Privacy Policy
This Privacy Policy explains how Kaught (published by Jeremy Lasne) collects and processes your personal data, in accordance with the GDPR (Regulation (EU) 2016/679) and the French Data Protection Act. The Terms of Use and Terms of Sale are covered separately in our Terms & Legal Notice.
1.Data controller
The data controller is Jeremy Lasne, individual entrepreneur (entreprise individuelle), France. For any question relating to your data, contact: hello@kaught.app. Given the scale of processing, no Data Protection Officer is required; data requests are handled at the same address.
2.Data we collect
| Category | Examples | Source |
|---|---|---|
| Account | email address, identifier, password (hashed), username | you |
| User Content | Capture photographs (stored on your device), associated metadata | you |
| Geolocation | approximate or precise location associated with a Capture (if enabled) | you / device |
| Collection & usage | species caught, identification history, in-app interactions | use of the Service |
| Technical data | device type, OS, app version, technical identifiers, logs, IP address | device |
| Purchases / subscription | subscription status, transaction identifiers (no bank data) | App Store / Google Play / RevenueCat |
| Diagnostics | crash reports, performance | device |
| Support | the content of your exchanges with support | you |
3.Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Account creation and management | Performance of contract (art. 6.1.b) |
| Animal identification and Collection management | Performance of contract (art. 6.1.b) |
| Display of Captures on the map / geolocation | Consent (art. 6.1.a) — optional feature |
| Subscription and purchase management | Performance of contract (art. 6.1.b); accounting obligations (art. 6.1.c) |
| Security, fraud and abuse prevention | Legitimate interest (art. 6.1.f) |
| Service improvement and diagnostics | Legitimate interest (art. 6.1.f) |
| Diagnostics / bug fixing | Legitimate interest (art. 6.1.f) |
| Service-related communications | Performance of contract / legitimate interest |
| Marketing (if applicable) | Consent (art. 6.1.a) |
4.Identification by artificial intelligence
The photographs you take are stored on your device and are sent to Google Cloud Vision (Google LLC, United States) to identify the species; we do not keep a copy of your photographs on our servers. We do not use your photographs to train models without your separate consent (see Terms §7.3).
5.Geolocation
Geolocation is optional and is only enabled with your consent (device system permission). You can disable it at any time in your device settings. Your Captures and their locations are private to your account and are not shared publicly with other users.
6.Recipients and processors
Your data is accessible to the Publisher’s authorised staff and to the following providers (processors), acting on instruction and under a contract compliant with Article 28 GDPR:
| Processor | Role | Location |
|---|---|---|
| Convex, Inc. | Application backend & database | United States |
| Apple Inc. | iOS distribution & in-app payment | United States |
| Google LLC | Android distribution & in-app payment | United States |
| Google LLC (Google Cloud Vision) | AI image identification | United States |
| RevenueCat, Inc. | Subscription management | United States |
Capture photographs are stored locally on your device, not on a third-party host, and we do not use third-party analytics SDKs. We do not sell your personal data.
7.Transfers outside the European Union
Some processors (notably Convex, Google — including Google Cloud Vision, to which your photos are sent for identification — Apple and RevenueCat) are located in the United States. These transfers are governed by appropriate safeguards: the European Commission’s standard contractual clauses and/or adherence to the EU–U.S. Data Privacy Framework where applicable, together with additional measures. A copy of the safeguards can be requested at hello@kaught.app.
8.Retention periods
| Data | Period |
|---|---|
| Account data | Lifetime of the Account, then deleted within 30 days (excluding temporary technical backups) |
| Photographs & Collection | Photographs stay on your device until you delete them; Collection metadata is kept until you delete it or your Account |
| Geolocation | Kept with the associated observation; deleted with it |
| Technical / security logs | Up to 12 months |
| Accounting data / invoices | 10 years (legal obligation) |
| Marketing data | 3 years after the last contact |
| Diagnostic reports | Up to 12 months |
9.Security
We implement appropriate technical and organisational measures (encryption in transit, access control, hashed passwords, logging). As no system is infallible, we cannot guarantee absolute security.
10.Your rights
In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, objection, portability, and the right to withdraw your consent at any time (without retroactive effect). You can exercise these rights at hello@kaught.app. You also have the right to lodge a complaint with the CNIL, the French data protection authority (cnil.fr). You can also delete your account at any time from within the app.
11.Minors
The Service is not intended for children under 15 without parental authorisation (see Terms §4.4). We do not knowingly collect data from minors in violation of applicable law.
13.Changes to this policy
We may modify this Privacy Policy. In the event of a substantial change, you will be informed by appropriate means. The last-updated date appears at the top of this document.
14.Contact
For any question: hello@kaught.app.
Kaught © Jeremy Lasne · Last updated June 23, 2026.