Privacy Policy

1. Who we are

FoReLLISTS is an internal application for managing and publishing content on social networks (LinkedIn, Bluesky) and for running a calendar of scientific events, developed for a research team at the University of Poitiers (Université de Poitiers, France). The application is available at https://forellists.vercel.app.

Data controller: the FoReLLISTS team, University of Poitiers.
Contact: hugo.semilly@univ-poitiers.fr

2. Data we collect

Authenticated users (team members)

• Email address and username (via Supabase Auth)
• Role in the application (editor, validator, administrator)
• Accessibility preferences (theme, reading mode)
• LinkedIn and Bluesky OAuth access tokens (stored encrypted in the application vault)
• Content of posts (text, images) created or approved by the member
• Technical error logs (via Sentry, pseudonymised)

Visitors of the public calendar and event suggestions

• No data is collected for simply viewing the calendar
• When suggesting an event: name and email address of the organiser, and the title, date and description of the event (voluntary form)

3. Purposes and legal bases

4. Storage and hosting

Data is stored with:

• Supabase (database, authentication, image storage) — servers in the European Union.
• Vercel (application hosting) — CDG1 region, Paris, France.
• Sentry (error logs) — pseudonymised data, SOC 2 compliant.

OAuth tokens (LinkedIn, Bluesky) are stored encrypted in the Supabase database and are only used for the API calls required to publish.

5. Sharing with third parties

We do not sell or rent your data. Data is shared only with the processors required to run the application:

• LinkedIn — to publish content through the Community Management API
• Bluesky / AT Protocol — to publish content
• Supabase — database and authentication
• Vercel — hosting and CDN
• Sentry — error monitoring

No personal data is passed on to third parties for advertising or commercial purposes.

6. Retention periods

• Member accounts: until the account is deleted or the tool is no longer used
• Posts and events: kept indefinitely as an internal archive
• Event suggestions: kept after they have been processed (accepted or rejected), including the name and email address of the person who suggested them, for internal follow-up; erased on request (see section 7)
• Sentry logs: rolling 90 days
• OAuth tokens: until revoked or expired

7. Your rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access: obtain a copy of the data concerning you
• Right to rectification: correct inaccurate data
• Right to erasure: request the deletion of your account and your data
• Right to object: object to certain processing
• Right to data portability: receive your data in a structured format
• Withdrawal of consent: revoke your LinkedIn or Bluesky OAuth access at any time

To exercise these rights, contact us at: hugo.semilly@univ-poitiers.fr. We will reply within 30 days at the latest.

You may also lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), the French data protection authority.

8. Cookies and trackers

The application only uses cookies that are strictly necessary for the authentication session (Supabase Auth). No advertising or third-party tracking cookies are used.

9. Security

Access to the application requires authentication. Two-factor authentication (MFA) is available to all members; an account that has enabled it must enter a code at every login. Communications are encrypted over HTTPS. Sensitive tokens are stored encrypted. The application applies the recommended HTTP security headers (HSTS, CSP, X-Frame-Options).