Privacy policy — The Unknown Masterpiece

This site is built so that you can visit it without leaving any trace of yourself. No account, no profile, no persistent cart. Here is what that looks like concretely, and what happens when you write to me.

No personal data stored by default

When you read these pages, nothing is recorded about you. There is no user database, no customer account, no cart saved across visits. The site is essentially static — it serves pages, you read them, you leave.

Contact forms

Contact, expertise and newsletter forms (forthcoming) are handled by Brevo, a French platform based in Paris, GDPR-compliant. Their only job: turn your message into an email that lands in my inbox. No copy is kept on this site.

Concretely: your name, email and message are forwarded to Brevo (subprocessor), Brevo sends them as transactional email to contact@lechefdoeuvreinconnu.com, then Brevo deletes them according to its own retention policy (available on brevo.com).

Note: no form is active on the site yet. This section describes the planned behavior, to be confirmed when the forms actually ship.

Newsletter

If you decide to subscribe to my newsletter (once it opens), it will use Brevo double opt-in: you enter your email, Brevo sends a confirmation email, and you are only registered after your explicit click. No pre-checked boxes, no commitment.

Every newsletter contains a one-click unsubscribe link, GDPR-compliant. Your email stays at Brevo, is never resold, is never used for anything other than sending you the letter you requested.

Analytics — Rybbit, cookieless

I measure site traffic with Rybbit, an open-source analytics tool I run myself on the hosting infrastructure above — no data is sent to any third-party service such as Google Analytics. Rybbit is cookieless: it sets no tracking cookie and assigns no persistent identifier. Visit counting relies on an anonymous method that identifies no individual visitor.

What I see, in aggregated and anonymized form: number of visits per page, country of origin (IP resolution, IP itself not stored), device type (mobile / desktop), traffic source (search engine, direct link). That is all.

Direct consequence: no cookie consent banner is required. The French CNIL confirmed in 2020 that privacy-friendly, cookieless analytics like Rybbit are exempt from prior consent.

Technical cookies

A single cookie is set by this site: librairie_locale. It stores your language preference (French or English) for 1 year, with SameSite=Lax. This cookie is strictly necessary for the multilingual experience of the site and is also exempt from consent (user preference cookie — CNIL 2020 guidelines).

No third-party cookie, no advertising pixel, no social-network beacon is set.

Embedded Instagram feed

The bottom of the homepage shows an Instagram feed that extends the bookshop’s atmosphere. The images are hosted on our own server, not loaded from Meta/Instagram’s servers: opening the homepage drops no third-party cookie, contacts no Instagram server, and sends no data to Meta.

If you click on a tile, you are redirected to the matching post on Instagram.com, which then applies its own privacy policy and its own cookies. That choice is explicit — nothing happens unless you click.

Your GDPR rights and contact

Under the General Data Protection Regulation (GDPR) and the French “Informatique et Libertés” law, you have the right to access, rectify, erase, object to, and port your personal data, as well as the right to restrict its processing.

To exercise these rights: write to contact@lechefdoeuvreinconnu.com. I, Tiphaine, also act as Data Protection Officer (DPO) for this site. The response comes directly from me, with no middleman.

If you believe the handling of your data is non-compliant, you can file a complaint with the CNIL (French data protection authority): 3 place de Fontenoy, 75007 Paris, or via cnil.fr.