Privacy Policy

Last updated: 9 November 2026

This Privacy Policy explains what personal data ORGAA collects, why, on what legal basis, who it is shared with, how long it is kept, and how you can exercise your rights.

ORGAA is published by Batiflow, a SASU (simplified joint-stock company with sole shareholder) with share capital of €1,000, registered with the Paris Trade and Companies Register under number 993 058 908, with registered office at 60 rue François 1er, 75008 Paris, France (hereinafter "we" or "the Publisher"). The Publisher acts as data controller under Regulation (EU) 2016/679 ("GDPR").

1. Data we collect

1.1 Data you provide

1.2 Data collected automatically

1.3 Data from third parties

• Sign-in with Apple or Google: if you use federated authentication, we receive your email and name (subject to what the provider transmits, under your control).
• Contacts: for the "find friends on ORGAA" feature, we never read your contacts in plain text. The app computes cryptographic hashes of phone numbers and emails locally on your device. Only these anonymous hashes are sent to our server to check whether they match an existing account. We never store your contacts in plain text.
• Email invitations: an organizer can invite you to an event by entering your email address (and possibly your first name). We use this address only to send you the invitation and, if you don't reply, at most three reminders requested by the organizer. Every email states who invited you and lets you stop receiving invitations for good.
• Invitation of a professional by a vendor: a registered vendor can invite by email another professional they work with to join ORGAA. We use this address only for that invitation, never more than once in 30 days for the same address, with a link to stop being contacted.
• Business register: to check a vendor's identity, we consult the French State's public business directory (company name, SIRET, address, activity code, creation date).

1.4 Data we do not collect

• Banking data: ORGAA never collects funds between users. Contributions to a cagnotte are declarative (you state the amount you sent) and redirect to external providers (Lydia, PayPal, Wero, IBAN…) governed by their own privacy policies. When a vendor pays for their plan, the payment is processed by Stripe: we never see the card number.
• Activity and accommodation bookings take place on the partner platform's website: we receive neither your payment details nor the details of your booking.
• Continuous location (location is used point-in-time for event address selection only, never in background).
• Health data, biometric data (biometric unlock is stored locally on your device by iOS/Android, never transmitted to our servers).
• The microphone is only active while you are recording a voice message in a conversation, never in the background nor when the app starts. The resulting recording is content you send (see § 1.1): it is never analysed, transcribed, or used for advertising.

1.5 If you are a vendor

1.6 Preparing a listing from a website

When someone asks to prepare a listing from a website, a Google listing or a directory listing, we read the public pages provided: texts, photos, business contact details shown (phone, email, address) and legal notices. For a Google listing, we receive the name, address, phone, website and type of business. The texts are sent to our artificial intelligence subprocessor to draft a proposed listing. Nothing is published without the vendor's review.

If the person has no account, we also keep an encrypted fingerprint of their IP address, to limit abuse. If sign-up is not completed, the ORGAA team may contact the business, at its business contact details, to help complete it. The business can object at any time by writing to [email protected].

2. Purposes and legal bases

3. Event beneficiaries (third-party data)

When a user creates an event (birthday, farewell party, wedding…) for an identified beneficiary not yet registered on ORGAA, the creator enters the beneficiary's first and last name. The organizer is then responsible for that use and must ensure the beneficiary is informed. If the beneficiary does not register within 30 days after the event ends (surprise mode), we automatically anonymize these data via a scheduled task.

If you discover that an event concerns you without your consent, contact us at [email protected]: we will delete your data as soon as possible.

3a. What vendors see

When you send a quote request, the vendor receives your first name, the date, the number of guests and the city of the event, your messages and the files you attach. They then become data controller for these data and have committed, in our vendor terms, to use them only to answer you and perform the service.

A published review shows your first name, the initial of your last name, and the type and month of the event. The amount you enter is never published.

4. Subprocessors and recipients

We use the following subprocessors, selected for their GDPR compliance. All have signed Data Processing Agreements (DPAs / Art. 28 GDPR) with us:

We never sell your data to third parties. No transfer outside the EU is performed for data stored in Supabase. For subprocessors that transfer data outside the EU (Vercel, Google, Apple, Expo, Resend, Anthropic, Stripe), Standard Contractual Clauses approved by the European Commission govern the transfers. Our artificial intelligence subprocessor does not use the data we send it to train its models.

Other recipients, acting on their own behalf:

• vendors you send a request to (see § 3a);
• partner booking platforms for activities and accommodation: when you click on an offer, they receive a click identifier; for an accommodation search, they also receive your IP address and browser type. On their website, their own privacy policy applies;
• Meta Platforms Ireland Ltd. (Instagram, Facebook), to measure our ad campaigns: when the app is installed and when sign-up is completed, Meta receives the data described in § 1.2 ("Ad measurement") and may process it in the United States (EU-US Data Privacy Framework). Its own privacy policy applies. You can turn this off in Profile → Privacy → Ad measurement;
• map tile providers of the website (OpenFreeMap, OpenStreetMap), which receive your IP address when a map is displayed;
• authorities, upon legal request.

For details of the trackers we use (including PostHog and the Meta SDK) and how to refuse them, see our cookie policy.

5. Retention periods

6. Your rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15): obtain a copy of the data concerning you. However, we will not be able to include data that could harm the rights or freedoms of others.
• Right to rectification (Art. 16): correct inaccurate, outdated or incomplete data (most are editable directly in the app via Profile → Edit). If you cannot do it yourself, you can contact us and we will do it for you.
• Right to erasure / "right to be forgotten" (Art. 17): request the deletion of your data at any time. We will review the request and delete the data where possible. If, after reviewing your request, we find that legitimate grounds for retention still exist, we will inform you. You can also do it yourself via Profile → Delete my account, or by email.
• Right to object (Art. 21): opt out of PostHog analytics (Profile → Privacy → Anonymous analytics) and of Meta ad measurement (Profile → Privacy → Ad measurement). Every event email contains a link to stop receiving them (one event, messages from organizers, invitations, or all); in the app, manage them from Profile → Communication → Emails. Event cancellations are still sent to attendees.
• Right to restriction (Art. 18): in certain situations, ask to limit the use of your data and suspend a contested processing. For example, you may ask us to temporarily restrict the processing of your data in case of inaccurate data while it is being verified, in case of unlawful use of the data where you prefer restriction over erasure, or where we no longer need your data but you need it to establish, exercise or defend legal claims. We will also inform you before lifting the restrictions.
• Right to data portability (Art. 20): receive your data in a structured format, or request a copy of your data and have it transferred to another service. We will not be able to include data that could harm the rights or freedoms of others.
• Right to withdraw consent (Art. 7.3): at any time (newsletter, push…), without affecting the lawfulness of processing carried out before the withdrawal. When you withdraw your consent, we will stop using your data for the purposes you consented to, unless we have another legal basis to continue.
• Right to lodge a complaint (Art. 77): with a data protection authority (that of the country where you live, where you work, or where the issue occurred). The competent authority in France is the CNIL (www.cnil.fr).

If you are a vendor, most of your listing information can be edited in My listing, and your billing information in Manage my subscription. You can object to our sales follow-ups at any time.

To exercise these rights, write to [email protected] specifying your request and a way to re-identify you (account email). We respond within one month maximum.

7. Security

We implement appropriate technical and organizational measures: connection encryption (HTTPS/TLS), encryption at rest at Supabase, row-level security isolation, multi-factor authentication available, access logging. As no method is 100% foolproof, we encourage you to choose a strong password and enable biometric lock on your device.

8. Minors

ORGAA is prohibited to persons under 16 years of age. The date of birth is declared at sign-up. If you learn that a minor under 16 is using the app, report it to [email protected]: we will delete the account.

9. Changes

We may amend this policy to reflect legal or technical developments. The date at the top of the page indicates the last update. For substantial changes, we will notify you via in-app notification and/or email.

10. Contact

Batiflow, 60 rue François 1er, 75008 Paris, France Privacy email: [email protected] General email: [email protected]