Privacy notice

Who is responsible

Dylan Merigaud EI, SIREN 834 511 768, entrepreneur individuel (sole proprietorship) registered in France, is the data controller. Its public record holds the registered address. For anything in this notice, reply to the email you received: a person answers.

This page

This page has no form, no account, no cookie and no analytics script. Cloudflare serves it and, like any web host, processes your IP address and browser details to deliver it (legitimate interest, Article 6(1)(f) GDPR).

If we wrote to you

Dylan Merigaud EI writes to businesses by email to offer files built from public records. Your name, job title, company and business email address come from public sources: USAspending.gov, first-tier subawards under Assistance Listing 97.008 (Nonprofit Security Grant Program), your company's own website and business directories. Some addresses come from the business contact databases Prospeo and Apollo.io. An address no source had verified is checked with an email verification service before a first message. We do not write to an address guessed from a naming pattern.

What we hold and why

Your name, job title, company, business email address and the result of its verification, your company's public details (website, location, and the public record that made it relevant), and the dates and content of the messages we exchanged. Legal basis: our legitimate interest in offering a business a file related to its activity (Article 6(1)(f) GDPR). If you buy, Stripe takes the payment and we receive your name, email, billing address, what you bought and the sum, to deliver the file and issue the invoice (the contract, Article 6(1)(b), and our legal obligation, Article 6(1)(c)).

Your right to object

You can object at any time, without giving a reason: reply to any of our messages. We stop writing to you and your address goes on our suppression list, which every later message is checked against.

How long

Your record is kept 3 years after our last contact with you, then deleted. If you object, we keep only your address on the suppression list, so that the objection holds. Invoices are kept as accounting law requires.

Who handles it for us

• Cloudflare, Inc.: serves this page (United States). Certified under the EU-US Data Privacy Framework, with standard contractual clauses.
• Google Cloud France SARL, relying on Google LLC: the Google Workspace mailboxes our messages leave from and replies arrive in (United States). Certified under the Data Privacy Framework, with standard contractual clauses.
• Databricks, Inc., which runs Neon: the database of our outreach records (United States). Certified under the Data Privacy Framework, with standard contractual clauses.
• ZenLeads Inc., doing business as Apollo.io: business contact data (United States). Certified under the Data Privacy Framework, with standard contractual clauses.
• Defastra Tech Inc., which runs Prospeo: business contact data (Canada). Canada is covered by an EU adequacy decision.
• Reoon Technology: checks that an email address exists; it receives the address alone and keeps the result 15 days. Not certified under the Data Privacy Framework and publishes no data processing terms.
• Stripe Payments Europe, Limited, relying on Stripe, LLC: card payments (Ireland and the United States). Certified under the Data Privacy Framework, with standard contractual clauses.
• GitHub, Inc.: a private backup of our records (United States). Certified under the Data Privacy Framework.
• OVH US LLC: the server that runs our tools, hosted in London (United Kingdom). The United Kingdom is covered by an EU adequacy decision.
• Anthropic: an AI assistant that helps us read replies and draft answers (United States). Used under its subscription terms, with no data processing agreement; not certified under the Data Privacy Framework.
• Telegram Messenger Inc.: a notification on our own phone when a reply asks for something (the Netherlands for European users). Not certified under the Data Privacy Framework.

Your rights

You may ask what we hold about you, have it corrected or deleted, restrict or object to its use, and receive a copy. Reply to the email you received. You may also complain to the French data protection authority, the CNIL (cnil.fr). The same answers are given wherever you live.

Nothing sold

We do not sell or rent the contact details of the people we write to, and we build no advertising profile.

Last updated

November 12, 2026.