MaCompaney
Last updated: May 17, 2026
This Privacy Policy explains how MaCompaney ("we," "us," or "our") collects, uses, and protects your personal information when you use the MaCompaney mobile application (iOS and Android). MaCompaney is operated by Zoubair Alaoui, based in France, and is governed by the EU General Data Protection Regulation (GDPR) and applicable French data protection law. This policy applies to the MaCompaney mobile app only. A separate policy applies to our website macompaney.com.
The data controller for your personal information is MaCompaney, operated by Zoubair Alaoui, based in France. For all questions about your data, including to exercise your GDPR rights, contact privacy@macompaney.app.
When you create an account and use the App, you provide: account information (name, email address, phone number, optional profile photo); authentication credentials managed by Google Sign-In, Apple Sign-In, or password-based email authentication; contact information you add (first name, last name, phone number, email address, and optionally a physical mailing address for each contact); personal notes about contacts (descriptions, interests, profession, family members, hobbies, sports, retirement dates, or any other information you choose to record); life events you wish to share with contacts (births, travel plans, professional milestones, etc.); communication content (messages generated by the App and sent to your contacts on your behalf); and subscription information (payment status, subscription tier, renewal dates — we never see your full payment details).
When you use the App, we automatically collect: device information (device type, OS, app version, language, time zone); usage information (which features you use and how often, in aggregated and anonymized form via Firebase Analytics); crash reports (technical diagnostic information if the App crashes via Firebase Crashlytics — no contact data or message content); and push notification tokens (required to deliver reminders and alerts).
We do not collect your precise or approximate location, your browsing history outside the App, microphone audio (dictated notes are transcribed locally on your device and the audio is never uploaded), data about your contacts beyond what you explicitly enter, or health, financial, biometric, or other sensitive data categories under GDPR Article 9. We do not track you across other apps or websites.
We process your data only for the following purposes with the corresponding legal bases (GDPR Art. 6): creating and maintaining your account, storing contacts and notes, generating AI-personalized messages, sending messages on your behalf, processing subscription payments, and sending contact reminders (Contract — Art. 6(1)(b)); providing customer support and diagnosing crashes (Legitimate Interest — Art. 6(1)(f)); and complying with legal obligations such as tax records (Legal Obligation — Art. 6(1)(c)). We never use your data for advertising or marketing without your separate, explicit consent.
The App uses Anthropic's Claude AI service to generate personalized message drafts. When you request a message, the contact's name, your notes about them, and any relevant life event you have chosen to share are sent to Anthropic's Claude API solely to generate the draft. We never send the contact's email address, phone number, or physical address to Anthropic. The generated message is shown to you for review and sent only after you confirm. Anthropic processes this data as a subprocessor under their data processing terms and does not use it to train their AI models.
We share your data only with the following subprocessors under written data processing agreements: Google (Firebase) for authentication, database, storage, push notifications, crash reporting, and analytics; Google Sign-In for authentication; Apple for Sign-In, push notifications, and App Store payments; RevenueCat for subscription management; Anthropic for AI message generation (contact notes and life events only — no email/phone); and Resend for sending email messages on your behalf. We do not sell your personal data. We do not share your data with advertising networks or data brokers. For transfers outside the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. You may request a copy by contacting privacy@macompaney.app.
We retain your data only as long as necessary: account data for as long as your account is active plus 30 days after deletion; contact data and notes for as long as you keep them in the App; communication history for the lifetime of your account then deleted within 30 days of closure; subscription records for 10 years (French commercial law); crash reports and aggregated analytics anonymized and retained up to 90 days. You can delete your account at any time from Settings → Account → Delete Account. Deletion is permanent and removes all your personal data from active systems within 30 days.
If you are in the EEA, UK, or Switzerland, you have the right of access (Art. 15), rectification (Art. 16), erasure / "right to be forgotten" (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), to object to processing based on legitimate interests (Art. 21), to withdraw consent at any time (Art. 7(3)), and to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés) at www.cnil.fr (Art. 77). To exercise any of these rights, contact privacy@macompaney.app. We will respond within 30 days at no fee, unless your request is manifestly unfounded or excessive.
We implement appropriate technical and organizational measures: all data transferred between the App and our servers is encrypted using TLS 1.2 or higher; data stored in Firebase is encrypted with AES-256; only authorized personnel with a legitimate operational need can access user data; passwords are never stored in plain text — authentication is delegated to Google, Apple, or Firebase Auth; and we monitor for unauthorized access and security incidents. In the event of a personal data breach, we will notify the CNIL within 72 hours and, where required, notify affected users without undue delay (GDPR Art. 33 and 34).
MaCompaney is not directed at children under 16 years of age, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data without parental consent, please contact privacy@macompaney.app and we will delete the data.
When you add someone as a contact, you are responsible for ensuring you have a lawful basis under GDPR or applicable local law to store this information. For personal, family, or household purposes, this generally falls under the "personal or household activity" exemption (GDPR Art. 2(2)(c)). When MaCompaney sends an email to one of your contacts on your behalf, their email address is processed only to deliver the message and is not used for any other purpose. If a contact wishes to access, delete, or restrict data we hold about them, they may contact privacy@macompaney.app.
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date and notify you in the App, by email, or both if changes are material. Continued use of the App after a material change constitutes acceptance of the updated policy.
For any privacy-related questions, requests, or complaints: Email privacy@macompaney.app with subject line "Privacy Request". We respond within 30 days. You also have the right to contact the CNIL at www.cnil.fr.