Updated 5 October 2026
This is a translation provided for convenience. Only the French version is legally binding.
Privacy policy
Version applicable during the private beta.
Controller: Alexandre Ribes, sole trader operating under the business name La Boîte à Code, SIRET 840 048 680 00051 (see legal notice). Data protection contact: privacy@quietsystems.dev. No data protection officer has been appointed as at the date of this policy; this address receives requests relating to personal data.
Quiet Metrics wears two distinct hats, dealt with separately below: processor for the analytics carried out on behalf of its customers, and controller for the data of its own customers and visitors.
1. Visitors to sites measured by Quiet Metrics
Quiet Metrics is an analytics tool without any identification or tracking cookie: its measurement tools place on the visitor's device no identifier, no analytics cookie and no persistent fingerprint, and no directly identifying data is kept in the statistics. Only two things may be written on the device of a visitor to a measured site, and they do not follow the same regime: the opt-out marker qm_ignore, set at the person's own request in order to stop the measurement and never transmitted to Quiet Metrics, and the visit continuity cookie qm_visit, set by the measurement for ten sliding minutes so that a network change during a visit does not cause the same person to be counted twice. Neither of them contains an identifier, their value being the same for everyone, and the second is never set on the device of a person who has opted out. The public pages of Quiet Metrics further store two non-identifying local preferences after an action by the user (chosen theme and dismissal of the information notice). All of this is detailed in the cookie policy.
Concretely: the IP address and the browser signature pass through an encrypted queue of bounded duration (15 minutes target, under 2 hours for a permanently failed job), then serve for a few milliseconds in memory to compute an ephemeral pseudonymous fingerprint. They are not written to the measurement tables. That fingerprint is not computed on the full address but on the subscriber network: the whole address in IPv4, and in IPv6 the /64 prefix alone, the remaining 64 bits identifying the machine's interface. What is observed is therefore coarser than the address received. Without the daily salt, destroyed after its grace period, it is impossible to link a fingerprint to a person or to the following days: no tracking over time, no profile. The full method is described in how we count.
The controller for the analytics of a site is that site's operator; Quiet Metrics acts as a processor (art. 28 GDPR) under the data processing agreement. To exercise your rights regarding the measurement of a site you visited, contact that site's operator. Given the design of the service (no identifying data retained), Quiet Metrics is generally unable to re-identify a visitor (art. 11 GDPR).
2. Quiet Metrics account holders
To provide the service, we process:
| Data | Purpose | Legal basis | Duration |
|---|---|---|---|
| Account (name, email, hashed password, language) | Providing the service | Performance of the contract | Life of the account + 30-day reversibility period |
| Contract profile (consumer or business status; legal name, company number and VAT number for businesses) | Formation of the contract, billing and determining the applicable rules | Pre-contractual steps and performance of the contract | Life of the account, then applicable accounting and evidential periods |
| Contractual evidence (versions and dates of acceptance, start of contract, trial and any withdrawal) | Formation, performance and proof of the contract | Performance of the contract, then legitimate interest in defending rights | Term of the contract, then evidential archiving for up to 5 years |
| Billing (details, history, invoices) | Billing, accounting | Legal obligation | 10 years (accounting records) |
| Service emails (per-site reports, quota alerts, end of trial) | Providing the service | Performance of the contract | Life of the account |
| Support exchanges | Assistance | Performance of the contract | 3 years |
| Authentication, administration and security logs (account identifier, date, action, IP address where necessary) | Securing the Service, detecting abuse and evidencing incidents | Legitimate interest in securing the Service | 6 to 12 months, save for a documented need linked to an incident or dispute |
| Login security (active sessions with IP address and browser; two-factor authentication secret and recovery codes, encrypted, if you enable it) | Authentication and protection of the account | Performance of the contract and legitimate interest in securing the Service | Session: deleted after 2 hours of inactivity; two-factor authentication: until it is disabled or the account is closed |
| Programmatic access (API tokens, authorisations granted to an AI assistant through the MCP server) | Access to the statistics outside the interface, at your initiative | Performance of the contract | API token: 90 days at most; MCP authorisation: one-hour access token renewable for 30 days; revocable at any time from your account |
| Sign-up notices (name and email address of the new account, sent by email to the Publisher) | Monitoring account openings and preventing abusive sign-ups | Legitimate interest | Up to 3 years in the Publisher's mailbox |
| Person invited to an account (email address at the time of the invitation; name and hashed password if they create their access) | To let them accept the invitation and then access the account that invited them | Legitimate interest of the account holder in opening their account to their team | Life of the seat: deleted on removal by the holder, on the member leaving, or on closure of the account |
Card payment is handled by Stripe: card data never passes through our servers. Stripe collects billing details, the company's legal name and, where applicable, its tax identifier. No marketing outreach is carried out without your agreement; service emails are limited to the operation of the account, and periodic reports can be switched off site by site.
3. Visitors to quietmetrics.dev
We measure the audience of the site's public pages with our own product, from our server: no measurement script is loaded there and no measurement cookie is set. Each page served is counted according to the method described in § 1: the IP address and the browser signature serve only to compute an ephemeral fingerprint and are not recorded in the statistics, which keep the address of the page viewed, the page you came from and the first language declared by your browser. Purpose: knowing the site's traffic and where visits come from, as aggregated statistics. Legal basis: legitimate interest in measuring the audience of our own site. Duration: the retention period of the measurement account, 25 months at most. You may object at any time by adding ?qm_ignore=1 to the address of a page of the site: a marker with no identifier is then stored on your device, and our server, which checks for its presence on every page, stops counting you; ?qm_ignore=0 removes it (see the cookie policy).
The contact page collects the name, email address, subject and message entered voluntarily. This data is not written to the application database: it is sent by email to the Publisher, delivered by Spirion (service-smtp.fr) to a mailbox hosted by Proton (§ 4), in order to answer the request, on the basis of pre-contractual steps, performance of the contract or the legitimate interest in handling enquiries, depending on their nature. Exchanges are kept in the mailbox for 3 years.
This page, and the registration form, load Cloudflare Turnstile to prevent automated submissions and account creation. To that end Cloudflare processes technical signals such as the IP address, the User-Agent header, the TLS fingerprint, the widget key and its origin. These signals serve to tell humans from bots, not for advertising or analytics. The resulting token is verified server-side before each submission; it expires quickly and can be used only once. See the Turnstile privacy addendum.
4. Hosting, recipients and processors
The service's data is hosted in France and is neither sold, rented nor shared for commercial purposes.
| Processor | Role | Acts for | Location |
|---|---|---|---|
| OVH SAS | Hosting of the platform and the data | § 1, § 2 and § 3 | France (EU) |
| Stripe Payments Europe / Stripe Inc. | Payment and billing | § 2 | EU / United States; transfers framed by standard contractual clauses and the compliance framework in force |
| Spirion SAS (service-smtp.fr) | Email: delivery of the emails sent by the Service (service emails, order confirmations, periodic reports, contact form messages forwarded to the Publisher); the content is not kept beyond delivery | § 2 and § 3 | France (EU) |
| Proton AG | Email: receipt of messages sent to the contact and support addresses | § 2 and § 3 | Switzerland, a country recognised as adequate by the European Commission |
| Cloudflare, Inc. | Anti-bot protection of the contact and registration forms (Turnstile) | § 3 | United States; processing framed by Cloudflare's DPA and transfer safeguards |
| Laravel Holdings, Inc. (Laravel Forge) | Server administration tool: deployment and configuration; it has technical access to the server but hosts no data | § 1, § 2 and § 3 | United States; access framed by Laravel's DPA and standard contractual clauses |
This table brings together two distinct capacities, depending on the hat concerned. Only OVH, which hosts the data, and Laravel Forge, which has administrative access to the server, take part in the analytics carried out on behalf of customers (§ 1): they are therefore the only sub-processors within the meaning of article 28 GDPR, and the only ones listed in § 6 of the data processing agreement. The other providers act only on the processing for which Quiet Metrics is controller (§ 2 and § 3); they receive no personal data of visitors to measured sites.
Before any AI assistance feature or MCP server involving an external provider is enabled, the provider chosen, its purpose, the location of processing, the retention period and the transfer safeguards are added to the table above and brought to the account holder's attention. No visitor data may be sent to it without the Customer's documented instruction and a prior update of the DPA. If the Customer configures their own AI provider and API key, that processing falls under their agreement with that provider.
The Quiet Metrics MCP server involves no AI provider chosen by the Publisher. When a user connects the assistant of their choice to it, the aggregated results that assistant requests are sent to it, along with, for the SEO analysis, the technical characteristics recorded on the public pages of the account's sites, under the agreement between the user and the assistant's provider; no visitor data is sent. The user can withdraw this access at any time from their account, and the owner of an account decides which members may use it.
5. Security
TLS encryption of all traffic, encrypted and promptly purged collection payloads, secret keys encrypted at rest, hashed passwords, restricted and logged access, pseudonymisation by ephemeral fingerprint for measurement (see DPA: technical measures annex). The database is backed up every night, encrypted, to our internal monitoring tool (Quiet Guard, operated by the Publisher and hosted by OVH in France); each backup is kept for 30 days, so erased data may remain in it for up to 30 days before disappearing in turn. Commercial opening is conditional on an additional off-server copy and a tested restore.
The same tool receives the application's error reports. When a technical incident occurs during a request, the report may contain the page address, the browser headers and the submitted fields, after masking of passwords, tokens, cookies, IP addresses and email addresses: it may therefore contain, for example, the name and message entered in the contact form. Collection requests for the web analytics (§ 1) are excluded from these reports. Purpose: diagnosing and fixing failures; legal basis: legitimate interest in ensuring the operation of the Service; duration: 90 days, content encrypted at rest.
6. What we do not do
No profiling, no solely automated decision producing legal effects, no cross-referencing between customer sites, no advertising, no resale of data.
7. Your rights
Depending on the processing and its legal basis, you have rights of access, rectification, erasure, restriction, portability and objection. Write to privacy@quietsystems.dev: an answer within the legal time limit, in principle one month. Proof of identity is requested only where there is reasonable doubt as to the requester's identity. Account holders can export their statistics at any time in CSV. API access is reserved for the Pro and Agency plans. You may lodge a complaint with the French data protection authority, the CNIL (cnil.fr).
8. Updates
This policy may change; the update date appears at the top. Substantial changes are notified to account holders.