The short version
This policy describes how Meliform processes the personal data of people using https://meliform.com, in accordance with Regulation (EU) 2016/679 (“GDPR”) and French Act No. 78-17 of 6 January 1978 as amended.
Who is the data controller?
Kassim MONDOHAEmail: contact@meliform.com
Given the nature and volume of the processing carried out, appointing a data protection officer (DPO) is not mandatory; the address above is the single point of contact for any question about your data.
Our two roles: controller and processor
This distinction matters in order to understand who is accountable for what:
| Situation | Our role | Applicable document |
|---|---|---|
| Your account, your content, your browsing of the site | Data controller | This policy |
| The answers your respondents submit to your forms | Processor — you decide what data is collected and how it is used | Data processing agreement |
In other words: when you create a form that collects personal data, you are the controller towards your respondents. It is your responsibility to have a legal basis, to inform the data subjects and to answer their requests. We then act solely on your instructions, under the terms of the data processing agreement.
What data do we collect?
| Category | Data concerned | Source |
|---|---|---|
| Identity and account | Last name, first name, username, email address, password (hashed), profile picture, display language, visibility preferences | Provided by you |
| Content you create | Forms, questions, learning paths, images, comments, edit proposals, organisations and memberships | Provided by you |
| Form responses | Answers submitted, score, progress, duration, start and end timestamps — including anonymous participations where the creator allows them | Provided by the respondent |
| Technical and security data | IP address, date and type of sensitive actions (sign-in, identifier change), web server logs | Collected automatically |
| AI assistance | The content of texts you voluntarily submit to an AI assistance feature. If the author of a form has enabled automatic marking of free-text answers, the text of your answers to that form is transmitted to the AI provider — never your identity or your email address | Provided by you, at your initiative |
| Audience measurement | Page views, referrer, device type — with no cookie and no identifier able to recognise you | Collected automatically |
We collect no special category data within the meaning of Article 9 GDPR (health, political opinions, religion, sexual orientation, biometric data) as part of running the site. If you choose to collect such data in your own forms, you alone are responsible for doing so and must comply with the conditions of Article 9 GDPR.
What data is publicly visible?
Collecting data and publishing it are two different things. The table below shows, for each piece of your account data, whether it is visible to other people — including signed-out visitors and search engines.
| Data | Publicly visible by default | Details |
|---|---|---|
| Username (pseudonym) | Yes | This is the public identity you appear under, prefixed with an “@”. You choose it and can change it. |
| Profile picture | Yes, if you add one | Optional. You freely choose the image; nothing requires you to use a photograph of yourself. |
| First and last name | No | They identify the account holder and allow us to correspond with you. They are published only if you expressly enable it (see below). |
| Email address | No | Never published on the site. |
| Forms, learning paths and categories you create | According to the visibility you give them | Each item carries its own setting: Public, Protected or Private. |
| Participations, scores and progress | Only in a leaderboard, if the form creator enables it | You then appear under your public identity, not under your legal name. |
Displaying your name: a choice, not a default
By default, your first and last name are not published. You may choose to display them by ticking the corresponding option when editing your profile. That choice:
- is off by default and is never enabled on your behalf;
- makes your name visible including to signed-out visitors and search engines;
- has no effect if your profile is Protected or Private — it can only add information, never relax a more restrictive setting;
- can be withdrawn at any time, without justification, from the same settings.
Your profile visibility
Independently of the above, your profile visibility setting determines what others may consult: a Public profile is accessible to everyone; a Protected profile exposes only your public identity, its details being reserved for authorised people; a Private profile cannot be consulted.
Within your organisations
If you are a member of an organisation, its administrators see your first name, last name and email address in the management areas. This exception is necessary to administer members: it rests on the performance of the contract and on the organisation’s legitimate interest in identifying the people it grants rights to. It does not make that data public.
Why, and on what legal basis?
| Purpose | Legal basis |
|---|---|
| Create and manage your account, authenticate you | Performance of a contract (the terms of use) |
| Provide the service: creating, publishing, sharing and running forms | Performance of a contract |
| Send you service emails (address verification, notifications, invitations) | Performance of a contract |
| Ensure the security of the service, prevent and detect abuse and fraud | Legitimate interest: protecting the service and its users |
| Retain data enabling the identification of content authors | Legal obligation (Article 6 II of the LCEN) |
| Handle content reports and contact requests | Legal obligation and legitimate interest |
| Measure site audience anonymously | Legitimate interest: understanding how the site is used (measurement exempt from consent) |
| Provide AI assistance features | Performance of a contract, at your express request |
| Establish, exercise or defend legal claims | Legitimate interest |
How long do we keep your data?
| Data | Retention period |
|---|---|
| Account and related content | For as long as the account exists |
| Account never activated | Deleted after 7 days if the email address has not been verified |
| Inactive account | Anonymised after 3 years without sign-in, following prior notice by email 30 days beforehand |
| After account deletion | Your identity is anonymised immediately. Published content that other users have copied or responded to is kept in anonymised form, so as not to destroy their own data |
| Form responses | Until deleted by the form creator, or until the form is deleted |
| Documents uploaded in a form | 12 months after upload, or until the response or the form is deleted if that happens sooner |
| IP address and log of sensitive actions | 12 months |
| Web server logs | 12 months |
| Messages sent through the contact form | 12 months — 3 years for content reports, for evidentiary purposes |
| AI assistance requests | Not retained by us beyond processing; retained for up to 30 days by the provider for abuse detection |
Who has access to your data?
Your data is never sold, rented or transferred to third parties for commercial purposes. It is accessible to the site publisher and to the following technical providers, acting as processors and bound by confidentiality and security commitments:
| Provider | Role | Data location |
|---|---|---|
| OVH SAS | Website and database hosting | France (European Union) |
| OVH SAS | Sending the service's emails | France (European Union) |
| Mistral AI SAS | AI assistance features and automatic marking of free-text answers | France (European Union) |
| Umami | Anonymous, cookie-free audience measurement | France (European Union) - self-hosted |
Some data is also visible to other users according to the settings you choose: a public form, a public profile or a comment is visible to everyone. Visibility settings can be changed at any time in your settings.
Finally, your data may be disclosed to administrative or judicial authorities where the law requires it.
Transfers outside the European Union
Hosting, the database, email, audience measurement and all ancillary processing are located entirely within the European Union. None of your data is transferred outside the Union.
Your rights
Under the conditions set out in the GDPR, you have the following rights:
- Access: obtain confirmation that your data is processed and receive a copy of it;
- Rectification: have inaccurate or incomplete data corrected — most of it can be edited directly in your settings;
- Erasure: request deletion of your data, subject to our legal retention obligations;
- Restriction: request that processing you contest be temporarily frozen;
- Objection: object, on grounds relating to your particular situation, to processing based on our legitimate interest;
- Portability: receive the data you provided to us in a structured, machine-readable format;
- Post-mortem directives: set out what should happen to your data after your death.
You can delete your account at any time from your settings. For any other request, write to contact@meliform.com or use the contact form. We respond within a maximum of 30 days. Proof of identity may be requested where there is reasonable doubt as to the identity of the requester.
How is your data protected?
- Encryption of traffic between your browser and the site (HTTPS/TLS);
- Passwords stored as one-way hashes — they are never readable, including by us;
- Secure session cookies (
Secure,HttpOnlyandSameSiteattributes); - Sign-in attempt rate limiting to counter brute-force attacks;
- Fine-grained access control: every content read or write is subject to a permission check;
- Hosting in European Union data centres, with regular backups;
- Access to production data restricted to the site publisher.
As no measure can guarantee absolute security, we encourage you to choose a strong, unique password. In the event of a data breach likely to result in a high risk to your rights, you will be informed as soon as possible, in accordance with Article 34 GDPR.
Cookies and trackers
The site uses no advertising trackers and no third-party cookies. Only cookies strictly necessary for it to function are set. Details are in the cookie policy.
Minors
Creating an account is restricted to people aged 15 or over. Below that age, registration requires the joint consent of the holder of parental responsibility (Article 8 GDPR). If you become aware that an account has been created by a child under 15 without such authorisation, please let us know: the account will be deleted.
Changes to this policy
This policy may change to reflect changes in the service or in applicable law. The version in force is the one published on this page; its update date appears at the top of the document. In the event of a material change, you will be informed by email or by a notification within the service.