Privacy policy

1. Who are we?

CHAINIT, a société par actions simplifiée unipersonnelle (SASU) whose registered office is at 5 rue Alphonse Haussaire, 95880 Enghien-les-Bains, France, registered with the Pontoise Trade and Companies Register under number 831 544 168 (establishment SIRET 831 544 168 00022, VAT number FR96831544168), is the controller of the personal data collected through the Farygo application and the www.farygo.com website (together, the "Application").

Legal representative: the President of the company.

Data protection contact: privacy@farygo.com

CHAINIT has not appointed a data protection officer (DPO): none of the three mandatory cases listed in Article 37 GDPR applies — the Publisher is not a public body, its core activity does not consist of regular and systematic monitoring of data subjects on a large scale, and it does not process special categories of data on a large scale. Data-related requests are handled at the address above.

2. What data do we collect?

No special categories of data within the meaning of Article 9 GDPR (health, origin, opinions, sexual orientation, etc.) are collected.

No banking data is collected or stored by CHAINIT. Subscriptions are paid either on the web, through Stripe, or in the mobile application, through Apple's App Store or Google's Play Store. Card numbers, security codes and bank details are entered directly with those providers and never pass through our servers: we receive only the payment status, the plan purchased and a customer identifier.

No solely automated decision-making producing legal effects or similarly significantly affecting you within the meaning of Article 22 GDPR takes place. Price alerts result from an automated calculation, but they are information only: they decide nothing on your behalf.

The Application is not intended for children under 15 and is not designed for them. If you become aware that an account has been created by a child under 15 without the consent of the holder of parental responsibility, write to privacy@farygo.com: the account and the associated data will be deleted.

3. On what legal basis do we process your data?

• Performance of a contract (Article 6(1)(b) GDPR) — account creation and management, monitoring of tracked routes, sending of alerts, management and billing of the paid subscription.
• Consent (Article 6(1)(a)) — marketing communications, non-essential cookies and trackers, and registration of a phone number for SMS verification. Consent to marketing communications is asked at sign-up, through a box separate from acceptance of the Terms and never pre-ticked: refusing it does not prevent you from creating an account. It can be withdrawn at any time from “Account” › “Notifications”, and your price alerts and service messages (account, billing, security) keep being sent — they are not marketing communications. That consent is freely given, specific, informed, unambiguous and may be withdrawn at any time, without affecting the lawfulness of processing already carried out.
• Legitimate interests (Article 6(1)(f)) — security of the Application, prevention of fraud and abuse, audience measurement and service improvement based on aggregate statistics. These operations are limited to what is necessary and you may object to them (section 7).
• Legal obligation (Article 6(1)(c)) — retention of accounting records and invoices relating to paid subscriptions.

4. Who has access to your data?

Your data is accessible:

• to CHAINIT staff, strictly within the scope of their duties;
• to our processors, listed below, who act only on CHAINIT's documented instructions and are bound by a processing agreement compliant with Article 28 GDPR.

Your data may also be disclosed to administrative or judicial authorities where the law requires it.

We never sell your data and never rent it to anyone. No data is passed to third parties for advertising purposes.

5. Where is your data hosted?

Data is hosted on Amazon Web Services infrastructure, in the `us-east-1` region (Northern Virginia, United States). It is therefore transferred outside the European Union.

That transfer is covered by the standard contractual clauses adopted by the European Commission on 4 June 2021, incorporated by operation of the AWS GDPR Data Processing Addendum that applies to all AWS customers. Amazon Web Services is further certified under the EU-U.S. Data Privacy Framework, whose adequacy the European Commission recognised by decision of 10 July 2023: the transfer therefore rests on an adequacy finding, with the standard contractual clauses applying in the alternative.

In line with the Schrems II judgment, we have assessed the impact of this transfer. The factors taken into account are: the transferred data is limited to that described in section 2, excluding any special categories and any banking data; it is encrypted in transit and at rest, with keys managed in the AWS key management service; access is restricted by authentication controls and logged; AWS publishes a half-yearly transparency report on government requests and contractually undertakes to challenge unlawful requests and to notify the customer unless legally prohibited. Given the nature of the data involved, those safeguards were assessed as sufficient.

This assessment is reviewed whenever the infrastructure or the applicable legal framework changes significantly. Migration to a European Union region remains possible; it would change neither the purposes, nor the retention periods, nor your rights.

6. How long do we keep your data?

Once those periods expire, the data is deleted or irreversibly anonymised.

7. What are your rights?

Under the GDPR, you have the following rights:

• Right of access — obtain confirmation that your data is processed and receive a copy of it;
• Right to rectification — have inaccurate or incomplete data corrected;
• Right to erasure — request deletion of your account and your data (see section 8);
• Right to restriction — request that processing be frozen while a challenge is examined;
• Right to data portability — receive the data you provided to us in a structured, commonly used and machine-readable format;
• Right to object — object at any time to processing based on legitimate interests, and to direct marketing;
• Right to withdraw consent — at any time, for processing that relies on it, without affecting the lawfulness of earlier processing;
• Right to give directions as to what happens to your data after your death, under Article 85 of the French Data Protection Act;
• Right to lodge a complaint with the French supervisory authority — CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

Most of these rights can be exercised directly from the Application's settings (data export, account deletion, consent management) or by writing to privacy@farygo.com. We reply within one month of receiving the request; that period may be extended by two months for complex requests, in which case you will be informed. Proof of identity will be requested only where there is reasonable doubt as to the requester's identity.

8. How do you delete your account?

You may request deletion of your account at any time from the Application's settings. It takes effect within 30 days at most, including technical backups. Data strictly necessary to comply with a legal obligation — invoices in particular — is retained until the end of the applicable statutory period, to the exclusion of any other use; everything else is deleted or anonymised.

Deleting your account does not cancel a subscription purchased in the App Store or the Play Store: those subscriptions are cancelled from the settings of the store concerned.

9. Cookies and trackers

The website displays a consent banner on the first visit, before any non-essential storage or reading. A single optional purpose is presented — audience measurement, which includes where your visit came from, campaign included where the link carried that marker. Nothing is pre-ticked, refusing is as easy as accepting, and no answer means refusal. Your choice can be changed at any time from the "Manage my cookies" link present on every page, and it is kept for six months.

Our audience measurement uses no cookie and keeps no identifier on your device: it falls under the exemption set out in CNIL decision no. 2020-091. We ask for your agreement nonetheless, and it does not start without it.

Cookies strictly necessary for the service to work — session, authentication, security, storing your consent choice — do not require prior consent under Article 82 of the French Data Protection Act.

Details of the trackers, their purposes and their lifetimes are set out in the [cookie policy](/en/cookies).

10. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss and disclosure: password hashing, encryption of data at rest and of communications in transit, access segregation on a least-privilege basis, administrator authentication, access logging, regular backups, and collection limited to what is strictly necessary.

11. Data breach

Where a data breach is likely to result in a risk to your rights and freedoms, we notify the CNIL within 72 hours of becoming aware of it, under Article 33 GDPR. Where the breach is likely to result in a high risk, we inform you individually without undue delay, under Article 34.

12. Changes to this policy

This policy may be updated to reflect changes to the service or to the law. The version in force is the one published on this page, identified by its version number and date. Any substantial change will be notified to you by email or by an in-app notification and, where the law requires it, your consent will be sought again.

13. Contact

For any question about this policy or the exercise of your rights:

CHAINIT — Farygo 5 rue Alphonse Haussaire, 95880 Enghien-les-Bains, France privacy@farygo.com