Privacy Policy

1. Data controller

The data controller is the publisher of Raffly (a French sole proprietorship). Contact: hello@raffly.tech.

2. Data we collect

• Account: username, email address, password (stored hashed with bcrypt, never in plain text).
• Amazon account credentials: the email and password of the Amazon accounts you add, along with the associated sessions. This data is encrypted at rest (AES-256-GCM). See section 4.
• Usage data: raffles tracked, entries, statuses, technical logs (timestamp, step, error code). The proxy address used is stored without its password.
• Billing: handled by Stripe. We do not store your card numbers; we keep a customer ID and subscription status.
• Support: the content of tickets and attachments you send us.

3. Purposes and legal bases

• Providing the service (account creation, automated entries): performance of the contract.
• Storing and using Amazon credentials: your explicit consent, collected when you add an account.
• Billing and subscription management: performance of the contract and legal/accounting obligations.
• Security, fraud prevention, support: legitimate interest.

4. Amazon account credentials

To automate entries on your behalf, the service stores the credentials of the Amazon accounts you provide. This data is encrypted (AES-256-GCM) and used only to sign in to Amazon and enter the raffles you request. You can delete an account at any time, which deletes the associated credentials. You acknowledge that you provide these credentials voluntarily and that you are their legitimate owner.

5. Recipients and sub-processors

We rely on providers acting as sub-processors:

• Stripe: payment processing.
• OVH: hosting.
• Murphy Proxies: network proxy provision.
• Capsolver (secondary, backup): anti-bot challenge solving, used only as a complement to our own systems.

Some of these providers may process data outside the European Union. Where applicable, such transfers are governed by appropriate safeguards (standard contractual clauses).

6. Retention

Account data is kept while your subscription is active. When a subscription lapses, we stop actively monitoring and entering raffles on your Amazon accounts. If the subscription is not reactivated within 6 months, your account and its associated data (including your Amazon accounts, raffle entries, and related records) are permanently deleted. Billing data is kept in accordance with legal obligations (up to 10 years). Technical logs are kept for a limited time for debugging and security purposes.

7. Security

We implement reasonable technical measures: encryption of credentials at rest (AES-256-GCM), password hashing (bcrypt), token-based authentication, and restricted access. As no system is infallible, we cannot guarantee absolute security.

8. Your rights (GDPR)

You have the rights of access, rectification, erasure, restriction, portability, and objection, as well as the right to withdraw your consent at any time. To exercise them: hello@raffly.tech. You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

9. Cookies

The service uses only cookies/storage strictly necessary for its operation (authentication). No advertising or third-party tracking cookies are set.

10. Contact

For any question about your data: hello@raffly.tech.