Yumwi
Sign in

Privacy

What is collected, why, on what basis, for how long, and how to have it erased. Updated on 29 octobre 2026. This is a translation provided for information. The French version is the one that applies; in case of difference, it prevails.

The controller

The data controller is Mathieu Vincenti EI, sous le nom commercial Yumwi, 138 avenue Victor Hugo, 75016 Paris, France. For any question or request: contact@yumwi.com.

For data that visitors leave on a creator's Hub (messages, appointments, addresses on their list), the creator is the controller and Yumwi processes the data on their behalf (see the terms of use).

The principle

Nothing is collected to be sold, and nothing is published without an explicit action. A portfolio, its positions, amounts and cash flows stay private: they never leave their owner's account, whatever public page they choose to open.

The site sets no advertising or audience-measurement cookie and embeds no third-party tracker, except on the Hub of a creator who adds some: their trackers only load after the visitor agrees, on that Hub. A Hub's players come from the platforms themselves (YouTube, Vimeo, Instagram, TikTok, Twitch, music players) and also wait for the visitor's consent: without it, nothing loads, and a click opens the post on the platform's site.

Yumwi's cookies

All of them are needed for the site to work; none follows browsing elsewhere, and none requires consent:

  • the session (Supabase), to stay signed in;
  • the chosen language (yumwi-locale), one year;
  • the Hub and portfolio open in the editor (yumwi-hub, yumwi_pf), thirty days;
  • the return after sign-in (yumwi_retour), ten minutes, and an ongoing invitation (yumwi-invitation), one hour;
  • a Hub chat conversation, for a visitor who is not signed in, one year; access to an opened media kit, thirty days;
  • our host's bot protection (__cf_bm), thirty minutes.
  • Choices made on a Hub (accepting or refusing its trackers and players) are kept for six months in the visitor's browser, not in a cookie.

What is collected, and why

  • The account: when signing in with Google, the email address, name and photo of the Google account, to open, recognise and protect the account; the name and photo can prefill the Hub. With email and password: the email address, and the password, which our authentication provider keeps irreversibly hashed; it is checked against known breached passwords by sending only the first five characters of its hash to Have I Been Pwned.
  • A Hub's content: texts, links, settings and uploaded images, to display the Hub; public only once published by its author.
  • A fingerprint of the IP address of Hub visitors and clicks, to count one visit per person per hour, with the visit's country (deduced by our host) and device type (mobile or computer). The address itself is not kept, only its fingerprint, computed with a site secret combined with the Hub's identifier: the same address leaves a different fingerprint on each Hub, and visits to two Hubs cannot be matched through their fingerprints. This is pseudonymous data, not anonymous, and Yumwi never tries to link it to a person.
  • The referring domain, when the browser sends it, to tell the creator where their audience comes from, never who it is.
  • Site audience measurement, without cookies or third parties: for each page view and tool action, a fingerprint of the IP address mixed with the date, the country and the device type. Like Hub fingerprints, this is pseudonymous data.
  • A subscription order: plan, period, price, version of the terms of sale accepted, boxes ticked (18 or older, immediate performance), declared country of residence and time. They prove the contract. Payment happens at Stripe, which receives the card, email address and country; Yumwi never sees the card number. A withdrawal likewise keeps the declaration (name, contract, acknowledgment address) and what was refunded.
  • Acceptance of the terms of use, with the declaration of being at least 15: the version accepted and the time.
  • Subscription emails (confirmation, end of trial, renewal reminder, cancellation, withdrawal): a record of each sending, so it is never sent twice.
  • Yumwi's newsletter, if the box is ticked: the account's email address and sign-up date. Each issue has an unsubscribe link.
  • Feedback or a report: the message, the page concerned, and an email address only if the person leaves one for a reply.
  • A message sent through a Hub's contact form, chat, appointment booking, PDF download or media kit: what the visitor enters, passed on to the creator.
  • A creator's Substack newsletter button: the address entered goes directly to Substack; Yumwi does not keep it.
  • Bot protection: on forms, Cloudflare Turnstile checks that a human is sending, from technical browser signals, without advertising cookies. On the sign-in page, the Google button loads from Google.
  • On a creator's Hub with trackers (Meta, TikTok, Google) or third-party players, and only with the visitor's consent: those services receive the visit, under the creator's responsibility and their own rules.

How long

  • The account and its Hub: as long as the account exists. A deleted account spends 30 days in the bin, then is erased for good.
  • Hub visit, click and media kit fingerprints: twenty-four hours, just long enough to count one visit per person per hour. After that, the fingerprint is replaced within the hour by a neutral value: the visit stays counted, with no one behind it.
  • Site audience measurement: thirteen months, long enough to compare one year with the previous one, then each fingerprint is replaced by another one computed with a key thrown away at once: each day's visitors stay counted, with no one behind them.
  • Feedback: the address and fingerprint are erased after twelve months.
  • Contact messages and chat conversations: twenty-four months at most; appointments and media kit details: twelve months; an address left for a PDF: twelve months.
  • A mailing-list sign-up: erased within 7 days if not confirmed; otherwise until unsubscribing, removal by the creator, or deletion of their account.
  • Yumwi's newsletter: until unsubscribing or account deletion.
  • Orders, withdrawals, acceptances of the terms and the record of subscription emails: as long as needed to prove the contract, five years after it ends. A deleted account is no longer linked to them, but a withdrawal keeps the name and email address of its declaration, which prove it. Invoices, at Stripe, are kept ten years as the law requires.
  • Backups: an encrypted copy each week, kept 90 days.

On what basis

  • Account, Hub, subscription and its emails: performance of the contract.
  • Proof of orders, withdrawals and acceptances, invoices, emails required by law: a legal obligation, and our legitimate interest in being able to prove them.
  • Cookieless audience measurement, visit fingerprints, bot and abuse protection: our legitimate interest in running and protecting the site, and giving creators their statistics.
  • Yumwi's newsletter, a Hub's trackers and players: consent, which can be withdrawn at any time.
  • Data left by visitors on a Hub: the basis chosen by the creator, who is responsible for it.

Who else sees it

Only the providers strictly needed to run the site:

  • Cloudflare: website hosting, storage of images and encrypted backups, bot protection (United States and European Union).
  • Google: account sign-in (United States and European Union).
  • Supabase: database and accounts (European Union).
  • Stripe: subscription payments, invoices (European Union and United States).
  • Resend: transactional emails (United States and European Union).
  • GitHub: running the weekly encrypted database backup (United States).

Outside the European Union

The database is hosted in the European Union (Frankfurt). Some providers are American and may process data in the United States: Cloudflare, Google, Stripe, Resend and GitHub are certified under the EU-US Data Privacy Framework recognised by the European Commission; Supabase commits through the Commission's standard contractual clauses. These documents can be requested from the contact address.

Your rights

Exporting your data and deleting your account are done yourself, from My account.

For everything else (access, rectification, erasure, restriction, objection, portability, withdrawal of consent): contact@yumwi.com. Requests are handled within one month.

A complaint can be made to the CNIL (www.cnil.fr), 3 place de Fontenoy, 75007 Paris, France, or to the authority of your country.