Privacy policy
This document sets out what personal data is processed when you visit varec.bernik.io, why, and what rights you hold. It is written pursuant to articles 12 to 14 of Regulation (EU) 2016/679 (GDPR). The French version prevails in case of discrepancy.
1. In short
What remains is the technical minimum inherent to any website: your browser sends a request to a server, which briefly records it in order to function and to defend itself against abuse. Sections 5 to 7 set out the detail.
2. Scope
This policy covers the varec.bernik.io website and nothing else.
It does not cover:
- the VAREC application installed on your machine — its own processing (licence activation, cloud sharing features, diagnostic logs) is governed by the documentation and licence agreement supplied with it;
- third-party sites this site links to, notably GitHub and bernik.io, which apply their own policies.
3. Data controller
The data controller is BERNIK, a French single-member private limited company (EURL) with share capital of €100, registered with the Brest trade register under number 102 539 095, whose registered office is at 3 rue Simon, 29200 Brest, France.
For any question about this policy or to exercise your rights: contact@bernik.io.
Given the nature and volume of the processing described below, no data protection officer has been appointed: the conditions for mandatory appointment under article 37 GDPR are not met. The address above is the single point of contact.
4. No direct collection
The site has no form, no input field and no user account. You are never asked for an email address, a name, or any other information about you.
In particular, downloading VAREC is conditional on nothing. An earlier mechanism required an email address before unlocking the download; it has been removed and the corresponding data deleted (see section 15).
If you write to us at contact@bernik.io of your own accord, your message and address are processed in order to reply — that is the only case in which data reaches us through an act of yours.
5. Processing carried out
The table below lists every item of processing arising from your use of the site.
| Processing | Data | Purpose | Legal basis |
|---|---|---|---|
| Hosting logs | IP address, user agent, page requested, timestamp, response code | Serving pages, security, incident diagnosis | Legitimate interests — art. 6(1)(f) |
| Audience measurement | Page viewed, referrer, country, device type, a derived visit identifier not stored in clear | Measuring traffic in aggregate | Legitimate interests — art. 6(1)(f) |
| Requests to GitHub | IP address and user agent sent to GitHub | Delivering the installer, displaying the home page video and reading the list of published releases | Legitimate interests — art. 6(1)(f) |
| Correspondence | Email address, message content | Replying to your enquiry | Legitimate interests, or pre-contractual steps — art. 6(1)(f) and (b) |
None of this processing involves automated decision-making or profiling within the meaning of article 22 GDPR.
6. Audience measurement
Some pages use Vercel Web Analytics, the measurement tool built into our host. It has three characteristics, which is why you are shown no consent banner:
- it sets no cookie and writes nothing to your browser;
- it allows no cross-site tracking: measurement stops at the boundaries of varec.bernik.io;
- it does not retain your IP address: the address is used to derive a non-reversible visit identifier, renewed daily, which distinguishes two visits without ever identifying you.
Configured this way, the measurement falls within the consent exemption the French supervisory authority (CNIL) grants to audience measurement tools strictly limited to producing anonymous statistics for the publisher alone.
cdn.vercel-insights.com domain with a content blocker. The site remains fully functional either way.
8. Recipients
No data is sold, rented, exchanged or passed on for advertising purposes. The only third parties that come into contact with data are the technical providers the site needs to operate:
| Provider | Role | Country |
|---|---|---|
| Vercel Inc. | Site hosting and audience measurement | United States |
| GitHub, Inc. (Microsoft) | Distribution of installer files and the home page video, release listing | United States |
Data may also be disclosed to administrative or judicial authorities where the law so requires.
9. Transfers outside the European Union
Both providers above being established in the United States, using the site entails a transfer of data outside the European Union.
These transfers are governed by the appropriate safeguards of chapter V GDPR: participation in the EU–US Data Privacy Framework, found adequate by the European Commission's implementing decision of 10 July 2023, supplemented by standard contractual clauses in the data processing agreements concluded with each of them.
10. Retention periods
| Data | Period |
|---|---|
| Hosting logs | Kept by the host for a short operational period, not exceeding the customary one-year limit applicable to connection logs |
| Audience statistics | In aggregate form only; the visit identifier is not kept beyond the day |
| Email correspondence | For as long as needed to handle your enquiry, then archived as required to follow up, within a limit of three years from the last exchange |
11. Your rights
Under articles 15 to 22 GDPR you hold the following rights:
- Access — confirmation as to whether data about you is processed, and a copy of it;
- Rectification — correction of inaccurate data;
- Erasure — deletion of your data, subject to legal retention obligations;
- Restriction — suspension of processing while a challenge is examined;
- Objection — objection, on grounds relating to your particular situation, to processing based on legitimate interests;
- Portability — receipt in a structured format of the data you provided, where processing rests on consent or a contract;
- Post-mortem directives — instructions as to what becomes of your data after your death, under article 85 of the French Data Protection Act.
To exercise these rights, write to contact@bernik.io. You will receive a reply within one month of receipt of your request, extendable by two months where its complexity warrants — in which case you will be told.
12. Complaints
If, having contacted us, you consider your rights are not being respected, you may lodge a complaint with the French supervisory authority, or with the supervisory authority of your own country of residence:
CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr
13. Security
The site is served exclusively over HTTPS. It is static: it runs no server-side code and holds no database, which reduces the attack surface to a minimum. Installer files are distributed through GitHub Releases and signed in accordance with Apple's notarisation requirements.
14. Minors
VAREC is aimed at sound professionals. The site is not directed at children under fifteen and knowingly collects no data concerning them.
15. History — the collection mechanism that was removed
For the sake of transparency, and because people may have supplied their address under it:
Until 4 September 2026, downloading VAREC was preceded by a dialog requiring an email address, which was recorded together with the date, version and architecture downloaded.
That mechanism did not comply with the GDPR: making access to a free download conditional on data that was not necessary for that service deprived consent of its freely-given character, within the meaning of article 7(4) and recital 43. The information provided at the point of collection was also inadequate.
It has been removed in full: the dialog, the collection endpoint and the storage file are gone, and the recorded addresses have been deleted. No marketing will be sent on the basis of that list.
If you supplied your address this way and would like confirmation of its deletion, write to contact@bernik.io.
16. Changes
This policy may change, in particular if new site features come to involve new processing. The date of the last update appears below; any substantial change will be signalled on the home page.
Last updated: 4 September 2026.