Data controller
[À compléter : nom et prénom ou raison sociale], [À compléter : adresse postale]. Contact: contact@malistedenoel.fr.
Data, purposes and retention periods
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Christmas lists | Chosen name or first name, message, cover image, gifts (title, link, price, photo, note, options) | Performance of the service | Until the list or account is deleted |
| Reservations and group gifts | Technical browser identifier (hashed), first name and optional email of participants | Performance of the service | Until the list is cancelled or deleted |
| Account | Name and email address; irreversibly encrypted password (PBKDF2) for an email account, or profile photo and identifier provided by Google or Facebook; notification preferences | Performance of the service | Until the account is deleted; sessions: 90 days |
| Reminders before Christmas | Confirmed email address of a loved one subscribed to a list | Consent (double confirmation) | Until unsubscribed; unconfirmed requests deleted after 30 days |
| Secret Santa draw | First names, optional emails, exclusions, results, list link | Performance of the service | 12 months after the event date, or deletion by the organiser |
| List co-management | Co-manager accounts, invitations (email optional) | Performance of the service | Invitations: 14 days; access: until withdrawn |
| Blog: comments and ratings | First name, optional email (not published), comment; hashed IP address fingerprint against spam | Legitimate interest (moderation, anti-spam) | Comment: until deleted; IP fingerprint: 12 months |
| Genie (gift ideas) | Description entered, sent to the AI service to generate ideas; not stored by the site | Performance of the service | Not stored |
| Security and anti-abuse | Hashed IP address fingerprints, Turnstile verification, technical error logs | Legitimate interest (security) | Rate limits: 24 hours; errors: 90 days with the provider |
| Statistics | Daily totals without personal data | Legitimate interest | Unlimited (anonymous data) |
Who sees what?
Anyone with the sharing link to a list can view it: only share it with your loved ones. Lists are not indexed by search engines. The manager of a list sees which gifts have been reserved (without knowing by whom), unless they enable surprise mode. The organiser of a group gift sees the first names and emails of participants to help them coordinate. Do not include sensitive information in your lists.
Processors and transfers outside the European Union
- Cloudflare (United States, EU) : Hosting, database, image storage, Turnstile anti-bot protection
- Google, Meta (Facebook) : Account login, if you choose it
- Twilio SendGrid (United States) : Sending emails (notifications, reminders, invitations, draw)
- Anthropic (United States) : Artificial intelligence for the Genie and blog writing assistance
- OpenAI, Tavily (United States) : Illustrations and sources for blog articles (back-office only)
- Amazon : Product search and affiliate links
- Sentry (United States) : Technical error tracking
Transfers to the United States are governed by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.
E-mails
You only receive emails linked to an action: reservation notification (account, can be disabled in "My account"), reservation confirmation, reminders before Christmas if you have confirmed them, invitations and draws. Each reminder contains an unsubscribe link.
Your rights
You have the right to access, rectify, erase, restrict, object to and port your data. You can delete a list yourself ("Customise" then "Delete this list") or your account and all its lists ("My account"). For any other request: contact@malistedenoel.fr. If you encounter any difficulty, you can contact the CNIL (cnil.fr).
Cookies
Only cookies necessary for the service are used: see the cookies page.
Security
Encrypted connection (HTTPS), private links and random sessions stored in hashed form, protection against bots and abuse, daily backups encrypted at rest, sanitised article content.
Last updated: 24 septembre 2026.
Manage my lists