Privacy Policy
Last updated: February 2026
Data Controller
Mix Control is published by Mickaël MASSON. Data collected is processed in accordance with the GDPR (EU Regulation 2016/679).
Data Collected
- Registration data: email address, first name, last name, phone number (optional), password (hashed Argon2id)
- Business data: recipes, ingredients, nutritional compositions created by the user
- Technical data: IP address, User-Agent, login logs (12-month retention)
- Payment data: handled exclusively by Stripe (PCI-DSS SAQ A). No banking data passes through our servers.
- Third-party authentication data: when signing in via Google OAuth, your Google identifier (subject ID) is stored to link your account
- Biometric access keys (Passkeys/WebAuthn): cryptographic credentials stored for passwordless authentication
- Referral data: referral codes, tracking of referrals made and received
- Professional data: SIRET number (optional), used for billing and legal obligations
Processing Purposes
- Service delivery: account management, recipe storage and calculation
- Billing: subscription management via Stripe
- Service improvement: anonymized analytics (Matomo cookieless)
- Marketing and conversion tracking: with your consent, measuring the effectiveness of our advertising campaigns
Cookies and Trackers
Mix Control uses various measurement and tracking tools:
- Matomo (cookieless): analytics exempt from consent (CNIL), no cookies set, anonymized data
- Google Analytics 4: audience measurement and user behavior analysis (subject to your consent)
- Meta Pixel / Conversions API: Facebook/Instagram advertising conversion tracking (subject to your consent)
You can manage your consent preferences at any time from your account Settings ("Cookie consent" section).
Cookie details
| Cookie | Vendor | Purpose | Duration | Category |
|---|---|---|---|---|
| consent_state | Mix Control | Saves your consent preferences | 13 months | Required |
| mc_session | Mix Control | Session indicator (HttpOnly) for admin route protection | 24h–30 days | Required |
| refresh_token | Mix Control | Automatic session renewal | 24h–30 days | Required |
| _ga / _ga_* | Google Analytics visitor identification | 2 years | Analytics | |
| _gcl_au | Google Ads | Google Ads conversion linking | 90 days | Marketing |
| _fbp | Meta | Meta Pixel visitor identification | 90 days | Marketing |
Sub-processors and Third Parties
- Stripe (payments): secure card payment processing — stripe.com/privacy
- Google (OAuth, Analytics, Ads): authentication and audience measurement — policies.google.com/privacy
- Meta (Pixel, Conversions API): advertising conversion tracking — facebook.com/privacy
Data Retention
Data is retained as long as the account is active. After account deletion, data is erased within 7 days (including a 48-hour grace period). Invoices are retained for 10 years per accounting obligations.
Your Rights
Under the GDPR, you have rights of access, rectification, erasure, portability, and objection. Exercise them from your account Settings or via our contact form. You may also file a complaint with your national data protection authority. Contact form
DPO Contact
For any questions regarding your data protection: Contact page