Privacy Policy — website
Last updated: 5 July 2026
Chut.App BV, a private limited company under Belgian law, BCE/VAT BE 1035.742.145, with registered office at Ballingstraat 116, 8560 Wevelgem, Belgium ("Chut", "we"), operates the marketing website www.chut.app. This Privacy Policy explains how we handle personal data collected through this website — namely the waitlist / contact form and website analytics — under the EU General Data Protection Regulation (GDPR) and the Belgian Act of 30 July 2018.
If you are a customer of the Chut product (app.chut.app), the processing of your business data is governed separately by your customer agreement and its Data Processing Agreement, provided to you directly — this website policy does not cover it.
1. Who is responsible
For personal data collected through this website, Chut.App BV is the data controller. You can reach our Data Protection Officer at dpo@chut.app.
2. Data we collect through this website
| Category | Data | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Waitlist / contact form | Name, email address, company name — when you choose to submit a form | Art. 6(1)(a) — consent |
| Audience measurement | Usage data (pages visited, traffic source, approximate location, device/browser) via Google Analytics 4 — only after consent | Art. 6(1)(a) — consent |
| Technical logs | IP address, request metadata, timestamps — generated when the site is served | Art. 6(1)(f) — legitimate interest (security and delivery of the site) |
We do not ask for, or process, any special-category data through this website.
3. Why we use it
- Respond to your request — when you join the waitlist or contact us, so we can get back to you and send you related updates about the product.
- Understand site usage — aggregate analytics to see which pages are useful and improve the site.
- Operate and secure the site — serve the pages, prevent abuse, keep the site available.
4. Where your data is stored
All hosting and processing for this website is located in the European Union.
| Data | Location |
|---|---|
| Website hosting and technical logs | EU — France (Scaleway S.A.S., fr-par region) |
| Waitlist / contact submissions | EU — France (Brevo / Sendinblue SAS) |
| Website analytics | EU — Ireland (Google Ireland Limited); any onward transfer to Google LLC (USA) is covered by the SCCs |
5. How long we keep it
| Category | Period |
|---|---|
| Waitlist / contact data | Until you unsubscribe or ask us to delete it, and in any case no longer than needed |
| Website analytics | Per the Google Analytics 4 retention setting (14 months) |
| Technical logs | Short-term, for security and troubleshooting |
6. Sub-processors
We rely on the following sub-processors to run this website. The full, up-to-date list is at /sub-processors.
| Sub-processor | Purpose | Location |
|---|---|---|
| Scaleway S.A.S. | Website hosting (Object Storage + Edge Services) | EU — France (Paris / fr-par) |
| Google Ireland Limited | Website analytics (Google Tag Manager + Google Analytics 4) | EU — Ireland (with SCCs for onward transfers) |
| Brevo (Sendinblue SAS) | Waitlist / lead capture | EU — France |
7. Cookies
We use two categories of cookies on this website:
| Category | Purpose | Legal basis | Consent required |
|---|---|---|---|
| Essential | Remembering your cookie choice and language preference. | Art. 6(1)(f) GDPR — legitimate interest; ePrivacy art. 5(3) — strictly necessary | No |
| Audience measurement | Google Analytics 4 via Google Tag Manager, to understand site usage (pages visited, traffic sources, performance). | Art. 6(1)(a) GDPR — consent | Yes |
Audience-measurement cookies are only set after your explicit consent via the cookie banner. Until then, Google's Consent Mode v2 stays on denied for all four signals (analytics_storage, ad_storage, ad_user_data, ad_personalization) and no identifier is transmitted. You can withdraw consent at any time via the "Manage cookies" link in the footer.
We do not display advertising on the site and we do not run remarketing campaigns. When you accept cookies we enable Google's ad-measurement signals so that, if we later run Google Ads campaigns to drive traffic here, Google can correctly attribute conversions. Your data is never sold to advertisers.
7.1 Detailed cookie inventory
| Name | Domain | Type | Duration | Purpose | Category |
|---|---|---|---|---|---|
chut.cookies.v1 | www.chut.app | localStorage (browser side) | Persistent (until manually cleared) | Stores your cookie-banner choice ("granted" or "denied"). | Essential |
_ga | .chut.app | HTTP (1st-party) | 2 years | Anonymous user identifier for Google Analytics 4. Set only after consent. | Audience measurement |
_ga_TVHD33QP | .chut.app | HTTP (1st-party) | 2 years | GA4 session state for container GTM-TVHD33QP. Set only after consent. | Audience measurement |
If the Google Tag Manager container (GTM-TVHD33QP) is extended with additional tags in the future, this list will be updated before activation and you will be asked to confirm your consent again.
8. Your rights (GDPR)
Over the personal data we hold about you from this website, you have the following rights. To exercise any of them, email our DPO at dpo@chut.app.
| Right | GDPR article |
|---|---|
| Access | Art. 15 |
| Rectification | Art. 16 |
| Erasure | Art. 17 |
| Restriction of processing | Art. 18 |
| Portability | Art. 20 |
| Objection | Art. 21 |
| Withdraw consent | Art. 7(3) |
9. Contact
For any question about the protection of your data, contact our Data Protection Officer (DPO):
- Email: dpo@chut.app
You also have the right to lodge a complaint with the Belgian Data Protection Authority (APD / GBA):
- Rue de la Presse 35, 1000 Brussels
- Website: www.dataprotectionauthority.be
- Phone: +32 (0)2 274 48 00
- Email: contact@apd-gba.be
10. Change log
| Date | Change |
|---|---|
| 5 July 2026 | Scoped this policy to the Chut marketing website (chut.app): waitlist / contact form and website analytics. Processing of Chut product (app.chut.app) data is governed by the customer agreement and its DPA. |
| 11 May 2026 | Detailed cookie inventory added (section 7.1). All four Consent Mode v2 signals flip together on Accept / Reject. |
| 9 May 2026 | Google Ireland Limited added for website analytics. Cookie section rewritten to a two-tier model with a consent banner. |
| 7 February 2026 | Initial publication. |