01Our commitment
Budday handles sensitive data: conditions, allergies, measurements, weigh-in photos, mood logs. This data stays under your control, encrypted, hosted in France, never resold to a third party.
In 4 lines: strict GDPR, health data hosted in France (Azure France Central), encryption in transit (TLS 1.3) and at rest (AES-256), no reselling. You can export everything or delete everything at any time, without asking our permission.
02Data controller
The controller of your personal data is:
- Adrien Choquel, individual editor (natural person, company being incorporated)
- Postal address: provided on request
- General contact: contact@budday.app
- DPO contact: dpo@budday.app
03Data collected
We collect only what we need to run the app and keep our commitments. Here is the exhaustive list, by category:
| Category | Examples | Sensitive? |
|---|---|---|
| Identity | Email, first name, password (hashed) | No |
| Health profile | Conditions, allergies, intolerances, chosen diets | Yes (GDPR art. 9) |
| Measurements | Weight, height, waist circumference, body fat %, weigh-in photos | Yes |
| Sport profile | Level, equipment, off days, injuries | No |
| Cooking profile | Equipment, household, budget, typical week | No |
| App activity | Recipes viewed, sessions completed, meals validated, glucose readings logged | Yes |
| Technical logs | IP, user-agent, connection timestamps (anonymised after 30 days) | No |
At this stage (pre-launch waitlist phase), only the email is collected via the waitlist form. The rest applies to the app once launched.
04Purposes
For each data category we have defined a clear purpose. If a purpose does not appear here, we do not process your data for it.
- Waitlist enrolment: send you a launch invitation email with your "3 months Premium free" code.
- Personalisation: compose your menu, your groceries, your sessions calibrated on your health + sport profile.
- Tracking: display your trend charts (weight, measurements, glucose, sleep).
- Adaptation: adjust your plan based on context (weather, travel, dietary deviation).
- Security: prevent abuse, detect suspicious logins, protect your account.
- Support: answer your questions, handle bugs and help requests.
- Product improvement: aggregated, anonymised statistics on feature usage. No identifying data is used.
05Legal basis (GDPR art. 6 and 9)
| Processing | GDPR legal basis |
|---|---|
| Account creation + Free access | Contract performance (art. 6.1.b) |
| Health data (conditions, glucose…) | Explicit consent (art. 9.2.a) |
| Waitlist enrolment | Consent (art. 6.1.a) |
| Analytics + preferences cookies | Consent (art. 6.1.a) |
| Essential cookies (session, security) | Legitimate interest (art. 6.1.f) |
| Newsletter, marketing communications | Consent (art. 6.1.a), separate opt-in, revocable at any time |
06Retention
| Data type | Duration | After this period |
|---|---|---|
| Waitlist email | Until launch + 12 months | Deletion |
| Active account | As long as you use the app | N/A |
| Inactive account | 12 months after last login | Reactivation email, then deletion |
| Health profile after account deletion | Immediate, irreversible deletion | N/A |
| Billing data | 10 years (FR legal obligation) | Automatic deletion |
| Security logs | 12 months | Anonymisation then deletion |
| Analytics cookies (consented) | 13 months maximum | Automatic deletion |
07Sub-processors
Your data does not leave the Budday perimeter, except for the following sub-processors, all bound by a GDPR processing agreement (art. 28):
| Sub-processor | Service | Location |
|---|---|---|
| Microsoft Ireland Operations Limited | Application + database hosting | France (Azure France Central) |
| Google Ireland Limited | Audience measurement (Google Analytics 4), consent-gated | EU + US (SCC + DPF) |
| Microsoft Corporation | Usage analytics (Microsoft Clarity), consent-gated | EU + US (SCC + DPF) |
This list will be updated when we enter the transactional phase: at that point, we will add the sub-processors needed for payment processing, transactional emails and error monitoring. You will be notified by in-app notification and by an update to this document.
None of your health data leaves the Azure France Central region (France). The audience-measurement tools (Google Analytics, Microsoft Clarity) only process your browsing on the site, never your health data.
08Transfers outside the EU
Your application data (profile, health, content) is not transferred outside the EU. It is hosted in the European Economic Area (Azure France Central).
The only possible transfers concern the optional audience-measurement tools (Google Analytics, Microsoft Clarity), activated only with your consent: they may involve processing by Google LLC and Microsoft Corporation in the United States, governed by the Standard Contractual Clauses (SCCs) of the European Commission (decision 2021/914) and the EU-US Data Privacy Framework. If you decline the "audience measurement" category in the consent banner, none of these transfers occur.
09Your rights (GDPR art. 15-22)
Right of access
Get a copy of all data we hold about you, in a readable format.
Right of rectification
Correct any inaccurate or incomplete data about you.
Right to erasure
Request the permanent deletion of your account and all your data.
Right to portability
Retrieve your data in a structured, machine-readable format (JSON).
Right to restriction
Request the suspension of processing of your data.
Right to object
Object to the processing of your data on legitimate grounds (in particular marketing).
How to exercise your rights? Email to dpo@budday.app with a copy of an ID for verification. Reply within 30 days (GDPR art. 12), free of charge, never conditional.
You can also exercise most of these rights directly in the app settings: "Export my data", "Delete my account".
10DPO + CNIL recourse
Data Protection Officer (DPO)
Adrien Choquel has designated a Data Protection Officer to handle any GDPR question:
- Email: dpo@budday.app
CNIL recourse
If you believe the processing of your data violates regulations, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL):
- 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
- +33 (0)1 53 73 22 22
- www.cnil.fr · online complaint form
We'd prefer to talk first, write to us at dpo@budday.app, we commit to a human reply within 48 working hours.