Privacy

Privacy policy

Last updated: 21 August 2026

This policy describes how Romain Mathieu (“we”, “the controller”), publisher of JoliQ (joliq.fr), processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Belgian Act of 30 July 2018.

Privacy contact: contact@joliq.fr. Full identity: see the legal notice.

1. Principles — privacy by design

JoliQ is a conversation assistant: you send a screenshot of a text / dating-app thread, and the Service suggests replies. The content of a chat is sensitive by default. Product design:

conversation content is never attached to analytics events, nor written to the app’s technical logs;
imported text and replies are stored in the device secure vault (Keychain / Android Keystore); the non-sensitive key store holds only derived data (quota, preferences);
you control retention from settings: one analysis, the full history, the profile, or everything;
running an analysis sends the screenshot (compressed on the device) — or pasted text — to an AI provider (OpenAI) via our backend, to produce the replies — see § 3.3;
there is no on-device OCR: the image itself (resized and compressed on the device) is sent so the model can read the bubbles.

2. Controller

Romain Mathieu, natural person, BCE 1036.553.777, VAT BE1036553777, Rue du Marais 80, 6150 Anderlues, Belgium.

No data protection officer (DPO) is appointed at this stage (not required for this structure). The GDPR contact point is contact@joliq.fr.

3. Data processed

3.1 Data we do not collect

Targeted advertising / advertising IDs / third-party ad trackers
Precise location
Mandatory account creation to use the free offer
Raw conversation text in analytics

3.2 Data stored on your device

The app may store locally: analysis results and replies (secure vault), screenshots used for an in-progress analysis, preferences, quota and subscription flags, anonymous install identifier, age declaration. These data stay on the device, except the screenshot (or text) sent to OpenAI when you run an analysis, in-app purchase data, or a support message. Legal basis: contract performance / legitimate interest (Art. 6.1.b and 6.1.f GDPR), under your control.

The screenshot is resized and compressed on the device before sending. There is no local OCR: the AI model reads the bubbles.

3.3 AI analysis (OpenAI)

When you run an analysis, JoliQ sends over HTTPS, via our backend (a function hosted at Supabase), to OpenAI (Chat Completions / vision API, api.openai.com): the compressed screenshot and/or the thread text. OpenAI returns the suggested replies and the tip. We do not keep that screenshot on our own servers as the primary store: the result is saved in the device’s local vault.

If the cloud model is not configured or unavailable, a local engine (heuristic, on-device) may produce an analysis without transmitting the conversation.

Legal basis: contract performance (Art. 6.1.b GDPR) — you request the analysis — and consent (Art. 6.1.a) recorded at the first analysis. To stop this processing: do not send more conversations, and delete data from settings (history, profile, or everything) or uninstall the app. Write to contact@joliq.fr for any GDPR request.

OpenAI policy: openai.com/policies/privacy-policy. Do not import content whose transmission to an AI provider would be prohibited (professional secrecy, health data, conversations involving minors, banking secrets, etc.).

3.4 Data when you contact support

If you write to us (contact@joliq.fr): identity, email, message content, attachments you choose to send. Basis: legitimate interest (support) and/or pre-contractual steps (Art. 6.1.b/f).

3.5 Subscriptions and payments

Premium payments are processed by Apple (App Store) and/or Google (Google Play), via RevenueCat as a technical entitlements intermediary. An anonymous install identifier (UUID generated on the device, distinct from an advertising ID) may be sent to RevenueCat to attach the subscription to the install. We do not store full card numbers. We may receive a purchase identifier, subscription status and plan type to activate Premium.

Policies: Apple, Google, RevenueCat.

3.6 Technical hosting data for the website

The site host (Hostinger International Limited) may process technical logs (IP address, date, URL, user-agent) for security, continuity and proper operation. Basis: legitimate interest (Art. 6.1.f) — security. Hostinger policy: hostinger.com/legal/privacy-policy.

3.7 Product analytics (app)

The app may measure the funnel (open, onboarding, analysis started, paywall, purchase) to understand where it drops. By default this processing is off (opt-in). Without consent, only essential events may be recorded locally (app_opened, consent_changed).

An event may carry an anonymous install identifier (UUID, no IDFA / GAID), a session identifier, the app version, the platform, and non-reversible derived metrics (message count, length bucket, score, tone label, language code). Filtered before any storage: conversation text, names, handles, phone numbers, emails, precise location, advertising IDs, any free-text field you type.

As of this policy, no third-party analytics provider is connected: events stay on the device. If a provider is added, this page will be updated. Basis: consent (Art. 6.1.a) for the optional funnel; legitimate interest (Art. 6.1.f) for essential diagnostic events.

4. Purposes

Provide the conversation assistant (screenshot reading, replies)
Manage free quotas and the Pro subscription
Provide support and answer GDPR requests
Meet legal obligations (accounting, tax)
Secure the website infrastructure
Measure the product funnel without conversation content

5. Recipients

Recipients: OpenAI (analysis and replies, when you run an analysis), Supabase (analysis backend, anonymous auth, quota), Apple and Google (stores / payment), RevenueCat (subscription entitlements), Hostinger (hosting of joliq.fr), email for support, authorities if legally required. No sale of personal data.

6. Transfers outside the EEA

OpenAI, Apple, Google and RevenueCat may process data outside the EEA, including in the United States. Appropriate safeguards apply (standard contractual clauses, Data Privacy Framework where applicable). Details on request at contact@joliq.fr. OpenAI policy: openai.com/policies/privacy-policy.

7. Retention periods

Local app data: until you delete it or uninstall
Support emails: up to 3 years after the last useful contact
Transaction / billing data: statutory accounting periods (often 7 years in Belgium) via Apple, Google and/or us
Hosting technical logs: in principle up to 90 days, unless a longer security need or legal duty applies
Analytics events (no content): up to 13 months

8. Your rights

You have rights of access, rectification, erasure, restriction, objection, portability (where applicable), and the right to withdraw consent. To exercise them: contact@joliq.fr. You may also lodge a complaint with the Belgian Data Protection Authority (APD): autoriteprotectiondonnees.be.

For data on the device, exercise your rights from JoliQ settings (delete one analysis, history, profile, or all data) or by uninstalling the app. Data already sent to OpenAI for an analysis follows OpenAI’s retention policy.

9. Security

We implement appropriate measures (HTTPS to OpenAI, minimisation, local secure vault, analytics redaction, no advertising ID). No system is infallible: protect your device (passcode, biometrics) and do not import unnecessary secrets (passwords, banking codes, health data).

10. Minors

You declare your age before any generation. A user under 18 may use the Free offer: the Service then caps the register (teasing, no double meanings). It is not a social network or a dating app. Paid subscriptions are reserved for people able to contract. Importing conversations involving a minor is prohibited.

11. Changes

This policy may be updated. The date at the top of the page is authoritative. In case of a material change, a notice may be shown on the site and/or in the app.

12. Contact

contact@joliq.fr — Romain Mathieu, Rue du Marais 80, 6150 Anderlues, Belgium.