Privacy Policy

Last updated: March 18, 2026 (GDPR-compliant version)

1. Data Controller

Publisher: Elevio

Contact email: mail@app-elevio.com

Domain: app-elevio.com

Data Protection Officer (DPO): mail@app-elevio.com

2. Personal Data Collected

A) Registration and authentication

Elevio only collects data strictly necessary for its operation:

• Email address — used for authentication via Supabase (account creation, login, password recovery).
• User identifier — unique technical ID automatically generated by Supabase to associate your data with your account.
• Daily tracking data — energy, mood, sleep, stress, physical activity, diet, expenses. This data is entered manually by you alone.
• Network data — personal contacts, private notes associated with your contacts, messages exchanged in your private groups.
• Directory data — places, books, movies, with your personal notes and impressions.

We do not collect any geolocation data, advertising identifiers, usage data for analytical purposes, or any data from other applications or sensors on your device.

B) Wellness and health data

• Daily entries: mood, energy, sleep, physical/mental health
• Trends: analysis of behavioral patterns over time
• Personal history: data accumulated since account creation

C) Network and contact data

• Trust network: identifiers of other added users (emails)
• Data sharing: data voluntarily shared with the network

D) Technical and usage data

• IP address (via Supabase server logs)
• Device type (iOS)
• App version
• Error logs (to improve stability)

3. Legal Basis for Processing

GDPR Article 6(1)(a) - Consent:

• The user explicitly consents to the collection and processing of their data upon registration
• This consent can be withdrawn at any time via the app settings

Processing of health data (Article 9 GDPR):

• Explicit user consent for processing sensitive data
• No automatic sharing with third parties (voluntary sharing only via trust network)

4. Purposes of Processing

• Account authentication and security
• Daily tracking functionality
• Trend analysis (algorithms on personal data)
• Trust network management (connections between users)
• User communication (support, important notifications)
• Service improvement (data anonymization for stability analysis)
• Legal compliance (retention for legal obligations)

5. Data Retention

• Active account — Duration of subscription — Necessary for service
• Email & password — Until account deletion — Authentication
• Daily entries — Until account deletion — User history
• Network data — Until account deletion — Trust network management
• Technical logs — 30 days max — Troubleshooting only
• Deleted data — Permanently deleted — Right to be forgotten

6. Data Recipients

No sharing with commercial third parties

• No sales to advertisers
• No sharing with marketing partners
• No data brokers

Technical partners (infrastructure only)

• Supabase (PostgreSQL) — Cloud database — All accounts & data — EU servers, encrypted
• Supabase Auth — Authentication — Email, password hash — Secure OAuth2
• AWS SES — Transactional emails — Email only — EU-North-1 servers

Data processing agreement: All providers have a DPA (Data Processing Agreement) in place.

7. Data Transfers Outside the EU

No transfers outside the EU

• Supabase: Servers in Europe
• AWS SES: Region eu-north-1 (Sweden)
• Data stored and processed in the EU only

8. Where is Your Data Stored?

• Supabase (infrastructure host, servers located in the European Union) — stores your email address, user identifier and synchronized data (network, directory).
• Local storage on your device (AsyncStorage / native iOS storage) — some daily tracking data is kept locally for quick offline access.

No data is transferred outside the European Economic Area.

9. Data Security

Technical measures:

• Encryption in transit: TLS 1.2+ (HTTPS)
• Encryption at rest: PostgreSQL encryption
• Authentication: OAuth2, secure JWT tokens
• Passwords: bcrypt hashing
• Local AsyncStorage: Minimal sensitive data

Organizational measures:

• Limited data access
• No logging of sensitive data
• Access audit logs
• Incident response plan

10. Your Rights

Right of access (Article 15 GDPR)

Request a complete copy of your personal data.

Procedure: Send request to mail@app-elevio.com

Right to rectification (Article 16 GDPR)

Correct your incomplete or inaccurate data.

Procedure: Use in-app settings or contact the DPO

Right to erasure (Article 17 GDPR)

Request permanent deletion of your account and data.

• Via app: Settings > Delete account
• Or written request to the DPO (mail@app-elevio.com)
• Permanent deletion within 30 days

Right to restriction of processing (Article 18 GDPR)

Request a temporary freeze on processing of your data.

Right to data portability (Article 20 GDPR)

Receive your data in a structured format and transfer it.

Format: JSON via user export

Right to object (Article 21 GDPR)

Object to the processing of personal data.

Rights related to automated decisions (Article 22 GDPR)

No fully automated decisions are made about your data.

11. Complaints to a Supervisory Authority

If you believe your rights are not being respected:

CNIL (France)

• 3 Place de Fontenoy, 75007 Paris
• www.cnil.fr
• plainte@cnil.fr

Local authority: Depending on your EU country of residence

12. Cookies and Tracking Technologies

• No third-party cookies for tracking/advertising
• Technical cookies only (session authentication)
• Local AsyncStorage for user preferences

13. Minimum Age Requirement

• Elevio is intended for users aged 16 and over
• For users aged 16-17: parental consent strongly recommended
• We do not intentionally collect data from minors without parental consent
• Immediate deletion if violation detected

14. Changes to This Policy

We may modify this policy to comply with legal developments or improve protection.

• Major change = email notification
• Minor change = in-app notification
• New version = archiving of the previous one

Effective: 15 days after notification

15. Contact and Exercise of Rights

16. Effective Date

Effective: March 18, 2026

Last updated: March 18, 2026