Your data should move slowly too.

Data controller

DIGINOV, A 21, 36 rue Henri-Claude Lauth, 31400 Toulouse, France, is responsible for the processing described on this page.

Data we use

When a startup joins or receives a boost, ShellOut processes the submitted company name, website domain, selected category, purchase amount, trackside placement where selected, aggregate outbound-click count and the identifiers required to reconcile the Checkout Session, payment, invoice, tax calculation, refund or dispute with the ranking. Stripe separately collects the payer's email, legal or business name, billing address, tax identifier where provided and payment information.

To show the approximate number of startups currently watching the race, ShellOut temporarily processes a random browser-session identifier and its latest activity time. The identifier does not contain a company name, email address or account ID and is not used to build a profile. Cloudflare receives ordinary connection and security data when the site is visited. The page loads company favicons from Google's favicon service, which may expose connection data such as the visitor's IP address and browser information to Google. If a visitor accepts audience measurement, Google Analytics 4 receives online identifiers and usage information such as page views, page URL and title, browser or device characteristics, approximate location, engagement, scrolls and outbound clicks.

Purposes and legal bases

Checkout, invoicing and ranking

Steps requested before purchase and performance of the contract with the participating business.

Accounting and tax records

Compliance with DIGINOV's legal obligations.

Refunds and payment disputes

Performance of the contract, fraud prevention, and the establishment, exercise or defence of legal claims.

Displaying company information

Performance of the listing contract and the participant's requested public visibility.

Live presence counter

DIGINOV's legitimate interest in displaying an aggregate, short-lived indication of current activity on the race.

Security and abuse prevention

DIGINOV's legitimate interest in protecting the service and preventing fraudulent payments or attacks.

Audience measurement

The visitor's consent. Google Analytics remains fully blocked until analytics are accepted.

Cookies, analytics and advertising

The live presence counter does not set a cookie. It keeps a random token in the browser's session storage for the current tab and sends a lightweight activity signal while that tab is visible. The server retains only the token and latest activity time in memory, then automatically forgets inactive presence records after about one minute.

ShellOut uses Google Analytics 4 only after an affirmative choice in the privacy banner. The site uses the basic consent approach: no Analytics script, cookie or measurement request is loaded before acceptance. Advertising storage, ad user data, ad personalisation and Google signals are disabled. The choice is stored on the visitor's device and can be changed at any time using “Privacy choices” in the footer; withdrawing consent reloads the page and removes ShellOut's first-party Analytics cookies.

When a visitor follows a startup's direct website link, ShellOut increments that listing's aggregate click counter without setting a dedicated tracking cookie. The same random tab token is used to ignore repeated clicks on the same startup for about thirty minutes; that temporary deduplication record stays only in server memory. Stripe's hosted checkout operates under Stripe's own privacy and security documentation and may use strictly necessary technologies to process and secure payments.

Recipients, hosting and transfers

OVH SAS hosts ShellOut's origin website, ranking database and technical logs. Cloudflare provides DNS, delivery and security. Stripe processes Checkout, billing, tax, invoice, refund and dispute data. Google receives ordinary connection data when its favicon service is requested and, after consent, processes Google Analytics data. These providers may use approved subprocessors.

Stripe acts as a processor for certain services performed on DIGINOV's instructions and as an independent controller for activities such as financial compliance, fraud prevention and its own service improvement, as described in Stripe's documentation. Where a provider processes information outside the European Economic Area, the transfer is governed by the mechanism made available by that provider under applicable data-protection law.

Retention

Live presence records expire from server memory after about one minute of inactivity. Temporary click-deduplication records expire after about thirty minutes. Both reset whenever the service restarts. Public listing data remains active while ShellOut operates and the listing remains compliant. Payment reconciliation, invoice and accounting records are retained for the periods required by French law, which may reach ten years for supporting accounting documents. Refund, dispute, fraud-prevention and contractual-proof data may be retained for the period needed to establish, exercise or defend legal claims. Security logs are normally retained for up to 90 days unless an incident requires longer restricted retention. Stripe and Google apply their documented retention and deletion controls to data held in their systems.

Your rights

Depending on the processing, you may ask for access, correction, deletion, restriction or portability of your personal data, object to processing, or withdraw consent at any time. Some transaction data cannot be deleted before mandatory accounting or fraud-prevention periods expire. You may also lodge a complaint with the French data protection authority (CNIL) ↗.

Send privacy requests to [email protected].

External links

Clicking a company link takes you to an independent website with its own privacy practices. ShellOut does not control those websites.