Privacy policy
Last updated: 26 October 2026. This policy explains how Gatherlab processes your personal data in the Crew by Mojitoh app and on crew.mojitoh.com, in line with the GDPR.
1. Controller
Crew by Mojitoh is published by Gatherlab, a French SAS with share capital of €3,000, SIREN 908 326 739 (RCS Angers), VAT FR66908326739, registered office 22 rue de la Baraterie, 49000 Angers, France. Publication director: P.-A. Rivalan, president. Contact: [email protected]. Site host: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.
2. Data, purposes, legal bases
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Account ID, e-mail (possibly relayed by Apple), name if provided | Create and manage your account (Sign in with Apple) | Contract (6.1.b) |
| Content you enter: requests, notes, brand guidelines, generated deliverables | Run the agents and deliver drafts | Contract (6.1.b) |
| Purchases: subscription, credits, transactions | Manage subscription, access rights, billing, accounting | Contract (6.1.b); legal obligation (6.1.c) |
| Usage data: level, streak, achievements, credit consumption | Product operation, quotas | Contract (6.1.b); legitimate interest (6.1.f) |
| Device notification token | Tell you when a deliverable is ready | Consent (6.1.a), withdrawable in iOS settings |
| Pseudonymised technical logs without content; hashed IP address | Security, abuse prevention, diagnostics | Legitimate interest (6.1.f) |
| Support correspondence | Answer your requests | Legitimate interest (6.1.f) |
We do not ask for sensitive data (health, opinions, etc.); the Terms forbid it. We run no targeted advertising and do not sell your data.
3. Artificial intelligence
To produce a deliverable, your request and the context needed (agent card, brand guidelines, excerpts of your notes) are sent to an AI model hosted through Amazon Web Services, Europe region (Paris, eu-west-3). A consent screen names the AI providers before the first send; you can decline or withdraw in Settings > Privacy, and the rest of the app keeps working. We never send your e-mail, Apple ID or payment data. Your content is not used to train AI models. Deliverables are AI-generated: review them before any use.
4. Processors and recipients
| Processor | Role | Location |
|---|---|---|
| Cloudflare, Inc. | API hosting, database and task queues (EU jurisdiction) | EU; US company |
| Amazon Web Services (Bedrock) | Running AI models | France (Paris, eu-west-3); US company |
| Stripe Payments Europe Ltd | Payment for the web "founding member" offer and web subscription | Ireland / EU; US group |
| Apple Distribution International Ltd / Apple Inc. | App Store, in-app purchases, Sign in with Apple, push notifications | Ireland / United States |
E-mails sent to support go through Google's mail service (Google Ireland Ltd). No analytics tool is used. This list is kept current on this page. Data processing agreements (DPAs) are signed with each processor.
5. Transfers outside the EU
Data is hosted and processed in the EU. Cloudflare, AWS, Stripe and Apple are US companies or groups: remote access or occasional transfer to the United States (support, maintenance, security) remains possible. Such transfers rely on the EU-US Data Privacy Framework adequacy decision where the provider is certified, otherwise on the European Commission's standard contractual clauses. Cloudflare, Amazon Web Services, Stripe, Apple and Google are certified under this framework.
6. Retention
| Data | Period |
|---|---|
| Account, content and deliverables | While the account is active; deleted on request or on account deletion (erasure within 30 days) |
| Inactive account | Deletion after 24 months of inactivity, with notice |
| Billing data and transactions | 10 years (accounting obligations) |
| Technical and security logs | 12 months |
| Support correspondence | 3 years after last contact |
| Backups | Rolling, 30 days maximum |
7. Your rights
You have the rights of access, rectification, erasure, restriction, objection, portability and, where processing relies on consent, withdrawal at any time. In the app: Settings > Account > "Download my data" and "Delete my account" (deletes data and revokes Sign in with Apple tokens; billing runs through Apple, so cancel your subscription too). Other requests: [email protected], answer within one month. You may lodge a complaint with the CNIL (cnil.fr) or your local authority.
8. Security
Encryption in transit, content-free logs, two-factor protected admin access, secrets kept out of code. No system is infallible; in case of a data breach we notify the authority and affected people as the GDPR requires.
9. Minors
The app is for adult professionals (18+). We do not knowingly collect minors' data.
10. Cookies
These pages use no tracking cookies and no audience measurement.
11. Changes
We may update this policy; the date appears at the top. Material changes are announced in the app.