This policy covers Bobine (bobine.chapplications.com), where an event's guests photograph it with their phone. It is addressed to organizers, to guests who join an event and to the people who appear in the photos.
Controller and contact
Christophe Hurpeau EI (Chapplications) is the data controller. Contact: contact@chapplications.com, 9 IMPASSE DE LA BELLE ANGUILLE, 56200 COURNON, France.
Data and use
If you organize an event, your email address, temporary codes, session and language enable sign-in. The event records its name, dates, settings (visibility, moderation, pauses, challenges) and the addresses of the co-organizers you add. This processing is necessary to provide the service you request.
A co-organizer is added by the organizer, who must have their agreement. They receive an invitation and the album emails, and gain organizer rights by signing in with that address. This processing is based on the organizers' legitimate interest in preparing the event together.
If you ask to welcome more participants, your address, message and expected number of participants are recorded with the event and emailed to the publisher, to answer your request. The publisher also sees event names, their organizer's address and their counters, to manage these limits.
To join an event, you give your first name, which is required, and if you wish your email address, along with the application language. Your first name accompanies your photos for participants, organizers and on the big screen; your address is shown to no one. This processing is necessary to provide the service you request by joining the event.
Before it is sent, each photo is re-encoded on your phone, which removes its metadata, including GPS location. Our servers keep it with its author, time, challenge if any and moderation status, along with the list of photos each guest receives and the reactions (emojis) each guest puts on photos. Only the number of reactions is shown, never who put them. Depending on the settings, it is visible to participants and on the big screen; organizers see every photo and download the album. No facial recognition or biometric processing takes place. A photo is only shared through an explicit action.
A photo may show people who do not use Bobine, including children. The organizer chooses whom to invite, the event's settings and what to do with the downloaded album, and moderates the photos; whoever takes a photo makes sure the people photographed agree. Bobine hosts these photos for the time of the event, based on the participants' legitimate interest in sharing its memories. A downloaded photo leaves Bobine and is no longer covered by its deletion.
To have a photo you appear in removed, request its removal from the gallery. The organizers receive the request with your first name and reason if any, and decide. They may also delete a photo at any time. If you cannot access the event or your request is declined, write to contact@chapplications.com describing the event and the photo, to exercise your rights to erasure and to object.
Emails are service messages: for organizers, the sign-in code, the co-organizer invitation, the album announcement and the reminders before deletion; for guests who left their address, the link to the event's photos once it is over, then a reminder before their deletion. A guest may remove their address from the event.
Retention
The photos and all data of an event, participants and removal requests included, are deleted 7 days after it ends if an organizer downloaded the album (never less than 2 days after that download), otherwise 30 days after it ends. The organizer may delete a photo or the whole event earlier. Deletion is then immediate.
The organizer account is retained while it exists; you may request its erasure by email. A copy of each email sent is kept for seven days by our sending service. Any backups are overwritten within thirty days of effective deletion.
On your device
Your browser stores your organizer session, one session per joined event with its name, your language, your theme and photos waiting to be sent, until they are sent. The camera is only used to take the photo, without the microphone. Nothing is kept or sent until you choose to send the photo. The link received by email opens your session. Do not forward it. Bobine uses no cookies, trackers or third-party services.
Hosting and security
Photos are stored on our servers and are not passed to any other service. Security logs also record sign-ins, emails sent with the recipient's address, guest arrivals and organizer actions.
Chapplications services are hosted by OVH SAS (2 rue Kellermann, 59100 Roubaix, France) in the European Union. The publisher and its hosting provider access the data needed to operate and secure the service.
Server requests may be recorded in technical logs (IP address, date and request) for security and diagnostics, based on the publisher's legitimate interest. These logs are retained for at most twelve months. They are not used for advertising or profiling.
Your rights
You may request access, correction, deletion or portability of your data, restriction of processing or object to it under the conditions set out in the GDPR. Write to contact@chapplications.com. Proof of identity may be requested if there is reasonable doubt. We normally respond within one month; a complex request may require an extension, which we will explain.
You may also lodge a complaint with the CNIL. Reading this policy does not constitute consent to optional processing.