// SYSTEM_LEGAL_COMPLIANCE|GDPR (EU 2016/679) & LCEN|Last updated: September 23, 2026

> LEGAL NOTICE & GDPR

<SYSTEM.RETURN

// 01. SITE PUBLISHER IDENTIFICATION

>Site Publisher: Armand WALLE — Independent Fullstack Developer & Software Engineering Student (Université de Technologie de Belfort-Montbéliard - UTBM).
>Location: Belfort-Montbéliard, France (personal contact details preserved pursuant to Art. 6-III-2 of French Law LCEN No. 2004-575).
>Publication Director: Armand WALLE (responsible for editorial content).
>Direct contact: Encrypted channel at root (/#contact) or via direct email: [email protected].

// 02. HOSTING & NETWORK INFRASTRUCTURE

>Hosting Architecture: Direct self-hosting on autonomous, private dedicated bare-metal infrastructure operated by the publisher.
>Physical Hardware Nodes: Dedicated secure multi-architecture servers (ARM64 and x86_64) hosted in France by Armand WALLE.
>Edge Delivery & Security Network: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Phone: +1 (650) 319-8930) — Reverse proxy, TLS 1.3 termination, secure DNS, and WAF / DDoS mitigation.

// 03. INTELLECTUAL PROPERTY & ARTIST CREDITS

>Architecture & Source Code: Software architecture, Futuristic User Interface (FUI) visual design, cybernetic animations, and Nuxt 4 source code are the exclusive intellectual property of Armand WALLE.
>Open Source Licenses: Third-party components, frameworks, and libraries operated under the permissive MIT Open Source License (Vue.js, Nuxt, Tailwind CSS, Pinia, Vitest).
>Royalty-Free Music Selection: Tracks streamed via the FUI audio player are royalty-free music carefully curated from independent artists (synthwave, darksynth, cyberpunk).
>Artist-Compliant Attribution: Each track is streamed and credited in strict compliance with copyright regulations, attribution licenses, and the express requirements formulated by the original creators themselves (including Karl Casey @ White Bat Audio, Aim To Head, etc.).
>Live Attribution Inspection: Detailed attribution notices, complete credits, and official streaming links are directly accessible in real time within the audio player information modal (AudioCoverModal).
>Takedown Right & Artist Inquiries: Any artist, composer, or rights holder may request an update to their attribution or the immediate removal of a track at any time via [email protected].

// 04. LIABILITY & OUTBOUND HYPERLINKS

>Editorial Liability: The publisher disclaims any liability regarding external third-party content, accuracy, or availability reachable via hyperlinks (GitHub repositories, CVE vulnerability feeds, multimedia platforms).

// 01. DATA PROCESSING FRAMEWORK & CONTROLLER

>Data Controller: Armand WALLE ([email protected]).
>Applicable Legal Framework: General Data Protection Regulation (GDPR - Regulation EU 2016/679) and French Data Protection Act.
>Last revision date: September 23, 2026.

// 02. COLLECTED DATA, PURPOSES & LEGAL BASES

// Contact Form:

>Collected Data: Full name, email address, message body, timestamp, and anti-spam timing telemetry (submitDelay).
>Purpose: Processing professional inquiries, contact requests, and collaboration proposals.
>Legal Bases: Explicit user consent (Art. 6.1.a GDPR) and Legitimate Interest (Art. 6.1.f GDPR).
>Zero Host Storage: No record is stored in any local database (SQL/NoSQL) on the web server.

// Server Technical Logs:

>Collected Data: Connection IP address, browser User-Agent fingerprint, timestamp, requested URL, and HTTP status code.
>Purpose: Maintaining infrastructure security, intrusion detection, DDoS mitigation, and incident forensics.
>Legal Basis: Legitimate interest of the controller in ensuring system integrity and availability (Art. 6.1.f GDPR).
>Retention Period: 12 months maximum pursuant to French Decree No. 2011-219, with automated rotating purge.

// 03. TRANSMISSION VIA TELEGRAM RELAY & NO DATABASE STORAGE

>Local Anti-Bot Filtering & Validation: Inquiries undergo strict initial filtering (honeypot decoy field, minimum submission delay, domain DNS MX/A validation) and client-side resolution of the Breach Protocol cryptographic puzzle executed 100% locally in the browser.
>In-Transit Encryption: Upon successful validation, the message is instantly encrypted in transit (HTTPS / TLS 1.3) and relayed via the official Telegram Messenger Inc. Bot API to the publisher's private administration channel.
>Processor Role: Telegram Messenger Inc. acts strictly as a technical in-transit instant messaging processor, with no commercial indexing or profiling access to your data.
>Access & Deletion: Messages are accessed exclusively by Armand WALLE on a secure private device and are retained only for the duration strictly necessary to formulate a response, then permanently deleted.

// 04. IP ADDRESS, GEOLOCATION & RATE LIMITING

>FUI Coordinates Display (System Menu): To render approximate geographic coordinates (Latitude / Longitude) within the HUD system menu, the server first extracts edge network headers provided by Cloudflare Edge (cf-iplatitude, cf-iplongitude). If these headers are unavailable and for public IP addresses, the server queries the public FreeIPAPI HTTPS service (freeipapi.com) to retrieve approximate city- or region-level coordinates. No IP address or coordinate is persistently stored in any database by the application for this display function.
>Rate Limiting (Anti-Abuse Protection): Client IP addresses are temporarily tracked in volatile memory (RAM) by the Overseer module (/api/overseer) to restrict automated spam calls (4 requests/minute/IP), protecting infrastructure and conserving compute quotas. These memory keys are automatically purged after 60 seconds.
>Server Logs & Forensic Security: Inbound connection IP addresses are recorded in low-level technical access logs (Nginx and Cloudflare) for a maximum statutory duration of 12 months pursuant to French Decree No. 2011-219 and CNIL guidelines, strictly for intrusion detection and DDoS mitigation (GDPR Art. 6.1.f).

// 05. DATA RECIPIENTS & SUBPROCESSORS

Strict Non-Commercialization Guarantee: No personal data is ever sold, leased, transferred, or exchanged with third parties for commercial or marketing purposes.

>Telegram Messenger Inc.: Messaging subprocessor providing encrypted in-transit (TLS 1.3) relay of contact form notifications.
>Cloudflare Inc.: Network subprocessor providing edge WAF security, DDoS mitigation, TLS 1.3 termination, and CDN caching.
>FreeIPAPI: Secure public service queried for one-time IP-to-coordinates conversion without persistent data retention.

// 06. FULL CATALOG OF DATA SUBJECT RIGHTS (ART. 15 TO 22 GDPR)

Pursuant to Articles 15 to 22 of the GDPR, you hold the following rights regarding your personal data:

>Right of Access (Art. 15 GDPR): Obtain confirmation as to whether your personal data is being processed, and request a comprehensive copy.
>Right to Rectification (Art. 16 GDPR): Request correction or updating of inaccurate or outdated information.
>Right to Erasure ('Right to be Forgotten', Art. 17 GDPR): Request the permanent deletion of your personal data.
>Right to Restriction of Processing (Art. 18 GDPR): Request the temporary freezing of data processing under statutory conditions.
>Right to Data Portability (Art. 20 GDPR): Receive your data in a structured, commonly used, and machine-readable format.
>Right to Object (Art. 21 GDPR): Object at any time, on legitimate grounds, to the processing of your data.

Exercise Procedure: Submit requests via email with subject [EXERCICE DROITS RGPD] to [email protected] or through the contact form. Statutory response deadline: 30 calendar days maximum (Art. 12.3 GDPR).

// 07. LODGING A COMPLAINT WITH SUPERVISORY AUTHORITY (CNIL)

If you consider that the processing of your personal data infringes applicable regulations, you have the right to lodge a complaint with the French supervisory authority:

>Commission Nationale de l'Informatique et des Libertés (CNIL)
>Postal Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
>Phone: +33 (0)1 53 73 22 22
>Official Website: https://www.cnil.fr/en — Online Complaint Portal: https://www.cnil.fr/fr/plaintes

// 08. TECHNICAL & ORGANIZATIONAL SAFEGUARDS

>Systematic Encryption: TLS 1.3 protocol with HSTS (HTTP Strict Transport Security) ensuring communication confidentiality.
>Content Security Policy (CSP): Hardened directives preventing execution of unauthorized external scripts or resources.
>Data Sanitization: Strict HTML escaping and input filtering defending against Cross-Site Scripting (XSS) attacks.
>Honeypot Anti-Bot Trap: Invisible decoy form field trapping automated spambots while remaining transparent to assistive technologies.
>Breach Protocol Cryptographic Challenge: 100% client-side browser-executed cryptographic challenge eliminating invasive third-party trackers (zero Google reCAPTCHA tracking cookies).

// 01. ZERO COMMERCIAL TRACKING DECLARATION

>Absence of Advertising Trackers: This website deploys zero advertising cookies, zero behavioral targeting or profiling cookies, and zero third-party social media tracking beacons.
>Absence of Intrusive Analytics: No third-party audience measurement tools requiring prior consent (such as Google Analytics or Meta Pixel) are embedded.
>Consent Banner Exemption: Pursuant to Art. 82 of the French Data Protection Act and CNIL guidelines, no intrusive cookie banner is required as only items strictly necessary for service operation and security are stored.

// 02. COMPREHENSIVE LOCAL STORAGE INVENTORY

Key / Identifier	Storage Medium	Role & Purpose	Retention
i18n_redirected	First-Party HTTP / Client Cookie	Persists the chosen language preference (en, fr, zh-CN) to ensure browsing continuity.	1 year
fui_audio_session	HTTP HttpOnly Cookie (1st party)	Secure temporary technical session cookie generating timestamped HMAC tokens for continuous audio streaming and preventing unauthorized hotlinking.	24 hours
fui_audio_volume	Web Storage (localStorage)	Persists the FUI audio player volume gain slider setting between page views.	Persistent machine local (until browser clearance)
reflex_dino_best	Web Storage (localStorage)	Locally persists the user's best reaction latency score from the FUI reflex mini-game (0 network transmission).	Persistent machine local (until browser clearance)
kobayashi_best	Web Storage (localStorage)	Locally persists the user's survival score from the Kobayashi Maru mini-game (0 network transmission).	Persistent machine local (until browser clearance)

// 03. USER CONTROL & PURGE INSTRUCTIONS

You may inspect, disable, or delete these technical keys at any time directly through your web browser settings:

>Mozilla Firefox: Settings > Privacy & Security > Cookies and Site Data > Clear Data.
>Google Chrome: Settings > Privacy and Security > Clear browsing data.
>Apple Safari: Settings > Privacy > Manage Website Data.
>Microsoft Edge: Settings > Privacy, search, and services > Clear browsing data.