Privacy policy

Data controller

Olivier Filloux, publisher of Conviam, in a personal capacity. For any question or request about your data: contact@conviam.com.

The data processed

• Your account: name, email address, password (stored in a form that cannot be read back), profile photo if you add one, language, and two-factor authentication if you turn it on.
• Your sign-ins: the IP address and browser of each session, to protect your account.
• What you put in a moment: texts, messages, photos, videos, voice notes, schedule, places and addresses, replies to invitations, shared costs.
• A photo keeps the information your device wrote into it, sometimes including where it was taken, and its original can be downloaded by the people who have access to the moment. Remove the location before uploading a photo if you do not want to share it.
• Notifications, if you turn them on: the subscription address your browser provides, and the name of that browser and of your operating system (for example Chrome on Android).
• Security: counters tied to an IP address or an account limit repeated attempts. A report keeps its reason, its explanation, the account that made it and a copy of the reported message.

No audience measurement, no advertising, no profiling: your data is neither sold nor handed over.

To create an account, your name, your email address and a password are required: without them, the service cannot be provided to you. Everything else is optional, and a guest can reply without an account.

A person under 15 cannot consent alone to notifications, or to the processing of their allergies or of a menu that reveals a religious belief: the agreement of a holder of parental authority is also needed (French Data Protection Act, art. 45). What concerns an invited child is entered by the adult who replies for them, or by the organiser.

If you are a guest

The person organising a moment enters their guests' names themselves and, if they wish, their email address, menu and allergies, to prepare their moment. They must let you know, and the invitation email they send you, if any, says where your address came from and links to this page. A menu can reveal a religious belief, and allergies are health data: they must only enter them at your request. If an organiser has entered your email address, your account is linked to their moment when you sign in with that address, once it is verified.

When you reply, with or without an account, you can give, for yourself and for the people coming with you, a name, a menu and whether they are a child, and leave a message. The organiser sees all of this. Only name another person with their agreement.

A member can invite a person who has no account to chat, by entering their email address. That address is only used to send them this invitation, which says where the address came from and links to this page, on the basis of the member's legitimate interest in reaching someone close. It is erased as soon as the invitation is accepted, and at the latest when it expires, 7 days after it was sent.

To have what concerns you corrected or erased, ask the organiser, or write to contact@conviam.com.

Why, and on what basis

• Running the service (account, moments, invitations, replies, messages, photos) and sending the emails it involves (checking your address, forgotten password, invitations from an organiser, summaries): the performance of the service you use.
• Processing the guests' names, addresses and replies entered by an organiser: the legitimate interest of the organiser in preparing their moment, and of the guests in replying.
• Processing allergies, and a menu that reveals a religious belief: your explicit consent (GDPR, Art. 9(2)(a)), given to the organiser who enters them at your request, or by entering your menu yourself. You can withdraw it at any time by asking the organiser or us to erase them.
• Keeping the messages their recipients received, after their author's account is deleted: the legitimate interest of the recipients.
• Protecting the service, limiting abuse and handling reports: the legitimate interest of the publisher and of the users.
• Sending you push notifications: your consent, which you can withdraw at any time in your settings or in your browser.

Who has access

A moment's site, with its main information (for example its programme and its places), can be read without an account by anyone who has its address. Its photos, its chat and its guestbook are reserved for the people of the moment who have an account. If the organiser makes their moment public in its settings, its site can also show up in search engines.

The people of a moment see what is shared in it, according to the organiser's settings. The publisher only accesses it to run the service, protect it or handle a report. Providers process data on his behalf:

• OVH SAS (France): servers, database and contact mailboxes
• Scaleway SAS (France): storage of photos, videos and files, in the European Union
• Brevo (France): sending emails
• Google, Apple or Microsoft, depending on your browser: delivering push notifications, only if you turn them on

Outside the European Union

The data is hosted in the European Union. Push notifications, if you turn them on, go through your browser's service (Google, Apple or Microsoft), which may process them in the United States. Their content is encrypted: that service cannot read it. These three companies are certified under the EU-US Data Privacy Framework.

If you start content embedded in a moment (a YouTube or Vimeo video, Spotify or Deezer music, an OpenStreetMap or uMap map), that provider, which may be located outside the European Union, receives your IP address and applies its own policy. Nothing loads before you click. One exception: an image that an organiser inserts from another website in an HTML code block loads when the page is displayed, and that website then receives your IP address.

For how long

• Your account: for as long as it exists. During the beta, an inactive account is not deleted automatically. You can delete it at any time from your settings, unless you are the only organiser of a moment: you must then hand it over to someone or delete it first.
• When the account is deleted, your account, profile photo, sessions, preferences, notifications, push notification subscriptions, guestbook words and playlist suggestions are erased. The messages, photos and voice notes you sent in a chat stay with their recipients, signed with your first name only and detached from any account. The other photos you added to a moment stay there, with no author name, and your shared costs stay with the other participants, under your first name. The replies you gave to an organiser's invitation stay in their moment: ask them to erase them, or write to us. To object to any of this, write to us before deleting your account.
• Its author can delete a message within 15 minutes of sending it. After that, it stays with its recipients.
• A moment, its guests, their replies and its photos: until its organisers delete it. Deleting it erases its content. Its address (the moment's name in the URL) stays reserved for at least 2 years after it is deleted, so that nobody else can take it over.
• A sign-in session, with its IP address and browser: 30 days, extended for as long as you use the service. It is erased when you sign out or when it expires.
• Attempt counters tied to an IP address: erased no later than 24 hours after the last attempt.
• Notifications in the app: 90 days once read, and 180 days at most after their last update.
• A push notification subscription: erased after 12 months without a successful delivery.
• A report (reason, explanation, account that made it): kept with no time limit, to spot repeated abuse. The link to the account disappears when the account is deleted. The copy of the reported message is erased 6 months after the report is handled.
• The text of a removed message: erased 6 months after its removal, unless a report is open.
• A technical security log keeps, with no time limit and even after the account is deleted, the internal identifier of an account linked to certain changes (a role, a status), without a name or email address.
• If you refuse invitations to chat by email, a fingerprint of your address, from which it cannot be recovered, is kept with no time limit so that we send you no more.

Cookies and storage on your device

Conviam only uses cookies that it needs to work or that remember a choice you made. None is used for audience measurement or advertising: no consent is therefore asked for.

• __Secure-conviam.session_token: keeps you signed in (30 days).
• __Secure-conviam.two_factor: for the duration of two-factor authentication (10 minutes).
• conviam_locale: the language you chose (13 months).

Your browser also keeps on your device a copy of the pages and the uploads waiting to be sent, to work offline, as well as your refusal to install the app, if any. Signing out erases the kept pages and the messages waiting to be sent in your space; the pages kept by a moment's site are erased on your next visit to that site.

Your rights

You can ask for access to your data, its correction, its erasure, its portability or the restriction of its processing, and object to that processing. You can also withdraw your consent to notifications at any time, and give instructions on what happens to your data after your death.

Write to contact@conviam.com: you will get an answer within one month. You can also change your information and delete your account from your settings.

If you consider that your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority: cnil.fr.

Changes to this policy

This policy will change with the service, in particular at the end of the beta or when payments open. The version date, at the top of this page, shows when it was last updated.