Privacy Policy

The controller of the personal data collected through the SunMap application (hereinafter the “Application”) is:

• Vahan Lab EURL, a company incorporated in France
• 78, avenue des Champs-Élysées, 75008 Paris, France
• SIRET: 853 801 413 00016
• Contact: support@sunmap.tech

2.1 Location data — The user’s geographic position is used for the operation of the Application (displaying the map, computing local sunlight). This data is processed exclusively locally on the user’s device and is neither transmitted to nor stored on our servers.

2.2 Technical and usage data (Crashlytics) — The Application uses Firebase Crashlytics (Google) to detect and diagnose technical incidents (crashes, errors). This service may collect information such as the device model, the operating system version, the device identifier, and error logs at the time of an incident.

2.3 Analytics data (Google Analytics) — The Application uses Google Analytics to measure general usage of the Application (screens viewed, frequency of use, aggregated statistics). This service may collect an advertising or device identifier, as well as navigation data within the Application.

2.4 Account data (optional) — If the user chooses to create an account in order to submit reports on the map, identification data (at minimum an email address) is collected.

If the user chooses to link their OpenStreetMap account, an authorisation token (OAuth) is used to send reports directly to OpenStreetMap under the user’s OSM identity. Vahan Lab EURL does not store the password of the user’s OpenStreetMap account.

2.5 Payment data — Purchases and subscriptions are processed directly by Apple (App Store) and by the provider RevenueCat. Vahan Lab EURL has no access to any of the user’s banking data; only non-sensitive transaction data (purchase type, subscription status) can be viewed by Vahan Lab EURL through RevenueCat, for service management purposes.

2.6 No other collection — Beyond the items above, Vahan Lab EURL neither collects nor retains any additional personal data on its own servers.

The data mentioned above is used for the following purposes:

• ensuring the technical operation of the Application;
• diagnosing and fixing technical incidents (Crashlytics);
• measuring and improving usage of the Application (Google Analytics);
• enabling account creation and contribution to OpenStreetMap mapping;
• managing subscriptions and purchases through RevenueCat and Apple.

• Local location: performance of the service requested by the user (this item does not concern processing by Vahan Lab, as the data never leaves the device).
• Crashlytics and Google Analytics: Vahan Lab’s legitimate interest in ensuring the stability and continuous improvement of the Application, and/or the user’s consent where required by applicable regulation (in particular through the App Tracking Transparency prompt on iOS).
• User account and OSM account: performance of the service at the user’s request.
• Payment: performance of the subscription or purchase contract.

Data may be transmitted to the following recipients, limited to what is necessary for each purpose:

The Application’s servers are hosted by OVH, in France.

Google services (Crashlytics, Analytics) and RevenueCat may involve processing data on servers located outside the European Union, in particular in the United States. Those transfers are framed by the safeguards provided by these providers (European Commission standard contractual clauses or equivalent mechanisms).

• Account data is retained for as long as the user’s account is active, and deleted upon an account deletion request.
• Crashlytics and Analytics data is retained for the default periods set by Google, generally between 2 and 14 months depending on the type of data.
• Transaction data is retained in accordance with applicable statutory accounting obligations (generally 10 years in France).

An account can be deleted from within the Application or on simple request to support@sunmap.tech. Deletion erases the user’s identification data (email address and account identifiers).

Reports and contributions already submitted to the map are not deleted: they are permanently dissociated from their author’s account and can no longer be linked back to it. Those contributions describe the terrain, not the user, and removing them would degrade the service for every user.

This dissociation is irreversible: once the link is broken, Vahan Lab EURL is no longer able to identify the author of a contribution, including at that person’s own request.

Reports sent to OpenStreetMap under the user’s OSM identity are governed by OpenStreetMap and its own policy: their deletion must be requested directly from the OpenStreetMap Foundation.

Vahan Lab EURL implements reasonable technical and organisational measures to protect the data processed against unauthorised access, loss or disclosure, in particular through secure hosting at OVH.

Under the General Data Protection Regulation (GDPR), every user has the following rights over their personal data:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to data portability;
• right to object;
• right to set directives concerning the fate of their data after their death.

These rights can be exercised by writing to support@sunmap.tech. If the response is unsatisfactory, the user may lodge a complaint with the French data protection authority, the Commission Nationale de l’Informatique et des Libertés (CNIL — www.cnil.fr).

As the Application is accessible to minors and distributed worldwide, particular care applies:

• European Union: the GDPR provides a specific consent regime for minors under 15 (the threshold varies between Member States) for processing based on consent.
• United States: the COPPA (Children’s Online Privacy Protection Act) imposes stricter obligations (verifiable parental consent, restrictions on collection and targeted advertising) on any service directed at, or knowingly collecting data from, children under 13.

On iOS, where Crashlytics or Analytics enable user tracking for measurement or personalisation purposes through an identifier shared with third parties, the Application requests the user’s consent through Apple’s App Tracking Transparency (ATT) framework, in accordance with its requirements.

This policy may be updated at any time. Any substantive change will be brought to users’ attention through the Application.

For any question about this privacy policy or about exercising your rights: support@sunmap.tech