Privacy policy and data processing

This page explains which data is processed on MFmWebSite, why, under which legal basis and for how long — including forum, courses, news, games, support and professional services modules.

Last updated: June 23, 2026

Categories of processed data

Account and authentication data
Username, hashed password, roles, 2FA/TOTP status, and temporary data strictly required for registration steps and email verification.
Profile and contact data
Display name, masked email/phone suffix, verification flags, and, depending on enabled features, profile data stored in hashed or encrypted form (e.g. first name, last name, birth date, country).
Content and technical data
Reviews, course comments and ratings, forum messages and content, tickets (with account or public guest channel), replies, encrypted personal notes, uploaded course PDFs, professional pre-quote requests, MFmGames friend relations, technical logs (login, moderation) including IP addresses and User-Agent, session data, security tokens and interface preferences.
Third-party content and services data
Server-side aggregation of news RSS feeds (titles, links, excerpts, cached images), calls to public APIs (Open-Meteo weather, data.economie.gouv.fr fuel prices, geo.api.gouv.fr geolocation from your browser), Google Maps loaded only after consent, and Ko-fi redirect for donations.

Scope

This policy applies to processing carried out via MFmWebSite (the site you are currently on), its subdomains, related applications (e.g. MFmGames / CheeseCards) and APIs. It covers public browsing, accounts, published content (reviews, courses, comments, forum messages, tickets, notes), contact and pre-quote forms, the support page, and technical processing required for security and operation.



Linked services and sites

SaaS products, applications and sites published by the editor and linked to MFmWebSite (e.g. MFmTools, MFmGames, CheeseCards), when accessed through a verified link (shared account, SSO, subdomain or explicit referral from this site), are covered by this policy by default, unless the relevant service states otherwise.



Data controller and legal bases

The data controller is Marvin Forget-Mandras. Processing is carried out to provide requested features, manage accounts, secure the platform, and handle support requests.

Depending on context, legal bases include service performance, legitimate interest (security, abuse prevention, improvement), legal obligations, and consent where required.



Retention periods

Data is kept for a period proportionate to each purpose. Account data and related content are generally retained while the account is active, then handled under the applicable deletion/termination process.

Technical data: login logs ~1 month (IP included), 2FA trusted IP ~30 days, ip-api.com cache 24 h (language) / 30 days (history). Registration/email tokens: 24 h. Pre-quotes: commercial and legal retention.



Recipients and sharing

Data is never sold. Access limited to administration and moderation. Technical providers possible (hosting, email). Third parties by feature: Ko-fi, Google Maps (after consent), RSS feeds, Open-Meteo / French public services (Actu France), ip-api.com (IP only — language if enabled, history location). MFmGames/CheeseCards: own policy. Sensitive data encrypted or hashed.

Some third-party providers (Google) may transfer data outside the EU under appropriate legal safeguards (Data Privacy Framework).

Processing purposes

Create and manage accounts, authenticate sessions, validate sensitive actions, and secure access.
Enable publication and management of user content (reviews, comments, notes, tickets, and replies).
Process contact and support requests, including through the ticket module.
Prevent abuse (anti-spam, rate limiting, moderation), investigate incidents, and protect infrastructure.
Comply with legal obligations and keep evidence required to defend rights in case of dispute.
Improve service quality, usability, and technical reliability, without selling personal data.
Run the community forum (branches, channels, messages), moderate content and apply quotas and sanctions.
Publish, moderate and distribute community courses (PDFs, comments) and news aggregated from external sources.
Manage MFmGames (catalogue, player relations), voluntary support via Ko-fi and professional pre-quote requests.
Adapt interface language (browser, network or ip-api.com if enabled) and remember your choice.

Security measures

Passwords are stored in hashed form, forms are CSRF-protected, and access control is role-based.
Anti-abuse controls (including registration rate limiting), technical logging, and moderation mechanisms are applied.
Hashed/encrypted storage is used for selected sensitive data (e.g. user notes, profile fields), with ongoing hardening of security practices.



Language and IP addresses

Interface language

With no saved preference, the site determines the interface language in the order below and stores the result (session and `language` cookie, 1 year):

  1. Browser language
  2. Country via host/CDN (e.g. Cloudflare), no external call
  3. Country inferred from your IP via ip-api.com (country code only, 24 h cache), when IP geolocation is enabled on the server
  4. English if no supported language is identified

Change anytime via the language selector. Legal basis: legitimate interest.

IP addresses

Your IP (and sometimes User-Agent) is logged at sign-in for account security and abuse prevention.

Indicative retention: ~1 month (logs), ~30 days (2FA trusted IP).

To show approximate location in login history, the IP may be sent to ip-api.com (30-day server cache).

Data is not sold. IP logging remains necessary for authentication.

ip-api.com legal notices




Your rights

Under GDPR and applicable data protection laws, you may exercise the following rights within legal limits:

Right of access: confirm whether data about you is processed and obtain a copy.
Right to rectification: correct inaccurate or incomplete data.
Right to portability and right to lodge a complaint with the CNIL.
Right to restriction and objection: limit or challenge specific processing, especially when based on legitimate interest.
Right to erasure: request deletion of your data when legal conditions are met.

Cookies and similar technologies

Cookies and Symfony session (auth, CSRF, flows). Preferences: language (`language`, see dedicated section), RSS feeds (`actu_feed_lang`), Actu France (`actu_france_location`, 1 year). localStorage: language, theme, Maps consent, local quote draft.



Third-party services and external links

Third-party RSS feeds (links to sources). Actu France: Open-Meteo, data.economie.gouv.fr, geo.api.gouv.fr. Google Maps after consent. Donations via Ko-fi. CheeseCards/MFmGames: SSO, own terms. ip-api.com may receive your IP (language if enabled, history location) — ip-api.com legal notices.



Rights requests and contact

For any data protection question or to exercise your rights, you can open a private ticket (logged-in account) or a public ticket (no login) on the tickets page, which also displays a contact e-mail, or write to us directly at support@marvinfm.fr. Identity verification may be requested before handling a request involving personal data.



Policy updates

This policy may evolve with technical, functional, or legal changes. The version in force is the one published on this page with its update date.