GDPR privacy policy

1. Controller and contact

The platform’s data controller is NOWAK MARCIN, entrepreneur individuel, SIREN 947 601 746, 36 avenue de la République, 93140 Bondy, France. Data enquiries: support@alagaya.com. Accounts are restricted to people aged 18 or over; the adult declaration alone requires neither a date of birth nor a copy of an identity document.

2. Data and sources

Depending on the functions used, we process account and login data, profile and avatar, chosen city or location, CVs, listings, applications and invitations, declared professional status, availability, bookings, options and private address needed for a service, messages, notifications and associated tokens, granted credits and promotions, reports and blocks, privacy choices and proof of Terms acceptance, and technical security logs. Data comes from you, your contacts and, if chosen on a compatible platform, your login provider. Necessary fields are identified when collected; without them the relevant function may be unavailable. Other fields are optional. You can enter a city without enabling GPS. Do not send unnecessary sensitive data or identity documents.

3. Purposes and legal bases

Accounts, publications, applications, messages, bookings and other requested operations rely on performance of the contract or pre-contract steps at your request, to the extent objectively necessary. Security, proportionate fraud and abuse prevention, moderation and defence of rights rely on legitimate interests after balancing. Legal obligation is used only where applicable, including responding to competent authorities. Optional functions requiring consent use a separate, revocable choice, including the translation options identified at the time of choice. Refusing one option does not refuse unrelated functions. Device permission does not authorise all processing; service notifications are not permission for marketing.

4. Visibility and recipients

Listings and profile elements marked public are accessible to visitors. Availability becomes public only through the relevant option. CVs are shared with relevant recruiters when applying or accepting the relevant invitation, without general access to every CV. Messages, private service addresses and bookings are accessible to participants and authorised people strictly for operation, security or assistance. Recipient users, including recruiters and providers, have their own duties. Hiding a message for yourself does not necessarily erase another participant’s copy. Moderation access is restricted to authorised people; the application does not promise end-to-end encryption.

5. Providers and transfers

Cloudflare provides the website, API and Workers AI; Supabase provides authentication, database, realtime and file storage. Account transactional emails are routed through Resend and its Amazon SES infrastructure. The support@alagaya.com contact uses Cloudflare email routing to the publisher’s Gmail mailbox provided by Google; this is not a claim of a Google Workspace agreement. Expo, Apple APNs and Google FCM support updates and notifications on compatible devices. Maps and geographic searches use IGN/Géoplateforme and French public geographic APIs as applicable; opening external navigation passes the necessary information to the chosen service.

The primary Supabase database region in Frankfurt does not mean that all processing, support access or subprocessors remain in the EEA. Processing may take place notably in the United States or Singapore. The Cloudflare, Supabase and Resend DPAs provide transfer mechanisms including Standard Contractual Clauses where their conditions apply; Cloudflare also identifies the Data Privacy Framework for eligible transfers. Google mail is subject to its own terms and privacy information. These safeguards do not mean EU-only processing, zero retention or automatic compliance of every use. Relevant terms and safeguards may be requested from support@alagaya.com.

6. Automated translations

FR/EN/PL content translations use Cloudflare Workers AI, Qwen model, according to the functions and your choices. For a message, only the requested text is sent, limited to 2,000 characters, without automatically sending the entire history, a CV or photos. Identifying elements may be masked without guaranteeing complete anonymisation. Text may still contain personal data and be processed outside the EEA. The requesting user’s choice is not blanket permission to process all contacts’ data; relevant legal bases and rights still apply. Originals follow message-retention rules. Message translation cache is limited to 7 days; cost logs are retained for 90 days, with periodic purges. These periods do not promise instant erasure of every provider’s copies. Review your choices and the notice at /privacy/translations/?lang=en. Chat photo attachments and public CV translation are not described as active.

7. Retention and deletion

Account and profile data are retained during account use and for the requested functions. Removed or unnecessary listings and files are deleted or disassociated according to the relevant operation. Messages and bookings may remain necessary to their other participants; account deletion does not indiscriminately erase their history. Data needed for a legal duty, proof of acceptance, security or a dispute are limited to that purpose and applicable period; duration depends on closure of the matter, the duty concerned and applicable limitation periods, not indefinite commercial reuse. An account-linked acceptance receipt is deleted with the account by the mechanism currently prepared. Verified fixed translation periods are 7 days for message cache and 90 days for cost logs, with no message text in those logs.

Deletion is initiated in security settings or requested at support@alagaya.com. It processes the account, linked personal data and files while preserving other people’s rights and strictly necessary records. Backups and technical logs remain subject to the relevant service’s technical cycle and commitments; we do not promise instant deletion of every copy or an unverified numeric backup period for the plan in use. Retention criteria are necessity for the function or evidence, the deletion request, other participants’ rights and the applicable duty. You may request relevant details and exercise your rights through the contact below.

8. Your rights

Under the GDPR’s conditions, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. Withdraw consent for the future as easily as you gave it, without affecting earlier lawful processing, and provide instructions about your data after death. Write to support@alagaya.com; proportionate identity checks are requested only where there is reasonable doubt. We normally respond within one month; a two-month extension may be needed under the GDPR’s conditions, with reasons given in the first month. Complain to the CNIL at https://www.cnil.fr/fr/plaintes. No solely automated profiling decision with legal or similarly significant effects is announced; filters and recommendations do not replace users’ decisions or required human moderation.

9. Gifted-credit programme

The A/B/C welcome programme retains the minimum needed to verify the account, business, first qualifying publication and one-time entitlement. Only the business number is sent to the public DINUM register. A protected account or business fingerprint prevents another award after deletion; message content, CVs and private addresses are not used for this deduplication. A deleted beneficiary’s name is erased. Deleted-account fingerprints are purged 90 days after all allocations have been awarded and A instalments have ended, under the public programme rules. Credits cannot be exchanged for cash. Full rules: https://www.alagaya.com/bonus-program?lang=en.