Privacy policy

1. Data controller

The controller of the data described here is Inkat Studio, publisher of EventStock, 8B Avenue Anatole France, 94600 Choisy-le-Roi, France. For any question about your data: mosifoto@gmail.com.

This policy applies to the EventStock Android app, the web app (eventstock.app/app) and the eventstock.app website, together "the Service".

2. Data we process

Account: display name, email address, whether the address is confirmed, and the date and version of the terms of use you accepted. Your password is handled by Firebase Authentication and is never accessible to the publisher.

Organisation: the organisation you belong to, your role (administrator, coordinator or technician) and your membership status (pending, approved, refused).

Content: items, containers, locations, categories, loans, events, notes, and the photos you choose to save (item photos, photos taken when a loan goes out or comes back). A log of actions (author, action, date) is kept for each organisation.

Notifications: the device notification token (Firebase Cloud Messaging), used to send loan reminders.

Messages sent from "Contact / Feedback": subject, message, optional contact address and screenshot, app version and device model.

Technical data: crash reports (Firebase Crashlytics: error trace, device model, Android version, installation identifier) and usage statistics (Firebase Analytics: screens viewed, session length, app instance identifier, approximate country).

EventStock does not collect any advertising identifier, location or contacts. The camera is used only to scan codes and to take the photos you decide to save.

3. Purposes and legal bases

Providing the Service (creating and securing your account, confirming your email address, sharing the inventory between members of an organisation, managing roles, loan reminders): performance of the contract formed by the terms of use (GDPR Article 6(1)(b)).

Keeping proof that the terms were accepted, maintaining the action log and protecting the Service against misuse: legitimate interests of the publisher and of organisations (Article 6(1)(f)).

Fixing crashes and understanding how the app is used in order to improve it: the publisher's legitimate interest in maintaining a reliable service (Article 6(1)(f)).

Answering the messages you send: handling your request (Article 6(1)(b)). Analysing them to improve the app: the publisher's legitimate interest (Article 6(1)(f)).

No data is sold, rented, or used for advertising or profiling.

4. Data entered about third parties

An organisation may record the name of a person who has no account, such as the borrower of an item. The organisation decides what it enters: it takes care to record only what is necessary and to inform the people concerned. EventStock hosts and processes this information on its behalf.

5. Recipients

Within your organisation: members access the organisation's data according to their role. Administrators can see members' names, email addresses, roles and status.

The publisher: access limited to what is needed for support and maintenance of the Service.

Technical processors: Google (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, BigQuery, Cloud Messaging, Crashlytics, Analytics) and Vercel Inc. (hosting of the website and web app). The app is distributed through Google Play, whose own processing is governed by Google's privacy policy.

No other recipients, except where required by law.

6. Hosting location and transfers

The database (Cloud Firestore) and its backups are hosted in the European Union, in Paris (europe-west9 region). Server-side processing runs in Belgium for loan reminders (europe-west1 region) and in Paris for copying contact messages to BigQuery, a copy also hosted in Paris (europe-west9 region).

Some services — authentication, notifications, crash reports, statistics, web hosting — may process data in the United States. Crash reports and session data exported to BigQuery for analysis are stored there. These transfers are covered by the European Commission's standard contractual clauses and, for certified providers, by the EU–US Data Privacy Framework.

7. Retention periods

Account and profile: for as long as the account exists. They are deleted when you delete your account.

An organisation's content: for as long as the organisation is active. When its last member deletes their account, the organisation is deactivated and its data is no longer accessible; it is permanently deleted on simple request to mosifoto@gmail.com.

Action log: for the lifetime of the organisation. After an account is deleted, its entries only show a technical identifier.

Backups: 7 rolling days. Crash reports: 90 days. Usage statistics: 14 months at most.

Contact messages: 2 years, then deleted automatically, screenshot included; earlier on simple request. The copy used to analyse them (BigQuery) is kept for 7 days.

8. Security

Traffic is encrypted (HTTPS/TLS) and data is encrypted at rest by Google Cloud. Server-side access rules isolate each organisation: a user can only read their own organisation's data, according to their role. Deleting an account requires confirming the password. The database is backed up every day.

9. Your rights

You have the right to access, rectify and erase your data, to restrict its processing, to data portability, and to object to processing based on legitimate interests. Under French law, you may also set instructions regarding your data after your death.

You can change your name and email address in the app, and delete your account from Profile → Delete my account (see also the "Delete your account" page). For any other request, write to mosifoto@gmail.com from the address linked to your account: you will receive a reply within one month.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of your country.

10. Cookies and local storage

The website and web app use no advertising or audience-measurement cookies. They only store your language (NEXT_LOCALE cookie, 12 months), your light or dark theme and your sign-in session (browser local storage). These are strictly necessary for the Service to work and do not require consent.

11. Minors

EventStock is intended for professional or non-profit use. It is not intended for people under 15.

12. Changes

This policy may change as the Service or the regulations evolve. If a significant change is made, you will be informed in the app or by email. The date of the last update is shown below.