Privacy Policy

Effective: [launch date]

This policy explains what personal information Luc Bequette ("I", "me") collects through lucbequette.com and flights.lucbequette.com, why, who helps process it, and your choices. I'm an individual based in California.

1. What I collect

• – Email address at checkout. Used to create your order, send your download links (and Stripe's receipt), and let you request a re-send.
• – Payment details. Entered directly into Stripe's secure form. I never see or store your card number. Stripe tells me the payment result, amount, and the email you gave.
• – Stripe and Cloudflare scripts on shop pages. Stripe.js (which shows the Apple Pay, Google Pay and Link buttons and the card form) loads on the product and cart pages, as well as at checkout. Cloudflare Turnstile (an invisible bot check) runs when the product and cart pages load, not only at checkout. When you open those pages, Stripe and Cloudflare receive your IP address and basic browser details.
• – Wallet payments. If you pay with Apple Pay, Google Pay or Link, the wallet shares your email address with me so I can send your download links and receipt. I only ask the wallet for your email.
• – Order emails. Stripe may send you a receipt to the email you provide. We use Resend to send your download links from shop@lucbequette.com.
• – Download links. After purchase you get links containing a signed, expiring code tied to your order. Files are stored privately and served through a short-lived link.
• – IP address. Read briefly to limit abuse (for example, too many checkout or re-send attempts) and, when enabled, passed to Cloudflare Turnstile for bot checks.
• – Contact form. The contact form collects your first name, last name, email, and message, used only to reply. It's delivered by Resend to me at contact@lucbequette.com, with your email set as the reply-to address. It's protected by Cloudflare Turnstile (your browser's check token and your IP are sent to Cloudflare) and rate-limited by IP using Upstash. Email to contact@lucbequette.com is used only to reply.
• – Analytics. Vercel Web Analytics records anonymous page views (page, referrer, browser/device type, country) without cookies.
• – Cart. Your cart is saved in your own browser (local storage), not on my servers.

I do not collect phone numbers or mailing addresses.

2. Who processes it (service providers)

These providers process data on my behalf under their own terms and privacy policies.

3. How long I keep it

• – Email download links: expire after 24 hours. Links on the purchase confirmation page expire after 1 hour. The file link itself lasts 5 minutes.
• – Re-downloads: you can request new links for 30 days after purchase, up to 5 times.
• – Order records (email, amount, product) in Stripe: kept as long as needed for taxes, refunds, and disputes. Stripe also keeps records under its own policy.
• – Rate-limit records (IP, email): up to 1 hour.
• – Hosting logs: kept by Vercel for a limited period set by its hosting plan.
• – Contact-form messages and emails to contact@ and hello@: kept as long as needed to respond.

4. Selling and sharing

I do not sell your personal information and I do not "share" it for cross-context behavioral advertising. I don't use advertising cookies or trackers.

5. Your California privacy rights (CCPA/CPRA)

You may ask to:

• – Know what personal information I have about you and how it's used.
• – Delete it (some order records must be kept for legal and tax reasons).
• – Correct inaccurate information.
• – Opt out of sale or sharing — not applicable, since I do neither.
• – Limit use of sensitive personal information — I don't collect any.

To make a request, email contact@lucbequette.com with the email you used. I'll verify by confirming through that address, and respond within 45 days. An authorized agent may request on your behalf with your written permission. I won't treat you differently or charge you more for using these rights.

6. Cookies and local storage

• – lucbequette.com sets no cookies of its own. Your cart is kept in local storage (lbq-cart-v1); clear it anytime in your browser.
• – Stripe (checkout) and Cloudflare Turnstile may set their own cookies for fraud and bot prevention.
• – Vercel Web Analytics does not use cookies.

7. Children

The site isn't directed to children under 13, and I don't knowingly collect their information. If you believe a child has given me information, email me and I'll delete it.

8. Security

Payments go through Stripe; download links are signed and expire; files are stored privately; the site uses HTTPS and security headers. No system is perfectly secure, but I work to protect your information.

9. Changes

I'll post updates here with a new effective date. Significant changes will be noted on this page.

10. Contact

Luc Bequette — email me at contact@lucbequette.com for privacy and legal requests (access, correction, and deletion questions).

Addendum: flights.lucbequette.com (Reward Flight Finder)

• – No account, no personal details. The finder doesn't ask for your name or email.
• – Searches. Flight search details (origin, destination, dates, stops, cabin class) are sent to SerpAPI to fetch Google Flights prices. Your IP isn't passed to SerpAPI by the app.
• – Maps. Map tiles load from Stadia Maps (tiles.stadiamaps.com); your browser connects directly, so Stadia Maps sees your IP and the map area viewed.
• – City photos. Fetched from Wikipedia/Wikimedia; images load in your browser from Wikimedia's servers, which see your IP.
• – Bot protection. We use Vercel BotID, which runs a check in your browser to keep automated scrapers out.
• – Analytics. The finder uses no analytics.
• – Rate limiting. We use Upstash to limit abuse by IP (see main policy).
• – Hosting. Vercel (request logs, as above).