---
title: "Privacy policy"
description: "Which personal data this site processes, why, for how long, and how to exercise your rights."
url: "https://mc-stud.io/en/privacy"
lang: "en"
updated: "2026-10-12"
---

Personal data

# Privacy policy

This site collects almost nothing: no form, and audience measurement that only starts with your consent. Here is what is processed, and your rights.

## Data controller

MC Studio, a French EURL, represented by its manager Matisse Chenavas, whose details are in the [legal notice](https://mc-stud.io/en/legal-notice). Contact for any question about your data: [contact@mc-stud.io](mailto:contact@mc-stud.io). No data protection officer is appointed.

## What this site does not do

- no measurement cookie set, and no request to Google, until you accept (only your choice is remembered, see below);
- no advertising and no ad tracking: Google’s advertising signals stay denied even if you accept audience measurement;
- no font, video or map loaded from a third-party service: fonts are hosted with the site;
- no form: you reach me by email or through a booking link.

## Cookies and audience measurement

Your choice. On your first visit a banner lets you accept or refuse audience measurement, with equal ease. Your choice is remembered in your browser’s local storage (key mcs-consent: accepted or refused, and the date) for 6 months at most, after which you are asked again. This storage is strictly necessary to respect your choice: it is never transmitted and needs no consent. The "Cookie settings" link in the footer reopens the choice at any time.

Audience measurement, with your consent only. If you accept, the site loads the Google tag for Google Analytics 4 directly (Google Ireland Limited for the European Economic Area, Google LLC in the United States). Purpose: to know which pages are read and where visitors come from, in order to improve the site. Legal basis: your consent (GDPR Article 6(1)(a); Article 82 of the French Data Protection Act). Data: pages viewed, date, device and browser type, referrer, approximate location and a pseudonymous identifier stored in the _ga and _ga_KQZQ94SPP8 cookies. According to Google, Google Analytics does not log or store IP addresses. I am the controller of this processing; Google acts as a processor for Google Analytics.

Retention. Google cookies: 13 months at most. Data in Google Analytics: 14 months at most, then automatic deletion. Your consent choice: 6 months.

Withdrawing consent. Choose "Refuse" in "Cookie settings": the Google cookies are deleted, the page reloads and nothing more is sent to Google. Withdrawal does not affect processing already carried out. You can also delete cookies from your browser settings.

Site search. Keyword search runs entirely in your browser: your queries are sent nowhere. The site never writes what you type into the page address: on the search page it is kept in the part of the link after the "#", which your browser never sends to a server, and that part is not written if you accepted audience measurement. One exception for an old shared link: if it contains "?q=", that address reaches the host like any other request before the page removes it from the address bar and turns it into internal state; the page does this before any Google code is loaded, and the Google code never receives its full address. If you turn on semantic search, after reading the box that explains it and clicking "Download and turn on", your browser downloads an artificial intelligence model once (Google’s EmbeddingGemma 2, Apache 2.0 licence, about 165 MB) from Hugging Face, the repository where Google publishes its models, keeps it in its cache (Cache Storage) and runs it locally. This download is a request from your browser to a third party: Hugging Face, Inc. (a US company) and its delivery network then receive your IP address and the usual technical data of a request (browser, date), but neither your search nor the page you are reading: only the site’s name (mc-stud.io) accompanies the request. No request to Hugging Face is made before that click. Afterwards the model is read from your cache, with no new request, for as long as the files remain there; if your browser has erased any of them, the page asks you again before downloading them once more. One exception, for a download you confirmed: if the page is reloaded or closed before it ends, the download carries on by itself, from the parts already verified, as soon as you open a page of the site within the next 24 hours, unless you cancel it ("Cancel the download" in the search details, or the "Semantic search" switch turned off, in any tab). A download that failed, was cancelled or is older than 24 hours, or whose files the browser has erased, is asked again before any new request to Hugging Face. If your browser refuses to keep the model (full storage, private browsing), the page tells you and the model will have to be downloaded again, with your agreement, on a later visit. Hugging Face’s processing is governed by its own privacy policy: [huggingface.co/privacy](https://huggingface.co/privacy). In the search, turning the switch off keeps the model files, while "Delete the model from this browser" erases them and forgets your choice. The runtime (WebAssembly, 22 to 34 MB) and the manifest are still served by this site. Your preference is stored in local storage (key mcs-search-semantic) and only serves the feature you asked for. While a download runs, a second marker is stored there (key mcs-search-semantic-resume: the model’s checksum, the time of your confirmation and, once the first part is saved, a flag); it enables the resumption described above, expires after 24 hours and disappears as soon as the download finishes, fails or is cancelled. You can delete these markers, and the model, from the search or from your browser settings.

## The actual processing

Emails. When you write to [contact@mc-stud.io](mailto:contact@mc-stud.io), I process your address, your name if given and the content of your message to reply and, where relevant, to prepare a collaboration. Legal bases: pre-contractual steps at your request, then my legitimate interest in corresponding with professional contacts (GDPR Article 6(1)(b) and (f)). Retention: for the duration of the exchange, then at most three years after the last contact if no contract is signed; for a contract, the statutory retention period for accounting and contractual records. Mail is operated by an email service provider acting on my behalf.

Booking. The booking button is a link to the [Google Calendar](https://calendar.google.com/) appointment page on Google’s site. The booking button loads nothing from Google until you follow it; after that, if you book, your booking details (name, email address, time slot) are handled on Google’s site under its own privacy policy, and I receive them in my calendar to honour the appointment. Same legal basis and retention as above.

Host technical logs. Like any web server, the host ([Cloudflare, Inc.](https://www.cloudflare.com/)) records connection data (IP address, date, requested page, browser type) to deliver the site and protect it against abuse. I do not access them by name and derive no visitor statistics from them. Legal basis: legitimate interest in the security and proper operation of the site. Retention: Cloudflare does not publish a single retention period for its network request logs; its privacy policy says it keeps personal data for as long as its purposes or legal obligations require. If Cloudflare Workers application logs are enabled for this site, they are kept for 3 days (free plan) or 7 days (paid plan), according to Cloudflare’s documentation. I do not export or archive them elsewhere.

## Recipients and transfers outside the EU

Your data is neither sold nor passed on. It is accessible to me and to the technical providers acting on my behalf (mail, calendar, hosting, audience measurement with your consent). Google (Analytics, with your consent; Calendar, if you book) and Cloudflare are US companies: transfers rely on the EU-US Data Privacy Framework they participate in or, failing that, on the European Commission’s standard contractual clauses. Hugging Face, Inc. (a US company) is a recipient only if you turn on semantic search after clicking "Download and turn on": your browser then sends it a download request directly, which reveals your IP address and the technical data of the request to it, under its own privacy policy. I do not rely on any particular transfer mechanism for this download; that is why it depends on your explicit choice.

## Your rights

You may ask for access to your data, its rectification or erasure, restriction of processing, object to it, or ask for portability (GDPR Articles 15 to 21). Write to [contact@mc-stud.io](mailto:contact@mc-stud.io); I reply within one month. If you believe your rights are not respected, you may lodge a complaint with the [CNIL (French data protection authority)](https://www.cnil.fr/fr/plaintes) (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France), or with the authority of your own country.

Providing your data is optional: without it I simply cannot answer your request. No automated decision-making or profiling takes place.

## Changes

If the site ever adds a new measurement tool or third-party content, this page will be updated before it goes live, and consent will be requested where the law requires it.

Last updated: 12 October 2026