Regulation (EU) 2016/679

Privacy policy

In force
17 October 2026
Controller
Meltdown
Reference
PC-2026-10
This policy describes the personal-data processing carried out by Meltdown for the Marsha service. It is governed by Regulation (EU) 2016/679 of 27 April 2016 (the "GDPR") and by French Act No. 78-17 of 6 January 1978, as amended.

ART. 1Controller

The controller is Meltdown, the entity that publishes Marsha. Its identification is set out in the legal notice.

No data-protection officer is appointed. Any request about a processing is sent to [email protected].

ART. 2Scope

This policy applies to all Platforms published under the name Marsha: the site marsha.app, the dashboard dash.marsha.app, the archives at archives.marsha.app, the documentation at docs.marsha.app, the Discord bot, the Twitch bot, the public profiles, the account, the session, and the newsletter, and to any other service published under that name.

It does not govern processing for which Discord, Google, Twitch, Better Stack, or another third party is the sole controller, where the User uses that third party's own service. The status page status.marsha.app is operated by Better Stack.

ART. 3Data concerned

Depending on the services actually used, processing may cover:

Account
account identifiers, display name, and identifiers passed by Discord, Google, or Twitch when the User links that service.
Session
session token and sign-in state, required to maintain the access that was requested.
Preferences
language chosen on the Platforms, and the choice made about trackers.
Security
technical logs strictly required to establish abuse or a failure.
Audience
audience measurement, only after the consent referred to in Article 4.

ART. 4Purposes and legal bases

Each processing rests on one basis in Article 6(1) of the GDPR.

Contract
Account, session, and dashboard, in order to perform the service requested. Sign-in with Discord, Google, or Twitch, in order to create the account and to link only the services the User chooses.
Art. 6(1)(b)
Legitimate interest
Security of the service, prevention of abuse, and technical logs. The interest pursued is protection of the service and of its users. It does not override the person’s rights where those rights so require.
Art. 6(1)(f)
Consent
Audience measurement, after acceptance in the banner. Newsletter, after subscription. Consent may be withdrawn at any time, without retroactive effect on processing already carried out.
Art. 6(1)(a)

ART. 5Retention

Data are kept for as long as the purpose requires, then deleted or anonymised.

Account
For the life of the account, then deletion.
Session
For the session, or for up to one hundred and eighty (180) days where the sign-in is kept.
Consent
Thirteen (13) months. That period is not extended merely because of a further visit.
Logs
For as long as strictly needed to detect abuse, then deletion.

ART. 6Recipients

Data are disclosed only to the following recipients, each for its task:

Discord
Sign-in and operation of the bot, where that service is used.
Google
Account sign-in and, only after consent, audience measurement.
Twitch
Account sign-in, where that service is linked.
Sentry
Receipt of technical error reports.
Vercel
Hosting of the web interfaces, on the terms of the legal notice.

A public authority may also receive data where the law so requires. No file is sold for commercial prospecting.

ART. 7Transfers outside the European Union

Discord, Google, Twitch, Sentry, and Vercel may process data in the United States of America. Where Union law so requires, those transfers are framed by the standard contractual clauses adopted by the European Commission, or by an adequacy decision applicable to the recipient.

ART. 8Rights of data subjects

The data subject has the rights of access, rectification, erasure, restriction, portability, and objection, under Articles 15 to 21 of the GDPR. The data subject may withdraw consent at any time, without making unlawful the processing based on consent and carried out before the withdrawal.

The request is sent to [email protected]. It is handled within the one-month period in Article 12 of the GDPR, which may be extended in the cases that article provides.

The data subject may lodge a complaint with the Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at cnil.fr.