Privacy policy
Draft: this text is being reviewed and may still change.
Last updated: October 20, 2026
Who is responsible for your data
The data controller is the publisher's identity, see the legal notice, who can be reached at bonjour@listebaby.fr.
Listebaby has no ads, no trackers and no audience measurement tool, and sells no data.
The data we process
We only process the data the service needs:
- your account: first name, last name, email address, country, language and currency; your password is never stored as such, only its fingerprint;
- your registries: title, the baby's first name, dates, welcome message, items, payment methods and, if you give one, a delivery address;
- guests: first name, last name, optional email address, language, gifts and messages;
- people invited to manage a registry: their email address;
- technical data: the IP address (attempt limits, anti-bot check, security) and technical logs without personal content.
Why, and on what basis
- providing the service (accounts, registries, gifts, confirmation and follow-up emails): performance of our contract, that is the terms of use;
- protecting the service from abuse (attempt limits, anti-bot check, security logs): our legitimate interest;
- meeting legal obligations and requests from the authorities: legal obligation.
Who sees your data
The parents and managers of a registry see the guests' gifts and messages, with their names. Other guests only see the first name and the initial of the last name of givers, unless they chose anonymity. In surprise mode, the parents do not see the gifts.
Our service providers process some data on our behalf, only to run the service:
- hosting: host's name, in the European Union;
- sending emails: name of the email service;
- the anti-bot check on registration, forgotten password, giving a gift and requesting a link: Cloudflare Turnstile, which receives the IP address and technical information about the browser. framework for the transfer to the United States to confirm: Data Privacy Framework or standard contractual clauses
For how long
- your account and your registries: as long as your account exists; deleting it also deletes the registries you are the only owner of;
- guests' data: their names, email addresses and messages are erased 180 days after the registry is archived, or as soon as it is deleted;
- links sent by email: 48 hours to confirm an address, 30 minutes to change a password, 7 days for an invitation;
- login sessions: they end after 30 days without use, or as soon as you log out;
- technical logs: retention period, for example 30 days.
Your rights
You can access your data, correct it, erase it, restrict or object to its processing, and get it back in a reusable format. From "My account", you can change your profile, download your data and delete your account. For any other request, write to bonjour@listebaby.fr.
You can also set instructions for what happens to your data after your death, and lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).
Security
The site is served over HTTPS; passwords are protected by a strong hashing function; login tokens stay on our servers, encrypted, and your browser only keeps a session identifier. Registry pages are never indexed by search engines.
Changes
This policy may change; any significant change is announced to users by email.