Privacy policy for CadeauZ (cadeauz.famiz.fr)
This translation is provided for information only; only the French version is authoritative. Read the French version
Last updated: November 13, 2026
This page explains what data CadeauZ (cadeauz.famiz.fr), the gift list application, uses, why, how long we keep it and how to exercise your rights.
Who is responsible for your data?
CadeauZ is published by Aurélien SEMENCE and Sandrine SEMENCE, private individuals, in a non-professional capacity (together, "the publisher"; see the legal notice). They decide together how your data is used and how it is processed: they are its "joint controllers" (article 26 of the GDPR). Under their arrangement, a single address, privacy@famiz.fr, receives all requests; you may exercise your rights with either of them, and Aurélien SEMENCE answers them and keeps the record of processing activities. There is no data protection officer, as one is not mandatory for this service.
We send no advertising, and we neither sell nor rent out your data.
What CadeauZ processes
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Your lists: name, theme, who it is for, occasion, dates, who they are shared with | To create and share wish lists | Contract | As long as the list or the account exists |
| Your ideas: name, description, link, price, image, options | To fill your lists | Contract | As long as the idea exists |
| Your photos (ideas, pages of a letter) | To illustrate your ideas | Contract | Erased when no list uses them any more; temporary copies may remain for up to 30 days in the delivery network, and up to 1 year in your browser's cache |
| Reservations and contributions: who reserves which idea, what amount each person declares for a group gift | To avoid duplicates and organize group gifts | Contract | As long as the list exists; when your account is erased, your reservations on other families' lists remain, without your name |
| Your occasions: whether your birthday is included, chosen holidays, personal dates (label and date) | To prepare your lists before each occasion | Contract | As long as the account exists |
| The guests and circles a list is shared with, and each guest's address | To share a list and notify your family and friends | Contract (yours); legitimate interest for the guest | As long as the list is shared, or as long as the guest exists |
| The log of emails sent (a list shared, a list opened) | To never send the same email twice | Legitimate interest | 400 days |
| Occasions already opened (profile, occasion, year, list created) | To avoid opening the same list twice | Contract | Until 1 January of the second following year |
| Reports: idea or list reported, reason, comment (optional), author of the report, copy of the idea or list at the time of the report, the publisher's decision and note | Moderation: hiding and then reviewing content that breaches the Terms, and detecting abusive reports | Legitimate interest | 1 year after the decision; the reports you made are erased with your account |
| The contact form: your address, your name, the subject, your message, the language and the page you are writing from, your account if you are signed in | To reply to you | Legitimate interest | 12 months, or until the account is erased |
The surprise is preserved: no one sees who reserved the ideas on their own lists. The organizer of a group gift sees the declared amounts; the other contributors see the total and their own amount; the list owner sees who contributed after the reveal, never how much.
A reported idea or list disappears at once for the family and friends viewing it: no one can reserve or contribute any more, and reservations and contributions already made are hidden during the review. Its owner sees it marked "Reported content"; they are notified by email of the report and its reason, then of the decision, but never learn who made the report. The publisher is notified, reviews it, then restores or removes it; if it is removed, its reservations and contributions are cancelled, and the family and friends concerned are notified. Someone who abuses reporting may have their account suspended [À CONFIRMER : signalement depuis CadeauZ, à construire avant la publication].
The contact form is limited to a few messages per hour. To enforce this, the sender's IP address and email address are kept for one hour in a scrambled form, then erased. The publisher is notified of your message and replies to you by email.
No payment goes through CadeauZ. A contribution is a simple declaration: we neither ask for nor keep any bank details.
Photos you send are reduced in size in your browser, then stored without their metadata (location, device, date taken).
CadeauZ emails: when a list is shared with a guest or a circle, each recipient receives an email, only once per list. It contains your name, the name of the list and, for a child, the child's first name. Before an occasion you have chosen, CadeauZ opens your list, shares it with your close circles and lets you know by email. These emails carry the CadeauZ brand, "by FamiZ". An address that rejects our emails no longer receives list shares.
Links to shops
When you paste a product link, CadeauZ reads that product's public page to fill in its preview (name, price, image, options).
- The page is read from our servers, without any information about you: no cookie, no account, no IP address of your device. The link's tracking parameters (
utm_…,gclid,fbclid…) are removed from it. - The page read is kept in cache for 1 day, or 1 hour if it could not be read. We count, per shop, successful and failed reads, without the product's address or the person.
- During the preview, your browser displays the images directly from the shop: the shop then sees your IP address and your browser, but not the CadeauZ page the request comes from.
- When you save the idea, its image is copied into CadeauZ, so that the list no longer depends on the shop. If the copy fails, the image is still displayed from the shop.
Your FamiZ account, shared across the applications
CadeauZ uses the FamiZ account, shared by all FamiZ applications: a single sign-up and a single sign-in for all of them. This account is managed by the central account service, hosted by Amazon Web Services (AWS), in its Paris region.
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Account email address, password (stored hashed, so that no one can read it back) | To sign you in | Contract | As long as the account exists |
| Account profiles: first name; last name, date of birth, profile photo and notification address, if you wish; language, time zone, role in the account | To recognize you on each site, in your language and your time zone | Contract | As long as the account exists |
| Sign-ins: last activity, "remember me" choice | To keep you signed in | Contract | 1 hour without activity, or 1 year with "remember me" |
| Two-step verification, if you turn it on: the app's encrypted secret, hashed backup codes; for each security key or passkey, its public key, the name you give it and the dates it was added and last used | To protect your account | Contract | Until it is turned off, or until the key is removed |
| Sites used: date of each profile's first visit | To know which sites you use | Contract | As long as the account exists |
| Codes sent by email (verification, reset, change of address) | To prove that the address is yours | Contract | 15 minutes |
| Delivery status of your address: an email permanently rejected, a spam complaint, or 5 temporary failures in a row within 30 days | To stop writing to an address that rejects our emails; to ask you to re-verify it or change it | Legitimate interest | The "Your emails no longer arrive" flag on your account: 6 months; the count of temporary failures: 30 days; the AWS list of blocked addresses: until you re-verify the address |
| Technical logs of the central service (requests, errors) | To run the service, fix errors, prevent abuse | Legitimate interest | 6 months |
An account with no sign-in for 3 years is deleted: an email warns you 30 days before, then a reminder 7 days before. Simply sign in to any of the sites to keep it.
Account emails (verification code, password reset, account activated, invitation, change of address, security alerts) are sent through Amazon SES, from noreply@famiz.fr. We keep no copy of them. They carry the brand of the site the action came from, "by FamiZ".
The platform administrators, that is, the publisher and the people they authorize, who act under the publisher's responsibility, may look at your account for support, for security or to answer a request to exercise your rights. Each of their accesses is recorded, with its reason, in a log kept for 1 year. They may also review CadeauZ content that has been reported, to decide what action to take.
Erasing your account erases it from all the sites: profiles, lists, preferences, activity in each application, second factor and sessions. Gifts you reserved on other families' lists stay reserved, without your name, so as not to spoil their surprise. Once closed from "My FamiZ account", your account is no longer visible to others and is only erased 30 days later: signing in again before then cancels the closure. Erased data disappears from the backups no later than 35 days afterwards.
The account's processor
Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, hosts the central service (Paris region), sends the emails (Amazon SES, Paris region) and delivers the sites and images (CloudFront).
AWS is a company governed by US law. So that pages and images load quickly, CloudFront keeps temporary copies of them as close as possible to visitors, including outside the European Union. These transfers are covered by the European Commission's standard contractual clauses and by Amazon's participation in the Data Privacy Framework between the European Union and the United States.
Where is your data?
Your data stays in France: CadeauZ and the central account service are hosted by AWS, in its Paris region (lists, ideas, photos and image service), and the audience statistics are kept by the publisher, in France.
Who can see your data?
- The family and friends you share a list with, according to what you choose, and the members of your account according to their rights.
- The platform administrators, for support and security: their access is personal to each of them and recorded in the log. They see the general information of your lists (name, who it is for, number of ideas, status), and the content of a reported idea, or of your lists when you ask for a copy of your data.
- AWS, our host, which acts on our behalf.
- The shops whose link you paste, only for the images displayed during the preview (see above).
Cookies and storage in your browser
We only use cookies that are necessary for the service. They are not used for advertising or to track you, and do not require your consent.
| Cookie or storage | What it is for | Duration |
|---|---|---|
Sign-in cookie (__Secure-famiz_session) | To keep you signed in from one site to another | Until the browser is closed, or 1 year with "remember me" |
Language (famiz-locale) | To remember the chosen language | 1 year |
Theme (famiz-color-theme) | To remember the light or dark theme | 1 year |
Sign-in in progress (cadeauz.pending-authorization, tab storage) | To finish a sign-in already started | Until the tab is closed |
Audience measurement opt-out (famiz-no-stats) | To remember that you refused audience measurement on CadeauZ | Until you turn it back on |
Audience measurement
To know which pages are useful and whether they load fast enough, we measure traffic on CadeauZ with GoatCounter, an open-source tool that we host ourselves, in France. No data is passed on to a third party.
- We count visits to each page (its template, never a list or profile identifier), the site you came from, your browser, your operating system, your screen size, your browser's language and your country. We never go more precise than the country.
- We also measure how long pages take to display. These measurements are added up per day, per page and per device type, without any identifier.
- No cookie is set. Your IP address is not kept: CloudFront, at AWS, derives the country and the day's fingerprint from it, then removes it before passing on the measurement.
- To count each day's visitors, we keep a visit fingerprint until the next day, computed with a secret key, which cannot be used to recover your address. After that, only the number of visitors for the day remains.
- Measurements wait for at most 14 days, encrypted, in an AWS queue in Paris, before reaching us.
- CadeauZ is measured separately from the other sites: we do not follow you from one site to another, nor on other sites, and these statistics are never linked to your account.
- They are kept for 25 months at most.
This measurement meets the CNIL's conditions for being exempt from consent. You can still refuse it with the "Audience measurement" switch at the bottom of every page. It is also turned off automatically if your browser sends the Global Privacy Control signal.
Children
The holder of an account is at least 15 years old. Profiles of younger children are created and managed by an account manager, their parent or the person responsible for them: no child under 15 signs up alone. A child's profile does not need an email address and cannot change the account's security. Its data is protected like that of the rest of the family, and erased with the account.
The security of your data
- All communications are encrypted (HTTPS).
- Passwords are never stored in plain text.
- You can turn on two-step verification, with an app or a security key; it is mandatory for the platform administrators.
- With a security key or a passkey, your fingerprint or face never leaves your device: we only receive a public key. A passkey also lets you sign in without a password, with no additional data.
- An email alerts you to every significant change to your account's security.
Your rights
At any time, you can:
- get a copy of your data, in a file you can reuse elsewhere;
- correct your data: most of it can be changed directly on the site;
- have your account and your data erased, yourself from "My FamiZ account" if you manage the account, or by writing to us;
- object to a use based on our legitimate interest, or ask for it to be restricted;
- withdraw your consent to an email you chose, from "My emails" or the unsubscribe link in the email.
Write to privacy@famiz.fr. We reply within one month. To protect your account, we may ask you to confirm your identity.
If you believe your rights are not being respected, you can lodge a complaint with the CNIL (www.cnil.fr).
Changes
This policy may change. If there is a significant change, we will let you know by email or on the site.