Privacy policy

1. Data controller

The data controller is [to be completed], [to be completed]. For any question or request: [to be completed].

2. What we don’t do

Nexpiria shows no ads, uses no analytics or advertising tracking tools, never sells or rents your data and doesn’t use it for profiling.

3. Data processed and purposes

Depending on how you use the service, we process:

• Website browsing: IP address, browser type, pages requested and timestamps, recorded by the hosting provider in technical logs to keep the service secure and running. Legal basis: legitimate interest.
• Account: email address, password (stored only in encrypted form by the authentication service), your chosen first name or nickname and, if you use it, the identifier provided by Google or Apple. Purpose: creating and securing your account. Legal basis: performance of the contract (terms of use).
• Deadlines, notes, household profiles, preferences and attachments: stored only in your browser’s local storage. They are not sent to our servers and we have no access to them.
• Contact requests: your email and message, to reply to you. Legal basis: legitimate interest.

4. Scanning and dictation

Document text recognition runs in your browser. To work, it downloads its engine and language data from the jsDelivr content delivery network, which receives your IP address in the process; the content of your documents is not sent.

Dictation uses your browser’s speech recognition service, which may send the recording to its provider (for example Google for Chrome). Camera and microphone access always requires your permission.

5. Retention periods

• Technical logs: 12 months maximum.
• Account: until it is deleted. Deletion is immediate; encrypted traces of any Google links are erased within 14 days.
• Local data: until you delete it in the app or clear your browser data. Items in the trash are erased after 30 days.
• Email exchanges: 3 years after the last contact.

6. Recipients and processors

Your data is only accessible to authorised staff of the publisher and to the following providers, bound by confidentiality commitments:

• Hostinger International Ltd.: hosting of the website and app.
• Supabase Inc.: authentication and account database.
• Google and Apple: only if you choose to sign in with these services.
• jsDelivr: delivery of the files needed for scanning.

7. Transfers outside the European Union

Some providers (Supabase, Google, Apple, jsDelivr) may process data outside the European Union, notably in the United States. These transfers are covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.

8. Security

The website is served over HTTPS only, passwords are never stored in plain text and access to account data is restricted by access rules. As no measure offers absolute security, please protect access to your device and export your data regularly.

9. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection, as well as the right to give instructions about what happens to your data after your death. You can export or delete your data directly in the app, or email [to be completed]. We respond within one month.

You may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris CEDEX 07, France, www.cnil.fr, or with your local supervisory authority.

10. Minors

Nexpiria is intended for people aged 15 or over. Below that age, consent from a holder of parental authority is required.

11. Changes

This policy may change. The update date appears at the top of the page; for significant changes, we’ll let you know in the app.