GDPR

Privacy policy

Effective as of 21 July 2026 · django-admin-wiki Premium (marketing site, account area and cloud API).

1. Introduction

This policy explains how django-admin-wiki Premium (“we”, “the publisher”) processes personal data when you use:

the Premium marketing site (landing, signup, login);
the subscriber account area (dashboard, API keys, billing portal);
the cloud API that hosts your organisation’s wiki content.

Application servers are hosted in France / the European Union (Clever Cloud). We do not sell your personal data.

2. Controller

Christophe Surbier
Independent contractor (autónomo) — Spain
NIF: Y3258958X
EU VAT: ESY3258958X
Professional address: Riera Blanca 45-47, 08028 Barcelona, Spain
Email / GDPR: contact@django-admin-wiki.enprod.fr

3. Data we collect

3.1. Account and authentication

Email address (login identifier)
Password (stored hashed, never in clear text)
Organisation / project name (tenant)
Django session tokens

3.2. Subscription and billing

Stripe identifiers (customer, subscription, status)
Subscription status (active, past due, canceled, etc.)

We do not store card numbers; payments are processed by Stripe.

3.3. Hosted wiki data (Premium)

Wiki page content, metadata, revisions
Uploaded media files (images) scoped to your tenant
API key fingerprints (hashed; raw key shown once at issuance)

3.4. Technical data

Server logs (IP, timestamp, requests) for security and diagnostics
Rate-limiting metadata

3.5. Data we do not collect

No card data on our servers

4. Purposes and legal bases

Purpose	Legal basis
Account creation, authentication, session	Contract performance (GDPR art. 6.1.b)
Premium service (API, wiki storage, media)	Contract performance
Subscription, billing, customer portal	Contract · Legal obligation (accounting)
Support, security, abuse prevention	Legitimate interest (art. 6.1.f)

5. Recipients and processors

Clever Cloud — app hosting, PostgreSQL, Cellar (media)
Stripe — payments and subscriptions
Resend — optional transactional email (welcome after subscription)

Processors are bound by GDPR art. 28 contractual safeguards.

6. Transfers outside the EU

Application data is hosted in France / the EU. Some processors (notably Stripe, Resend) may process data outside the EEA under appropriate safeguards (SCCs, adequacy decision, or complementary measures).

7. Retention

Active account: while the account / subscription is active, then deletion or anonymisation within a reasonable period after closure, unless a legal obligation applies.
Technical logs: generally up to 12 months, unless a security incident requires longer.
Billing: 10 years where accounting rules require it.
Wiki content / media: for the Premium contract term, then deletion per termination policy.

8. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, objection and portability. Contact contact@django-admin-wiki.enprod.fr. We normally reply within one month.

9. Security

TLS/HTTPS;
email and hashed password authentication;
multi-tenant wiki isolation;
hashed API keys;
access control and logging.

10. Cookies

Strictly necessary cookies (Django session, CSRF) for authentication and security. No third-party analytics is enabled by default on the landing.

11. Minors

The service is intended for professionals. We do not knowingly collect data from anyone under 18.

12. Changes

We may update this policy. The effective date is shown above. Significant changes will be communicated by email or via the account area.

13. Contact and complaints

Email: contact@django-admin-wiki.enprod.fr

You may also lodge a complaint with a supervisory authority (in France: CNIL).