Privacy Policy
1. Data controller
The controller of your personal data is Paulin Laroche, sole proprietor (SIREN 494 088 677), 15 rue Lahire, 75013 Paris, France, reachable at paulin.laroche@mobile-concept.com. For any data protection matter: paulin.laroche@mobile-concept.com.
2. Data collected and purposes
VoxMap works without any account: no email address, no password, no sign-up. The data processed is: (a) an installation identifier — a random technical identifier generated on your device, not linked to your civil identity, yet personal data under the GDPR; it secures access to our servers, limits abuse and enables aggregate audience measurement; (b) attestation tokens (Apple App Attest, Google Play Integrity) proving requests come from a genuine app — for iOS, a public verification key is stored; (c) a technical subscription identifier (RevenueCat) used solely to verify a Premium subscription; (d) if you enable notifications, a technical token (FCM) assigned by Google/Apple to your device; (e) technical logs (IP address, user-agent, requests) for security and diagnostics, automatically purged after 7 days; (f) device model and app version. Your municipality, if you set one in Settings, is stored on your device only and never sent to our servers. What you browse (municipalities searched, results viewed) is not linked to any identity beyond the 7-day technical logs.
3. Legal basis
Processing relies on: (a) legitimate interest (Article 6.1.f GDPR) for security, abuse prevention and aggregate audience measurement; (b) your explicit consent (Article 6.1.a GDPR) for personalized advertising, collected through the consent form (Google UMP SDK) and, on iOS, App Tracking Transparency — revocable at any time; (c) contract performance (Article 6.1.b GDPR) for the Premium subscription.
4. Recipients
Your data is never sold to any third party. Technical processors, bound by contracts compliant with Article 28 GDPR, are: OVH (hosting, Strasbourg, France); Google AdMob (advertising, only after your consent); RevenueCat (subscription management); Apple and Google (app attestation, in-app purchases, notification delivery).
5. Transfers outside the EU
VoxMap's database and servers are hosted in France (OVH, Strasbourg). The use of AdMob, RevenueCat and Google/Apple notification services involves limited transfers to the United States, governed by the European Commission's Standard Contractual Clauses and, where applicable, the Data Privacy Framework.
6. Retention
Technical logs: 7 days (automatic purge). Installation data (identifier, attestation key, subscription identifier, notification token, preferences): kept while the app is in use, and deleted immediately via Settings → "Delete my data (GDPR)" or upon request. Legacy accounts (created before the account-free version of August 2026): kept to allow possible service reactivation; deleted upon simple request at voxmap.app/delete-account. Audience statistics: aggregate form only, with no identifier.
7. Your rights
In accordance with Articles 15 to 22 GDPR, you have the rights of access, rectification, erasure, portability, objection, restriction, and consent withdrawal. The most direct way: in the app, Settings → "Delete my data (GDPR)" immediately and permanently erases everything our servers know about your installation. You can also use the form at voxmap.app/delete-account (notably if the app is uninstalled, or for a legacy account) or write to paulin.laroche@mobile-concept.com. Response within one month at most. Note: on iOS the installation identifier lives in the system keychain, so uninstalling alone does not erase it — use the in-app deletion button; on Android, uninstalling regenerates this identifier.
8. Advertising and consent
The free version of VoxMap is funded by advertising (Google AdMob). No personalized advertising is displayed without your consent, collected at first launch through the dedicated form (UMP SDK) and, on iOS, the system tracking authorization (ATT). You can change or withdraw your consent at any time: Settings → "Manage my ad consent". The Premium subscription removes all advertising — and with it, all ad tracking. The app does not use cookies within the meaning of the ePrivacy regulation.
9. Security
Measures in place: HTTPS-only connections (Let's Encrypt certificates), app attestation (App Attest, Play Integrity) blocking non-genuine clients, short-lived access tokens with refresh token rotation, rate limiting per address and per installation, ISO 27001 certified OVH hosting, daily backups.
10. Data protection contact
Data protection contact: paulin.laroche@mobile-concept.com. Postal address: Paulin Laroche, 15 rue Lahire, 75013 Paris, France. Guaranteed response within one month to any legitimate request.
11. Complaint to the CNIL
If you believe your rights are not being respected or your data is processed unlawfully, you may lodge a complaint with the French supervisory authority (CNIL): cnil.fr/plaintes or by mail to CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
12. Changes to this policy
This policy may evolve. Any substantial change (new purpose, new recipient, etc.) will be announced in the app. The current version is available at voxmap.app/privacy with its last update date.
13. Push notifications
The app may send you push notifications, in categories you control individually in its settings: general announcements and news (consent — off by default or opted into at setup), election results and civic information (legitimate interest for a civic information app, can be disabled at any time). To deliver them, a technical identifier (FCM token) assigned by Google/Apple to your device is stored, linked to the installation identifier — never to an identity. It is deleted when you delete your data (Settings), when an uninstall is detected, or upon request. No notification content is shared with any third party for advertising purposes.
VoxMap · voxmap.app · Hosted by OVH (Strasbourg, France) · Data protection contact: paulin.laroche@mobile-concept.com