Privacy Policy

Data Controller

Yoan Lapeyre, 34 Résidence la Portesienne, 31120 Portet-sur-Garonne, France — vhu31100@gmail.com.

Data We Process

• Account data: email address, password (hashed, never readable), preferences (language, time zone).
• Expense data: recurring expenses, due dates, categories.
• Debt and credit data: creditors, amounts, transactions, associated notes.
• Asset data: declared assets (name, category, value, optional purchase price), monthly net worth snapshots for history purposes.
• Organization: appointments, tasks, lists (including grocery lists), reminders, key dates, recipes, notes and projects.
• Income and financial information entered by you (no connection to your bank accounts).
• Digital Vault: the files you upload to it (stored with our hosting provider, never analyzed for commercial purposes).
• Vault face recognition, only if you turn it on: the position of each face in your photos, a small thumbnail of the face and its digital fingerprint (see “Face recognition” below).
• Mail: the mailboxes you connect (address, synchronized messages). Login credentials are encrypted. Your mail remains personal: other members of a shared space can never see it.
• Zély: your conversations with Zély and what she remembers in order to help you (memories that you can view and delete).
• Pro Plan: sales listings, websites, software and games created, domain names ordered (registrant contact details required by the registry).
• Shared spaces: name of the space, members and their roles, invitations sent (recipient’s email address).
• Support: messages exchanged with support, any attachments (images), suggestion box.
• Subscription data: Stripe status, renewal dates (no bank details).
• Technical data: connection logs, IP address, session identifiers.
• Proof of consent: IP address and browser associated with each acceptance of the Terms of Use/Terms of Sale, retained as evidence in the event of a dispute.
• Push subscriptions: notification endpoint, if enabled.
• Use of Zély and AI credits: usage (excluding the content of conversations) and credit purchases.
• AI images (Zély subscriptions): photos you upload for editing, your requests, and the images created. They are visible only to you.

Purposes and Legal Bases

• Provision of the service: performance of the subscription contract.
• Billing: performance of the contract and legal accounting obligations.
• Security and fraud prevention: legitimate interest.
• Reminder notifications: the user’s explicit consent.
• Support: performance of the contract / legitimate interest.

Artificial Intelligence

Zély first responds from our own servers in France: everyday answers (“What do I have today?”, “Add milk to the groceries”), reminders and suggestions do not transmit any data to third parties. This is the only mode of operation in the Free Plan.

With the Zély Essentiel and Zély Confort plans, open conversation with Zély and writing aids are processed by Claude, the model developed by Anthropic. Claude only receives the data necessary for a given request, through tools (for example, the relevant list), never the entire space and never your passwords. Zély only accesses the modules you authorize her to use (Settings › Zély). Anthropic acts as a processor; under its commercial terms, data transmitted via the API is not used to train its models. Creations (websites, software, games, with Zély Confort) are produced by the same means.

With the Zély Essentiel and Zély Confort plans, the Images module (and Zély, when you ask her for an image) sends your written request and, for an edit, the selected photo to Google’s Gemini API (paid tier), which creates the image; nothing is sent until you press “Create image.” Google acts as a processor: under its terms, it does not use this content to improve its products and retains it only in abuse-prevention logs, for a limited period; the exchange is not stored as a conversation by Google. Each image carries an invisible watermark (SynthID) and metadata indicating that it was generated by AI, and the label “AI-generated image” is displayed with it. Your photos and images remain in your Ecomely storage, visible only to you, until you delete them; a photo that is uploaded but never used is erased after 24 hours. Do not edit a photo of a person without their consent, and do not edit photos of children.

Voice dictation uses your browser’s speech recognition: depending on the browser, it may go through the browser’s publisher. The recognized text is always shown to you before it is sent.

Face recognition (Vault)

Face recognition is turned off by default. A member of a space can turn it on in the Vault after giving explicit consent. It then groups photos of the same person to create people folders and the albums you choose to share. Legal basis: your explicit consent, since a face fingerprint is biometric data.

• Data processed: for each face detected in a personal photo, its position, a thumbnail and a digital fingerprint (a series of numbers from which the photo cannot be reconstructed), and then the first name you give it. Protected documents, documents in the Wallet, documents with an expiry date and scanned documents are never analyzed.
• Where: on our servers in France, using open-source models run by Ecomely. No photo or fingerprint is ever sent to a third party, used for advertising or used to train a model.
• Who can see it: members of the space only. An album can be seen outside the space only if you share it through a link, which you can revoke at any time. Fingerprints never leave our servers.
• Retention: for as long as the feature is turned on. Permanently deleting a photo erases its faces. Turning off face recognition immediately erases all faces, fingerprints, thumbnails, first names and people albums in the space. Your photos themselves are kept.
• People in your photos: only turn on this feature for your personal photos and those of your family and friends, and respect their wishes (“Stop suggesting”, “That’s not them”). They can exercise their rights by contacting you or us.

Linky Meter (Enedis Data Connect)

If you link your Linky meter from the Energy module, you authorize Enedis, through your personal Enedis account, to transmit to Ecomely the metering data of your delivery point for the period you choose (one year by default, never more than three years). Enedis is responsible for collecting and transmitting this data; upon receipt, Yoan Lapeyre is responsible for its processing within Ecomely.

• Data received: daily consumption (up to 36 months of history), meter readings per time period, load curve at 30-minute intervals, maximum daily power, injected production (solar panels), subscribed power, tariff option, off-peak hours and meter type. No identity or contact data is requested.
• Sole purpose: to display your consumption and production, estimate their cost, alert you and compare electricity offers. Legal basis: your consent, collected by Enedis. This data is never sold, transferred or used for advertising purposes.
• Security: the delivery point number and the authorization identifier are encrypted; the credentials for your Enedis account never pass through Ecomely.
• Withdrawal: at any time from the Energy module (“Disconnect my meter”, with deletion of the readings if you wish) and from your personal Enedis account. Once the authorization ends, no further data is collected; readings already received are retained for as long as your account exists, unless you delete them.

Audience Measurement

We measure site traffic anonymously, without cookies or persistent identifiers: each visit generates a one-way identifier (IP address and browser combined with a salt that changes every day), which allows us to count unique visits over a single day without ever being able to link two visits by the same person from one day to the next. No IP address is stored in plain text. This measurement is used solely internally, to understand site traffic — never for advertising purposes, and never shared with any third party.

Advertising Cookies

The only third-party tracker is Google Ads, which measures whether our ads brought you to Ecomely. It applies only to public pages (never to your signed-in space), is loaded only after you give your consent in the banner, and you are asked for your choice again every 6 months. Refusing has no effect on your use of Ecomely. You may change your mind at any time:

Recipients

Your data is never sold. It may be shared with our technical processors strictly as necessary for the operation of the service:

• Stripe (payment processing, fraud prevention).
• Anthropic (Zély Essentiel and Confort subscriptions only, see “Artificial Intelligence”).
• Google (Gemini API: image creation and editing in the Images module, Zély Essentiel and Confort subscriptions only; see “Artificial Intelligence”).
• Google (Google Ads: measurement of advertising conversions on the site, only if you accept it in the cookie banner).
• Our hosting provider, OVH SAS (server, database and storage of Vault files).
• The email providers you connect yourself (Gmail, Outlook, Yahoo…), to synchronize your emails.
• Our transactional email provider, where applicable.

The content of your account (tasks, finances, files, messages…) is never used for advertising or commercial profiling purposes.

Retention Periods

Your data is retained for as long as your account exists. If your account is deleted, your personal data is deleted, including Vault files and your creations, except for data whose retention is required by law (e.g. billing data, for the applicable statutory period). Anonymous audience measurement data is automatically purged after 90 days.

Your Rights

In accordance with the GDPR, you have the right to access, rectify, erase, restrict, port and object to the processing of your data. You can export (complete file) or delete your data directly from your settings, or contact us at vhu31100@gmail.com. You also have the right to lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

Security

Ecomely implements appropriate technical measures (password encryption, secure sessions, encrypted mail credentials, hosting in France, access control in shared spaces) to protect your data. Pro creations are never executed on our servers.