Atelier · La transparence

Transparency report.

Q1 2026 (Jan 1 – Mar 31) · published 01 April 2026. Updated every quarter.

In one paragraph

We received zero government data requests this quarter. Every byte of Linkette user data sits on EU soil. We use eight named sub-processors, all GDPR-bound, listed below with role and country. We have never been compelled to disclose user data; the canary statement below reaffirms this.

Government & legal requests

Numbers are cumulative for the period above. We commit to publishing this table every quarter, even when the numbers stay at zero.

Government data requests (any jurisdiction)—0
Court orders / subpoenas—0
Law-enforcement preservation requests—0
National security letters (gagged)See canary below0
DMCA / copyright takedowns—0
GDPR data-export requests (from users)Self-serve in Settings0
GDPR erasure requests (from users)Self-serve in Settings0

Warrant canary

As of 18 May 2026, Linkette has not received any National Security Letter, FISA order, gag order, or equivalent secret legal request that would compel us to disclose user data while preventing us from saying so.

This statement is reaffirmed on the first business day of every month. If it stops being updated, treat the absence as a signal. It is the only legal way to tell you something has changed under a gag order.

Sub-processors

Every service that touches your data. No US clouds, no shadow vendors. Linkette also notifies users 30 days before adding a new sub-processor (per the DPA).

Scaleway
France · GDPR
Compute · VPS
Paris (FR-PAR-1)
Supabase
EU only
Database · Auth · Storage
Paris (eu-west-3)
Mistral
France · GDPR
AI inference
Paris
Bunny
Slovenia · GDPR
CDN edges · object storage
EU edges (Frankfurt, Paris, Amsterdam)
Brevo
France · GDPR
Transactional email
Paris
Mollie
Netherlands · GDPR
Payments
Amsterdam
Langfuse
Germany · GDPR
AI observability
Frankfurt
Coolify
Runs on our infra
Self-hosted deploy orchestration
Our VPS

Data residency

Pages, accounts, links — Supabase eu-west-3 (Paris). Never leave the EU.
Visit logs — same Postgres, same Paris region. Salted IP hashes, no clear IPs ever stored.
Avatars & assets — Bunny Storage Falkenstein (DE) replicated to Bunny EU edges.
AI prompts & responses — Mistral La Plateforme, Paris. Never used for training (contractual).
Payments — Mollie, Amsterdam. Card numbers never touch our servers.
Email — Brevo Paris (SMTP + REST).

Security & incidents

Incidents this quarter — zero data breaches, zero unauthorized disclosures, zero confirmed security incidents.
Auth — magic-link only (PKCE), no passwords on our side to leak.
Encryption — TLS 1.3 in transit, AES-256 at rest (Supabase + Bunny defaults).
Backups — daily encrypted snapshots, 30-day retention, EU-only restore.
Disclosure — found something? security@linkette.eu — we reply within 72h and credit responsible disclosure.

What we'll never do

Sell, rent, or trade user data. Not anonymized, not aggregated, not ever.
Add a US cloud provider. Linkette's whole reason to exist is staying off them.
Ship a third-party tracker. No GA, no Pixel, no Hotjar, no exceptions.
Comply with a foreign request that lacks a valid EU legal basis. We will challenge it in court first.
Train any model on user content — ours or Mistral's. The contract forbids it.

AI features & EU AI Act disclosure

Linkette uses AI to help creators draft and manage their pages. Under the EU AI Act (Regulation 2024/1689) Art. 50, we disclose how AI is used in our product:

Atelier Director — generates a full page theme (palette, fonts, card style, gradient) from a one-sentence vibe prompt. Powered by Mistral Large, Paris. Output is always presented as a draft the creator reviews and applies manually.
Onboarding bio draft— suggests a short bio based on the creator’s description during signup. Editable before publishing. Mistral, Paris.
Link enrichment — auto-fills link titles and descriptions from URL metadata + AI summary. Creator can edit or override. Mistral, Paris.
Weekly editorial brief — a two-sentence analytics summary written by Mistral, delivered in-app and optionally by email. Opt-out anytime in Settings.

All AI inference runs on Mistral La Plateforme (Paris, France). No data is sent to OpenAI, Anthropic, or Google. Every AI-generated output is clearly labeled and presented as a draft — nothing is published without the creator’s explicit action. All AI features can be disabled in Settings → Privacy.