Privacy

Who is responsible for your data

The data controller is Information being finalised (test version), Information being finalised (test version) (SIREN Information being finalised (test version)). For any question about your data: support@dopalize.com.

What we collect

• Your account: first name, email address, password (stored only in an irreversibly encrypted form).
• Your check-in and daily answers: goal, rhythm of your day, regulators (sugar, coffee, alcohol, tobacco, screens), how you react to stress, whether you take a treatment and its times, hormonal axis if you share it, daily check-ins (energy, night, pressure), measurements, scan results, SOS button history, progress through the cycles. This is health data: see the Health data page.
• Your meal photos: they are sent for analysis and then immediately discarded. They are never saved on our side. Only the result (the foods recognized and the forecast) is kept.
• Your subscription: plan, dates, payment status. We never receive your card number, which stays with Stripe.
• Technical data: language, time zone, a device identifier for reminders, notification subscription, and a security log (type of action, date, an irreversible fingerprint of the IP address).

Why, and on what legal basis

We never sell your data, we don’t rent it, and we don’t use it for advertising.

• Providing the service you asked for (account, journey, scan, SOS, reminders, subscription): performance of the contract.
• Processing your health data to personalize your journey: your explicit consent, which you can withdraw at any time.
• Billing, handling refunds and meeting our accounting obligations: legal obligation.
• Securing the service and preventing fraud and abuse (scan limits, access log): legitimate interest.
• Measuring usage anonymously to improve the product (events with no content or answers): legitimate interest.

Who has access

Only the providers needed to run the service, within the limits of their role:

• Hostinger (hosting, servers in the European Union);
• Stripe (payment and invoicing);
• OpenAI (recognizing the foods in a meal photo: only the photo is sent, without your name or email, and Dopalize does not keep it);
• our email delivery provider (account, payment and reminder emails);
• the notification services of your browser or phone (Apple, Google, Mozilla…), if you turn reminders on.

Some of these providers may process data outside the European Union; in that case, the transfer is covered by the European Commission’s standard contractual clauses or an adequacy decision.

How long we keep your data

• As long as your account is active and your subscription is running.
• After a cancellation or the end of a subscription: 90 days, so you can pick up where you left off. After that, your account and all your data are deleted automatically.
• If you ask us to delete your account: immediately.
• Billing records are kept by our payment providers for the legal period (10 years for accounting documents).
• The security log is kept for a limited period of 12 months.

How we protect your data

• Encrypted connection (HTTPS) across the whole site.
• Health data is encrypted before it is written to the database (AES-256-GCM), with a key kept separate from the database.
• Hashed passwords, administration access reserved for authorized accounts, every administrative action logged.
• Health data never appears in technical logs.

Your rights

At any time you can access your data, correct it, erase it, restrict its processing, object to it, get it back in a readable format (portability) and withdraw your consent, without affecting what was done before.

• Export your data (JSON file): Settings > Your account > Download my data. Export remains possible even if your access is suspended for non-payment.
• Delete your account: Settings > Your account > Delete my account.
• Withdraw your consent to health data: Settings; the related answers are erased with your agreement withdrawn.
• Any other request: support@dopalize.com. We reply within one month at most.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

Cookies and trackers

Dopalize only uses strictly necessary cookies and storage: your login session, your language choice, a device identifier that enforces the free-scan limit, and a copy of your space on your device so it stays usable offline. No advertising cookies, no advertising trackers.

Minors

Dopalize is intended for people aged 18 and over.

Automated decisions

Energy-dip forecasts and scan suggestions are calculated by transparent rules from what you have told us. They produce no legal effect concerning you.

Changes to this page

If this policy changes in a significant way, we will tell you in the app or by email before it takes effect.