Privacy Policy

1. Who We Are

This Privacy Policy explains how Studio Quarante 5 Nord, registered in Bordeaux, France ("we", "us", "our"), collects, uses, and protects your personal data when you use Caylaconnect (the "Service").

We are the data controller for the personal data described in this policy.

2. What Data We Collect

We collect the following categories of personal data:

• Account data: name, email address, and login credentials.
• Health and wellness data: symptom logs, cycle tracking entries, journal entries, and menopause plan information you choose to record.
• Usage data: app interactions, feature usage, and device identifiers.
• Communication data: messages with coaches and community posts.
• Support data: customer support messages and inquiries.
• Technical data: IP address, browser type, and device information.

3. How We Use Your Data

We use your personal data for the following purposes:

• Account creation and management — to provide and maintain your account.
• Service provision — to deliver the features you use, including tracking, journaling, and coaching.
• Security and fraud prevention — to protect your account and our Service.
• Customer support — to respond to your questions and resolve issues.
• Product improvement — to understand how the Service is used and improve functionality.
• Legal compliance — to meet our legal obligations.

4. Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract performance — processing necessary to provide the Service you signed up for.
• Legitimate interests — for security, fraud prevention, and product improvement.
• Consent — where you have given explicit consent (e.g., for optional features).
• Legal obligation — where required by applicable law.

5. Data Sharing

We do not sell your personal data. We share it only with:

• Service providers — hosting, analytics, and support tooling providers who process data on our behalf under strict confidentiality agreements.
• Professional advisers — legal and accounting professionals where necessary.
• Authorities — where required by law or to protect our legal rights.

6. International Transfers

Your personal data is stored and processed within the European Economic Area (EEA). Where we use service providers outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions, to protect your data in accordance with GDPR requirements.

7. Data Retention

We retain your personal data for as long as necessary to provide the Service and fulfil the purposes described in this policy. When you delete your account or data, we will delete or anonymise your personal data within 30 days, except where we are required to retain it by law.

8. Your Rights

Under the GDPR, you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Restriction — request limitation of processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us through the Service. We will respond within one month. You also have the right to complain to the supervisory authority in your country.

9. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit and at rest, access controls, and regular security reviews. However, no system is completely secure, and we cannot guarantee absolute security.

10. Cookies and Tracking

We use essential cookies to operate the Service (e.g., authentication and session management). We may also use analytics cookies to understand how the Service is used. You can manage your cookie preferences through your browser settings. For more details, please see our cookie notice when you first visit the Service.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. The updated policy will indicate the effective date.

12. Contact

If you have questions about this Privacy Policy or how we handle your data, please contact us through the Service or at our registered address in Bordeaux, France.