Privacy

1. Controller

The controller of the data collected on this site is ALVIA, a French simplified joint-stock company with a sole shareholder, share capital €500, registered office Parc Berthault, Chemin Cacalovo, Villa Ottavi, 20000 Ajaccio, Ajaccio trade register 102 482 650 (SIRET 102 482 650 00011), represented by its President, Emmanuel Cardi. Contact: contact@cumpa.fr.

2. Data collected

During the pre-launch phase, when you join the founder list we collect:

• the email address you give us through the founder form;
• the time of registration;
• the source of the form (originating page, form used);
• consent to processing (box ticked);
• an anonymised answer to the optional pricing survey, if you take part.

And, for site audience measurement, on each page viewed:

• the page viewed and the referring page;
• interactions: scroll depth, clicks on call-to-action buttons, time spent on the page;
• the language of the page and campaign parameters (utm_*) if you arrive from a campaign link;
• browser and device type (the user agent sent by your browser);
• a visit identifier and a visitor identifier, generated at random and kept in your browser's local storage, without cookies. They contain no information about you and cannot track you across other sites. You erase them by clearing the site data in your browser.

These events contain neither your name nor your email address, and are not cross-referenced with the founder list.

The Cumpà app processes other information as part of the service (sleep, energy, context, pain, usage history). That does not fall under this policy but under the app privacy policy, which sets out in particular the regime for health data and how to delete your account.

3. Purposes of processing

• Telling you when the beta opens and when Cumpà launches (at the earliest in autumn 2026).
• Giving you priority access to the free beta and, where applicable, informing you of the plans offered at launch.
• Measuring interest in the service and product targeting.
• Producing aggregated audience statistics through an in-house measurement solution (Supabase).

Your data is never sold to third parties.

4. Legal basis

• Consent (GDPR art. 6(1)(a)) for email collection and sending communications.
• Legitimate interest (GDPR art. 6(1)(f)) for aggregated and anonymised audience measurement.

5. Retention period

Your data is kept for as long as you remain on the founder list and for a maximum of 3 years after your last interaction. You can ask for deletion at any time (see Your rights).

6. Your rights

Under the GDPR you have the following rights over your data:

• Access: obtain the list of your data.
• Rectification: correct inaccurate data.
• Erasure: ask for your data to be deleted.
• Objection: refuse a specific processing operation.
• Restriction: temporarily freeze a processing operation.
• Portability: retrieve your data in a standard format.

To exercise these rights, contact us at contact@cumpa.fr. You may also lodge a complaint with the CNIL.

7. Hosting and processors

• Site hosting: OVH SAS — 2 rue Kellermann, 59100 Roubaix, France. Data stored in France, GDPR compliant.
• Founder/beta list storage: Supabase (hosted in the European Union). Used for the beta only, deleted on simple request to contact@cumpa.fr.
• Audience measurement: in-house solution, events recorded with Supabase (hosted in the European Union). No cookies.

8. Cookies and audience measurement

This site uses no cookies. Audience measurement relies on an in-house solution, whose events are recorded with Supabase: pages viewed, interactions, language, browser type, and two random identifiers (visit and visitor) stored locally in your browser, as described in section 2.

This measurement is carried out for ALVIA alone, for statistical purposes. No third-party commercial tracker, no advertising profiling, no tracking of your browsing on other sites, no transmission to third parties.

9. Contact

For any question about this privacy policy or your data: contact@cumpa.fr

1. Who is responsible for your data

The Cumpà service is published by ALVIA, a French simplified joint-stock company with a sole shareholder, share capital €500, registered with the Ajaccio trade register under number 102 482 650, with its registered office at Parc Berthault, Chemin Cacalovo, Villa Ottavi, 20000 Ajaccio, France.

ALVIA is the controller of your data. For any question about this page or about your information, write to contact@cumpa.fr.

2. What Cumpà collects, and why

To create your account

Your email address and a password, which is never kept in readable form. The date your account was created and your consent choices, with timestamps. If you prefer, you can sign in with your Google account or your Apple ID: in that case Cumpà receives your email address and an account identifier from Google or Apple, nothing more, and never receives your password.

To calibrate your sessions

On first launch: your age bracket, your practice level, your goal, the rhythm you are aiming for and the time you have. If you choose to enter it, your gender, solely to offer cycle-related follow-up. You can skip that question.

To decide today's session

What you declare each day: your energy, your sleep, where you are, the time of day, the time you have, your muscle soreness, and any discomfort or pain you report, with the area of the body and its intensity.

To track your progress

The sessions proposed, accepted, postponed or completed, their actual duration, whether you interrupted one and why, and how difficult it felt. The breaks you declare.

To take weather and air quality into account

If you allow it, the app reads your phone's location at the moment it needs to know the weather. Those coordinates are sent directly to the Open-Meteo weather service, which returns the temperature, current conditions and the air quality index. Your coordinates are neither sent to ALVIA nor stored on its servers. Only the result — "it is raining", "air quality is good" — is kept on your phone for the day. If you decline location, you declare the weather yourself and the service works exactly the same.

If you add a profile picture

This picture is optional. You take it with the camera or pick it from your photo library, and it is stored with your account so it can be shown to you. You can remove it at any time from your profile. Cumpà never analyses its content.

To run the service

Technical information: connection logs, IP address, device type and version, app version, and a device identifier if you accept notifications. If you take out a subscription, the information relating to that payment.

If you use Cumpà as a guest

A guest account works without an email address. The information described above is then attached to that anonymous account rather than to your identity. It follows exactly the same rules as a named account, including for health data.

3. The permissions the app asks of your phone

Three permissions may be requested. Each one can be declined, each one can be revoked from your phone's settings, and none of them is required to use Cumpà:

Table 1 — Permissions requested by the app.

4. Your health data

What you declare about your body — pain, discomfort, tiredness, sleep — is health data. The law gives it heightened protection, and Cumpà treats it accordingly.

It is collected only with your explicit consent, asked separately when you sign up, on a screen dedicated to nothing else. You can withdraw that consent at any time, without having to explain yourself (see section 8). If you withdraw it, this information is deleted and the service keeps working, in a simplified mode.

You can also use Cumpà without ever giving that consent. You then receive sessions matched to your profile, but not to how you feel today.

5. How Cumpà decides your session

The session you are offered each day is chosen automatically by a rules engine. It is not a black box: the rules are written in advance and can be explained. The app shows you the reasons behind its proposal.

This decision has no legal consequence for you and denies you no right and no service. You remain free to follow the proposed session, choose another one, or do nothing. No advertising profile, no scoring, no risk rating is built from what you declare.

6. On what legal basis

Every piece of information has a reason to be collected:

Table 2 — Legal basis for each category of information.

7. How long your data is kept

Table 3 — Retention periods.

Once these periods have passed, the information is deleted automatically.

8. Deleting your account, withdrawing your consent, getting your data back

Deleting your account

Open the app, go to Profile › Settings › Delete my account, and confirm. Nothing else to do: no email to send, no justification to give, no waiting period imposed. If you no longer have the app, you do not need to reinstall it: the steps are set out on the Delete my data page.

From that confirmation onwards, your account is closed immediately and becomes inaccessible. Your profile, your daily declarations, your pain records, your session history and your picture are erased within 30 days. That period is the rotation cycle of the backups: beyond it, no copy remains.

Only three things survive deletion, because the law requires or allows it:

• invoices, if you have been a subscriber, for 10 years;
• technical logs, 6 months for connections and 12 months for security;
• proof of your consents — the date you accepted, and what you accepted — for 3 years, so that ALVIA can demonstrate it did obtain your agreement.

None of these contains health data.

Withdrawing your consent to health data

Write "I withdraw my health consent" to contact@cumpa.fr from your account's email address, or from within the app via Profile › Contact. ALVIA acts on it within 72 hours: your declarations of discomfort, pain, tiredness and sleep are erased, and the app switches to simplified mode. You keep your account, your session history and full access to the service.

Getting your data back

Write to contact@cumpa.fr from your account's email address. ALVIA sends you all of your information in a readable file that can be reused elsewhere, within one month at the latest, free of charge.

9. Who else has access to your data

Nobody buys it and nobody resells it. A few providers access it in order to run the service, each bound by a contract forbidding any other use:

Table 4 — Providers with access to the data. The current list of names is available on request.

Your data is hosted in France. The only transfers outside Europe concern the delivery of notifications, the verification of an Apple or Google identifier, and payment; they rely on the safeguards provided for by European regulation. No health data leaves the European Union.

ALVIA may be compelled to disclose information to a judicial authority upon formal request.

10. Your rights

At any time you may:

• Access all the information Cumpà holds about you.
• Correct inaccurate information.
• Delete your account and your data, from the app's settings.
• Retrieve your data in a file that can be reused elsewhere.
• Withdraw your consent to health data, without losing access to the service.
• Object to a processing operation or ask for it to be restricted.
• Set out what should happen to your information after your death, and appoint someone to exercise these rights.

Section 8 explains how, step by step. For anything else, write to contact@cumpa.fr. ALVIA replies within one month at the latest. If the request is complex, that period may be extended by two months, and you are told so. ALVIA may ask you to confirm your identity, but only where it has a genuine doubt.

If the answer does not satisfy you, you can lodge a complaint with the CNIL, the French data protection authority, at cnil.fr.

11. How your data is protected

• Everything travelling between your phone and the service goes over an encrypted connection.
• Your password is never kept in readable form: it is transformed by a one-way function that nobody can reverse, ALVIA included.
• Administrative access is personal to named individuals, restricted to those who need it, and logged.
• The servers and the backups are located in France, with a professional hosting provider, and are subject to the same access restrictions.
• ALVIA undertakes not to use real user data to develop or test the service.

No protection is absolute, and nobody can promise otherwise. If, despite these measures, a breach occurred and posed a risk to you, ALVIA would notify the CNIL within 72 hours and inform you directly.

12. Minimum age

Cumpà is reserved for adults, aged 18 or over. By creating your account you declare that you are 18 or older. If you notice that a minor has created an account, report it to contact@cumpa.fr: it will be deleted, and its data with it.

13. Changes to this page

This page may change, for instance if a new provider is involved or a feature changes. Where the change is significant, you are told in the app or by email 30 days before it takes effect. If the change concerns your health data, your consent is asked again. The version in force is always available in the app and on this page.

14. Contact

ALVIA — Parc Berthault, Chemin Cacalovo, Villa Ottavi, 20000 Ajaccio, France

contact@cumpa.fr