Privacy policy

CARBYO SAS, 300 avenue Via Nova, 83600 Fréjus, France, is the controller for personal data processing carried out for Kelmae. Contact for questions and rights requests: contact@kelmae.com. This policy covers the website, accounts, the application, captures and Konnect. Local content that never leaves the phone must be distinguished from data actually sent to servers.

The legal bases above are working classifications. An iOS or Android permission authorises technical access to a phone resource; it does not, by itself, replace GDPR consent where consent is required. Geolocation necessary for an explicitly requested feature may rely on performance of the service; optional reuse, including analytics or advertising, requires an assessment and, where applicable, separate consent.

The Subject chooses to join a session and, before connecting, receives the displayed identity of the Filmer, the categories of data transmitted and information about potential capture. Telemetry must only be disclosed to authorised participants. Beta diagnostics may include times, technical session identifiers, connection states, errors, latency, freshness and quality measurements, and potentially coordinates if they are actually included in events.

To be confirmed: the actual diagnostic fields, avoidance of exact coordinates where aggregated values suffice, restricted and logged administrative access, and the intended 30-day deletion schedule.

Data is accessible to authorised CARBYO personnel and providers that actually contribute to authentication, hosting, transmission, measurement and maintenance. Supabase is used for backend functions and Konnect; Lovable’s role in producing or hosting the website, together with any other provider, must be verified.

To be confirmed: storage region, subprocessors, possible transfers outside the EEA, the applicable legal mechanism and corresponding safeguards. No statement that all data remains in Europe is made without evidence.

Permissions are managed in the phone settings. The optional analytics choice must remain accessible in Kelmae and revocable. Subject to GDPR conditions, people may request access, rectification, erasure, restriction, objection or portability of their data, and withdraw consent without retroactive effect. They may write to contact@kelmae.com and lodge a complaint with the CNIL. CARBYO responds within the statutory time limits.

Account deletion must distinguish server data, media potentially stored online, content already exported to the phone, copies received by third parties, logs subject to a short retention period and backups.

To be confirmed: operational deletion period, residual backup retention and legal exceptions.

The website loads fonts from Google Fonts and media from the project’s delivery infrastructure. These technical requests may disclose the IP address and connection information required to deliver resources to those providers.

The EN/FR language choice is kept in the browser’s local storage under the “kelmae.locale” key; it is not used for tracking.

Audience measurement — Kelmae uses Matomo Cloud, a service provided by InnoCraft Ltd (New Zealand), solely to measure traffic on kelmae.com: number of visits and page views, country of origin, referring sites limited to their domain name, general campaign statistics (campaign parameters are masked), general device categories and major browser and operating system versions, and the number of successful beta sign-ups, without any email address. These statistics are used only by CARBYO to understand the website’s audience; they are not combined with other processing or used for advertising.

Tracking works without tracking cookies and without any identifier stored on your device. The IP address is anonymised (last two bytes masked); geographic origin is derived from this anonymised address. All other URL parameters are removed before sending. No user identifier is used, no individual tracking or per-visitor history is built, and these statistics are not matched with Kelmae app data. Raw visit data is deleted after 759 days (about 25 months) at most. Aggregated, rounded statistical reports, which cannot identify a visitor, are kept separately.

The data is hosted by InnoCraft on Amazon Web Services in Frankfurt (Germany), with backups in Dublin (Ireland). As InnoCraft is established in New Zealand, a country covered by a European Commission adequacy decision, any access from that country is governed by that decision. The Matomo Cloud data processing agreement forms part of its terms of service.

You can object to this measurement at any time with the button below; your choice is kept in the browser’s local storage. Your browser’s Do Not Track signal and Global Privacy Control (GPC) are also respected.