1. Data controller
The controller of your personal data is Jérémy Aurélien BODIN, a sole trader (entrepreneur individuel, EI) trading as ARLOAD and publisher of the Evora service, whose business address is 41 rue Coëtquen, 22100 Dinan, France, registered with the French national business register (RNE) under SIREN number 944 753 979 (SIRET 944 753 979 00011).
You can write to us by post at our business address, or by email at [email protected] for general enquiries, or at [email protected] for anything relating to the protection of your personal data.
2. Data Protection Officer (DPO)
Evora has appointed a Data Protection Officer (DPO) whose role is to ensure compliance with applicable data protection law and to be your main point of contact for anything concerning your rights.
You can reach our DPO:
- By email: [email protected]
- By post: ARLOAD (Evora) — For the attention of the DPO, 41 rue Coëtquen, 22100 Dinan, France
The DPO undertakes to answer any request within one month at most (extendable by two months for complex requests, under Article 12(3) GDPR).
3. Purposes of processing
Your personal data is collected and processed for the following purposes:
3.1 Creating and managing your account
Allowing you to sign up, sign in, edit your profile and exercise your rights under the terms of service.
3.2 Discovering and joining events
Suggesting relevant events based on your location (with your consent), your interests and your usage history, and letting you sign up for an event run by a third party.
3.3 Communicating with organisers
Passing on to the organisers of the events you join only the information strictly needed (your identity, email, attendance) to perform the contract you enter into with them.
3.4 Payment and billing (organisers only)
Letting organisations subscribe or buy a single event through Stripe, and receive their invoices for accounting purposes.
3.5 Push notifications and transactional emails
Notifying you of things that matter (a day-before reminder, a message from the organiser, a friend request, a sign-up confirmation) by push notification (Apple APNs, Google FCM) or email (Brevo).
3.6 Product analytics (with your consent)
Measuring aggregate usage of the service to improve the app and fix defects (PostHog). You can withdraw this consent at any time from your My data page.
3.7 Sharing your location with friends (optional)
If you turn it on, your location is shared with the people you pick, one by one. It is never kept as a history: each reading overwrites the previous one, so there is no record of your movements — not for you, not for us, not for a legal request. A shared location expires automatically after 3 hours. Ghost mode stops the sharing immediately and erases the stored location.
3.8 Shared landmarks (optional)
You can save a place (a vehicle, a meeting point, whatever you like — the label is free text) and choose who to share it with. A landmark is private by default and you set its lifetime when you create it. A photo can be attached to it.
3.9 Signal — alerting your trusted contacts (optional)
A Signal alerts the people you chose in advance, sends them your location and lets you talk with them until you declare the situation closed. Unlike ordinary location sharing, the location sent within a Signal is kept for its whole duration: it is the record of what happened, for you and for the people close to you.
Evora contacts no emergency service and triggers no automatic escalation. A Signal alerts the people you picked, and them alone. In an emergency, call 112.
3.10 Security and fraud prevention
Detecting unauthorised access attempts, abusive behaviour (spam, harassment) and payment fraud. This processing rests on our legitimate interest in protecting our users and our service.
3.11 Legal compliance
Meeting our legal obligations (keeping invoices for 10 years, answering judicial requests, moderating content under the DSA).
4. Legal bases
Under Article 6 GDPR, each processing operation rests on a specific legal basis:
| Purpose | Legal basis |
|---|---|
| Account creation and management | Performance of the contract (Art. 6(1)(b) — terms of service) |
| Geolocation | Consent (Art. 6(1)(a)) |
| Location sharing with friends | Consent (Art. 6(1)(a)), withdrawable at any time |
| Shared landmarks | Consent (Art. 6(1)(a)) |
| Signal (trusted contacts) | Consent (Art. 6(1)(a)) |
| Signing up for an event | Performance of the contract (Art. 6(1)(b)) |
| Payment and billing | Performance of the contract (terms of sale) + legal obligation (Art. 6(1)(b) and 6(1)(c)) |
| Essential transactional notifications | Performance of the contract (Art. 6(1)(b)) |
| Product analytics | Consent (Art. 6(1)(a)) |
| Direct marketing (newsletter, offers) | Consent (Art. 6(1)(a)) |
| Personalised recommendations | Consent (Art. 6(1)(a)) |
| Security and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Accounting retention | Legal obligation (Art. 6(1)(c) — French Commercial Code) |
Consent can be withdrawn at any time from your My data page, without affecting the lawfulness of processing carried out before the withdrawal.
5. Categories of data collected
5.1 Identity data
Email address, password (hashed with bcrypt), first name, last name, date of birth, gender (optional), profile picture, cover picture, short bio. For OAuth sign-ups (Google, Apple, Facebook) we receive your provider identifier and your email address.
5.2 Location data
GPS coordinates (latitude/longitude) when you enable geolocation, and an approximate position based on your IP address when you do not. Precise geolocation is only collected with your explicit consent and can be revoked at any time from your device settings.
5.3 Shared location, landmarks and Signal data
Last known position (never kept as a history), the landmarks you create with their label, lifetime and optional photo, the list of your trusted contacts and — during a Signal — the location sent, the messages exchanged and the timestamps of opening, acknowledgement and closing.
5.4 Behavioural data
History of the events you viewed, the ones you joined, your favourites, your searches and the organisers you follow. This data feeds the recommendations on the Discover tab (with your consent).
5.5 Payment data (organisers only)
Stripe customer ID, partial IBAN (last 4 digits), invoice history. Full card numbers are never stored at Evora — they go through Stripe only (PCI-DSS Level 1).
5.6 Technical data
IP address, device type, operating-system version, app version, language, session identifier, push notification token (APNs/FCM).
5.7 Content data
Messages you post (questions about events, organiser announcements), photos you add to an event gallery, content reports.
6. Data recipients
Your data may be passed on to the following recipients:
6.1 Event organisers
When you sign up for an event, the organiser receives your identity (first name, last name, email and photo if available) and may contact you about that event. The organiser then acts as a separate controller and is bound to Evora by a Data Processing Agreement (see /legal/dpa).
6.2 Technical sub-processors
Evora relies on a short list of technical sub-processors, set out in full on the /legal/subprocessors page. Each one is bound by a processing agreement compliant with Article 28 GDPR (with EU Commission standard contractual clauses where relevant).
6.3 Public authorities
Where a binding judicial or administrative request is made, we may have to pass your data on to the competent authorities (police, gendarmerie, judicial authority). We only answer formally valid requests.
Evora never sells your personal data to third parties for commercial purposes.
7. Retention periods
| Data category | Retention period |
|---|---|
| Active account (profile, settings) | As long as the account is active |
| Inactive account (no sign-in) | Deletion notice after 3 years of inactivity, actual deletion 3 months later |
| Event history | 5 years after the event ends (proof of attendance) |
| Billing data (organisers) | 10 years from the issue of the invoice (accounting obligation, Art. L123-22 French Commercial Code) |
| Technical logs (IP, sessions) | 12 months at most (French LCEN, Art. 6.II) |
| Analytics data (PostHog) | 24 months at most |
| Unused sign-up OTPs | 24 hours |
| Location shared with friends | 3 hours after the last reading, then erased. No history: each reading overwrites the previous one |
| Shared landmark | The lifetime you set when creating it, then erased (photo included) |
| Organization story (photo or video, views, reactions, votes) | Public for 24 hours, then kept 30 days, visible to the organization alone (figures only, never who viewed or voted), then erased — unless a report is open |
| Closed Signal and its messages | 30 days after closing |
| Open Signal | Kept until it is closed — and you are the one who closes it |
| GDPR requests (audit trail) | 3 years (proof of handling) |
| Account deletion requested | 30-day grace period, then immediate anonymisation |
8. Your rights
Under Articles 15 to 22 GDPR, you have the following rights over your personal data:
8.1 Right of access (Art. 15)
You can obtain confirmation that Evora processes your data, and get a copy of it. To do so, go to My data.
8.2 Right to rectification (Art. 16)
You can correct any inaccurate or incomplete data about you, straight from your profile.
8.3 Right to erasure (Art. 17)
You can ask for your account and personal data to be deleted from My data › “Delete my account”. A 30-day grace period applies, during which signing back in cancels the request. After that, your data is irreversibly anonymised. Statutory retention obligations (invoicing, logs) still apply.
Can no longer sign in? The Delete your account page explains what to do, what is erased and what is kept.
8.4 Right to data portability (Art. 20)
You can receive a copy of your data in a structured, commonly used, machine-readable format (JSON + CSV in a ZIP archive). Request your export from My data › “Export my data”. You will get an email with a download link valid for 7 days.
8.5 Right to object (Art. 21)
You can object to certain optional processing (analytics, marketing, personalisation) without deleting your account, from My data › “Your consents”.
8.6 Right to restriction of processing (Art. 18)
You can ask for the processing of your data to be temporarily frozen (for instance while its accuracy is disputed) by contacting [email protected].
8.7 Post-mortem directives (French Data Protection Act, Art. 85)
You can set out directives on what happens to your data after your death by contacting the DPO. Failing that, your heirs may ask for your data to be deleted or disclosed.
8.8 Exercising your rights
Most rights can be exercised on your own from the app. For anything else, contact the DPO at [email protected]. We undertake to answer within one month at most.
9. Transfers outside the EU
Some of our technical sub-processors are based outside the European Union (mainly in the United States) or run a global infrastructure. Transfers to them are governed by:
- Standard Contractual Clauses approved by the European Commission (decision 2021/914) for Stripe Inc., Vercel Inc., PostHog Inc., Mapbox Inc., Apple Inc., Google LLC and Anthropic PBC (automated content moderation and aggregate statistical analysis; DPA with a zero-data-retention option).
- Data stored in the EU for Supabase (EU-Central-1 region, Frankfurt, Germany) and Brevo (France).
- Sovereign hosting in France for our N8N instance (OVH France).
The full list of sub-processors and where the data is located is available at /legal/subprocessors.
10. Sources of the data
Almost all of the data is collected directly from you when you sign up, build your profile and use the service.
When you sign up through OAuth (Google, Apple, Facebook), the OAuth providers send us your identifier and your email address. No further third-party data (friend list, photos, contacts) is retrieved.
11. Profiling and automated decisions
Evora uses limited profiling for the recommendation features on the Discover tab: the engine ranks events based on your interaction history, your location and the interests you declared.
No automated legal or contractual decision (Article 22 GDPR) is taken by Evora about you. Any account suspension or termination is reviewed by a human on our moderation team.
Automated moderation of published content. The images and texts you publish (events, stories, memories, profile photos, announcements, places) are analysed automatically by an artificial intelligence model (Anthropic, United States) to detect illegal content or content that breaks our rules. Content may be hidden automatically: you are told so with the reason, and you can appeal the decision for 6 months; the appeal is reviewed by a human (DSA, Articles 17 and 20). This analysis never suspends an account.
You can turn off personalised recommendations from My data › “Personalisation”.
12. Security
Evora implements appropriate technical and organisational measures to ensure a level of security matching the risk:
- TLS 1.3 encryption on every exchange between the client and our servers
- Encryption at rest for the Supabase databases (AES-256)
- Row Level Security (RLS) enabled on 100% of sensitive tables
- bcrypt hashing for passwords (never stored in plain text)
- Optional two-factor authentication (2FA) via TOTP
- Audit logs on every administrative action
- Automatic Supabase backups (7-day PITR in production)
- Secrets stored in Supabase Vault (encrypted)
- Strict HTTP security headers (CSP, HSTS, X-Frame-Options)
- Anonymised error monitoring through PostHog
- Mandatory code reviews before any production deployment
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we undertake to notify the CNIL within 72 hours (Article 33 GDPR) and, where required, to inform you personally (Article 34 GDPR).
14. Changes to this policy
Evora may amend this privacy policy at any time, in particular to reflect legal or technical changes. Where the change is substantial, we will tell you by email and through an in-app notification at least 30 days before it takes effect.
You can always read the version in force on this page. Earlier versions remain available on request from the DPO.
15. Complaint to the CNIL
If, after contacting us, you believe your data rights are not being respected, you can lodge a complaint with the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL):
- Online: https://www.cnil.fr/fr/plaintes
- By post: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
- By phone: +33 1 53 73 22 22