15 to 22 of the GDPR, you hold the following rights regarding your personal data:
- Right of Access (Art. 15 GDPR): Obtain confirmation as to whether your personal data is being processed, and request a comprehensive copy.
- Right to Rectification (Art. 16 GDPR): Request correction or updating of inaccurate or outdated information.
- Right to Erasure ('Right to be Forgotten', Art. 17 GDPR): Request the permanent deletion of your personal data.
- Right to Restriction of Processing (Art. 18 GDPR): Request the temporary freezing of data processing under statutory conditions.
- Right to Data Portability (Art. 20 GDPR): Receive your data in a structured, commonly used, and machine-readable format.
- Right to Object (Art. 21 GDPR): Object at any time, on legitimate grounds, to the processing of your data.
Exercise Procedure: Submit requests via email with subject [EXERCICE DROITS RGPD] to [email protected] or through the contact form. Statutory response deadline: 30 calendar days maximum (Art. 12.3 GDPR).
07. Lodging a complaint with the supervisory authority (CNIL)
If you consider that the processing of your personal data infringes applicable regulations, you have the right to lodge a complaint with the French supervisory authority:
- Commission Nationale de l'Informatique et des Libertés (CNIL)
- Postal Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
- Phone: +33 (0)1 53 73 22 22
- Official Website: https://www.cnil.fr/en • Online Complaint Portal: https://www.cnil.fr/fr/plaintes
08. Technical & organizational safeguards
- Systematic Encryption: TLS 1.3 protocol with HSTS (HTTP Strict Transport Security) ensuring communication confidentiality.
- Content Security Policy (CSP): Hardened directives preventing execution of unauthorized external scripts or resources.
- Data Sanitization: Strict HTML escaping and input filtering defending against Cross-Site Scripting (XSS) attacks.
- Honeypot Anti-Bot Trap: Invisible decoy form field trapping automated spambots while remaining transparent to assistive technologies.
- Breach Protocol Cryptographic Challenge: 100% client-side browser-executed cryptographic challenge eliminating invasive third-party trackers (zero Google reCAPTCHA tracking cookies).