Privacy Policy

Ember Read Application

1. Introduction

This Privacy Policy describes how KAIOSA SAS (hereinafter "we", "our" or "the Publisher") collects, uses and protects the personal data of users of the Ember Read application (hereinafter "the Application").

This policy applies in accordance with the General Data Protection Regulation (GDPR - EU 2016/679) and the Data Protection Act.

2. Data Collected

2.1 Account data (if registered)

• Email address
• Password (encrypted, non-readable)
• Date of registration
• Subscription type

2.2 Technical data

• Phone model and system version
• Application version
• System language

2.3 Bluetooth compatibility data

When you connect a compatible Bluetooth device, we collect:

• Name and brand of the connected device
• Bluetooth MAC address (technical device identifier)
• Connection status and potential error codes
• Technical user identifier (pseudonymized)

This data is used exclusively to diagnose compatibility issues and improve device support.

2.4 Data NOT collected

We never collect:

• The content of the books you read
• Your name, address or telephone number
• Your GPS location
• Your contacts or photos
• Payment data (managed by Stripe and Apple depending on the platform)

3. Purposes of Processing

Purpose	Legal basis	Data concerned
User account management	Performance of the contract	Email, password
Provision of services	Performance of the contract	Technical data
Subscription management	Performance of the contract	Email, subscription type
Customer support	Legitimate interest	Email, technical data
Fraud prevention	Legitimate interest	Device identifier
Bluetooth compatibility and diagnostics	Legitimate interest	Bluetooth data (name, brand, MAC address, errors)

4. Data Storage

4.1 Local data (on your device)

• Library of imported books
• Reading preferences
• Keyword dictionary cache
• Reading progress

This data remains on your device and is not transmitted to our servers.

4.2 Server data

• User account: secure servers in France/EU

5. Retention Period

Data type	Duration
Account data	Duration of registration + 3 years after deletion
Payment data	Retained by Stripe in accordance with their policy
Technical logs	12 months
Bluetooth diagnostic data	12 months

6. Data Sharing

We never sell your data. They may be shared only with:

6.1 Technical subcontractors

• Stripe: web and Android payment processing (USA, standard contractual clauses)
• Apple: in-app purchase processing on iOS via App Store (USA, standard contractual clauses)
• Hosting provider: secure server data storage (France/EU)

6.2 Authorities

Upon legal request from the competent judicial or administrative authorities.

7. Security

We implement appropriate security measures:

• Encryption of communications (HTTPS/TLS)
• Password encryption (bcrypt)
• Encryption of local sensitive data
• JWT token authentication
• Restricted access to data (principle of least privilege)
• Regular encrypted backups

8. Your Rights (GDPR)

In accordance with the GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate data
• Right to erasure: request the deletion of your data
• Right to restriction of processing: restrict the processing of your data
• Right to data portability: receive your data in a structured format
• Right of opposition: object to processing on legitimate grounds
• Right to withdraw consent: withdraw your consent at any time

To exercise these rights, contact us at: [email protected]

We shall respond within a maximum period of 30 days.

9. Collection of Pseudonymized Data

As part of the continuous improvement of the Ember Read application, we collect pseudonymized usage data.

Data collected

• Technical information (device model, system version, application version)
• Usage data (reading progress, session duration, application settings)
• Performance data (loading times, technical errors)
• Bluetooth diagnostic data (name and brand of the connected device, MAC address, connection status, error codes)

Warranties

These data are:

• Pseudonymized: associated with a technical identifier that does not, on its own, allow for your direct identification. If you are logged into your account, this data may be linked to your email address for technical support purposes only.
• Used solely to improve the application and diagnose compatibility issues
• Not shared with third parties
• Not used for advertising or marketing purposes
• Retained for a maximum period of 12 months

You may disable this collection at any time in the application settings.

10. Cookies and Trackers

The mobile Application does not use cookies. The website emberread.com may use:

• Essential cookies: website operation (session, cart)
• Analytical cookies: visit statistics (with consent)

11. International Transfers

Your data are primarily processed in France and within the European Union.

In the event of a transfer outside the EU (e.g., Stripe in the USA), appropriate safeguards are implemented (European Commission standard contractual clauses).

12. Minors

The Application is strictly reserved for adults (18 years and older). We do not knowingly collect data concerning minors.

If we discover that we have collected data from a minor, it shall be immediately deleted.

13. Amendments

We may amend this policy at any time. Substantial amendments will be notified to you via the Application or by email.

The date of the last update appears at the bottom of this document.

14. Claim

If you believe that your rights are not being respected, you may lodge a complaint with the CNIL:

• Site: www.cnil.fr
• Address: CNIL - 3 Place de Fontenoy - TSA 80715 - 75334 Paris Cedex 07

Last updated: April 2026