Who runs this site

Waterfalls.app is operated as a sole undertaking by Jérôme Bestel ("the operator", "we", "us"), reachable via the contact form. The application is a live, self-serve product at app.waterfalls.app, with its own in-app privacy notice.

What data we collect

We try to collect as little personal data as possible. The categories below cover everything the site processes:

  • Contact form submissions. When you fill in the contact form, we receive your name, email, and message. The form is processed by Formspark and forwarded to the operator's inbox.
  • Anti-spam verification. Forms are protected by Cloudflare Turnstile, which performs a privacy-preserving challenge to filter bots. Turnstile does not use cookies for tracking.
  • Server logs. The site is hosted on Cloudflare. Cloudflare retains standard request logs (IP address, user agent, request path, timestamp) for security and operational purposes.

We do not use behavioural analytics, ad-tracking pixels, or third-party advertising networks on the public website.

How we use your data

  • To respond to contact-form messages.
  • To send you product updates if you've explicitly opted in.
  • To detect, prevent, and respond to spam, fraud, and abuse.
  • To meet legal obligations where applicable.

Legal basis (GDPR / UK GDPR)

For users in the European Economic Area or United Kingdom, our legal basis for processing personal data is one of:

  • Consent: when you submit a form or opt into communications.
  • Legitimate interests: for site security, fraud prevention, and operational logging.
  • Contract performance: when processing is necessary to provide a service you've requested (e.g. responding to a contact-form message).

Sharing and processors

We don't sell personal data. We share it only with the third-party services we rely on to operate the site:

  • Cloudflare (hosting, CDN, anti-bot): receives request logs.
  • Formspark (contact-form processor): receives contact-form submissions.

Each of these is a recognized data processor with its own published privacy and security practices.

Data retention

Contact-form messages are retained in the operator's inbox indefinitely unless you ask for deletion. Cloudflare server logs follow Cloudflare's default retention.

Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, port, or restrict the processing of your personal data, and to object to certain processing. To exercise any of these rights, write to the operator via the contact form with the subject line "Privacy request" and we will respond within 30 days.

If you're in the EU/UK and unhappy with our response, you can lodge a complaint with your local supervisory authority.

Cookies

See the cookie policy for the full list of cookies and similar technologies used on the site.

Changes to this policy

We update this policy when our practices change. The "last updated" date at the top of the page reflects the most recent revision. Material changes will be reflected on this page.

Contact

For privacy questions or requests, reach out via the contact form or email the operator directly at the address listed there.