Last updated: 21 October 2026.
Who
Contre-budget is run by ITHappensLab OÜ, a company established in Estonia. For anything about your data, write to gaspar@ithappens.fr.
What is kept, and why
- Your email address, to sign you in and to tell your budgets apart from others'. There is no password.
- A sign-in link, valid for 30 minutes, then deleted.
- A session cookie, valid for 30 days, so you stay signed in, and the cookies the sign-in form needs (its protection token and where to land after signing in). No other cookie.
- Your budgets, their versions and the pages you publish. A published page is public by design: it shows the budget's title and the first line of its notes, never your address.
- For reviewers: the decisions they take on evidence cards, with their address, visible to the other reviewers.
- If you start a research: the text of your reform, its progress, the sources read and the card produced, attached to your account.
- Your IP address, kept in the server's memory for ten minutes to limit sign-in mail sends. It is not written anywhere.
What is not done
No analytics, no advertising, no tracker, no third-party script. Your address is used for the sign-in mail and for nothing else; it is passed on to no one.
Where
On a server rented from Hostinger in Frankfurt, Germany (European Union). Sign-in mails go through the mail service the site is configured with. The text of the reform and an opaque research identifier are sent to Anthropic (United States), the AI provider, when you start the research; its data policy: https://www.anthropic.com/legal/privacy.
How long
Until you delete your account ("My budgets", then "Delete my account"): your account, your budgets and your public pages are removed at once, in one operation. Review decisions you took as a reviewer are kept without your name. A card accepted by a reviewer stays in the shared catalogue, unlinked from your account; researches and unaccepted cards are deleted with the account. Database backups are kept for a limited time, then overwritten.
Your rights
Access, correction, deletion, portability, objection. The delete button covers deletion; for the rest, write to the address above. You may also complain to a supervisory authority: in France, the CNIL; in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon).