Privacy Policy

Effective date: August 1, 2026

Last updated: August 1, 2026

This Privacy Policy explains how Imbutae collects, uses, discloses, and protects personal data when you use the Imbutae iOS application, the Imbutae website, and related services (together, the “Service”). Imbutae is operated by Errachdi Hafid, established in France (“Imbutae,” “we,” “us,” or “our”). For the purposes of applicable data protection law, Errachdi Hafid is the data controller. This Privacy Policy is intended to provide information about our data practices. It is not a contract requiring you to consent to every processing activity described below. Where consent is legally required, we request it separately.

1. Contact

For privacy questions or to exercise your rights, contact: Email: contact@imbutae.fr Controller: Errachdi Hafid Country of establishment: France We may ask for information reasonably necessary to confirm your identity before acting on a request. Please do not send identity documents unless we specifically ask for them.

2. Data We Process

The data we process depends on how you use the Service.

2.1 Account and authentication data

You may use core parts of Imbutae in guest mode. If you choose to create or connect an account using Sign in with Apple, we may receive and process:

a unique Apple and Imbutae account identifier;
your email address or Apple private relay address, if Apple makes it available;
authentication tokens and session information; and
account creation, sign-in, and security metadata. Apple controls what information is shared through Sign in with Apple. Imbutae does not receive your Apple ID password.

2.2 App activity and synced preferences

Depending on the features you use, we process information such as:

voices and topics you tune in to;
drops you save and items in your deck;
the position and consumption state of deck items;
Focus Stack settings, including its name and selected voices;

enabled source services and other app preferences;
community candidates you support and the number of lifts remaining;
notices delivered to or dismissed by your account or installation; and
subscription or feature-entitlement status. Some of this information is stored only on your device. If you sign in, relevant information is also synchronized with our cloud systems so that account-based features and restoration can work.

2.3 Purchases, subscriptions, and tips

Purchases are processed by Apple through the App Store. We do not receive or store your payment-card details. We may receive or generate:

product and transaction identifiers;
purchase, renewal, expiration, cancellation, or revocation status;
purchase dates and entitlement status;
an account or installation identifier associated with the transaction; and
signed transaction information used to verify a purchase with Apple. This includes Imbutae+ subscriptions, the Focus Stack purchase, and optional tips.

2.4 Support, requests, and reports

If you contact us in the app or by email, we process the information you submit, which may include:

your category, subject, message, feedback, voice request, or drop report;
contextual information you choose to include;
app version, iOS version, device type, and authentication state; and
your account identifier or a pseudonymous installation identifier, when available. Please avoid including sensitive personal data or personal data about another person unless it is necessary for us to handle your request.

2.5 Analytics and technical data

We use PostHog to understand how the Service is used and improve its reliability and design. Depending on your settings and applicable law, analytics data may include:

a pseudonymous installation or analytics identifier;
device type, operating system, app version, locale, and technical metadata;
app launches, screens or features used, button interactions, and timestamps;
purchase-flow, onboarding, settings, notification, and subscription interactions; and
interactions with particular voices or drops, such as a voice name or internal drop identifier. We have disabled automatic screen capture and automatic element-interaction capture in our PostHog configuration. We do not use PostHog session replay in the iOS app. We do not use analytics data for targeted advertising or to track you across apps and websites owned by other companies. Where applicable law requires consent before analytics identifiers or similar technologies are stored on or accessed from your device, analytics will be activated only after consent. You may withdraw that consent through the controls made available in the Service. Refusing optional analytics does not prevent use of the Service’s core features.

2.6 Notifications and local device data

If you enable notifications, Apple and your device process your notification authorization status. Imbutae stores notification preferences, thresholds, counters, and identifiers for already-seen items on your device. Imbutae currently uses these settings to schedule and manage notifications locally. You can disable notifications in the app or in iOS Settings. The app also stores operational preferences and app state using device storage such as UserDefaults and local databases. Removing the app generally removes app-local data, subject to iOS behavior and any data separately synchronized to your Imbutae account.

2.7 Information about featured people and public-source content

Imbutae curates excerpts, profile information, contextual descriptions, and links relating to people or organizations featured as “voices.” This information may include names, public identifiers where relevant, public images, public statements, source services, and links. We obtain this information from publicly accessible sources, the original source service, or information submitted for editorial consideration. Featured people may contact us at contact@imbutae.fr to request access, correction, contextualization, or removal where applicable.

3. Why We Process Data and Our Legal Bases

Where European Economic Area, United Kingdom, or similar data protection law applies, we rely on the following legal bases: Purpose Data involved Legal basis Provide the app, account, synchronization, saved items, deck, Focus Stack, community lifts, purchases, and support Account data, app activity, preferences, transaction data, communications Performance of our contract with you; steps taken at your request before entering a contract Authenticate users and protect accounts and transactions Account, session, security, installation, and transaction data Performance of contract; our legitimate interests in security and fraud prevention; compliance with legal obligations Verify purchases and maintain entitlements Apple transaction, account, product, and entitlement data Performance of contract; compliance with accounting and consumer-law obligations Respond to feedback, requests, reports, and disputes Support messages, contextual and technical data Performance of contract; our legitimate interests in support, service quality, and protecting legal rights Analyze and improve the Service Pseudonymous identifiers, technical and interaction data Your consent where required; otherwise our legitimate interests in understanding and improving the Service Deliver notices and user-requested notifications Account or installation identifier and notification preferences Performance of contract; your device-level permission where required Curate and attribute public-source editorial content Public names, usernames, images, statements, context, and source links Our legitimate interests in providing an editorial discovery and curation service and preserving accurate attribution Meet legal obligations and establish, exercise, or defend claims Relevant account, transaction, support, security, and usage data Compliance with legal obligations; our legitimate interests in protecting our rights and users When we rely on legitimate interests, we consider the nature of the data, the reasonable expectations of affected people, the benefit of the processing, and its potential impact. You may object to processing based on legitimate interests as described below.

4. How We Disclose Data

We do not sell personal data. We do not share personal data for cross-context behavioral advertising or targeted advertising. We disclose personal data only as reasonably necessary to the following categories of recipients:

Supabase: cloud database, authentication, serverless functions, storage of account-linked app state, support requests, notices, and verified purchase status;
PostHog: pseudonymous product analytics, using PostHog’s European Union ingestion endpoint;
Apple: Sign in with Apple, App Store purchases and subscriptions, purchase verification, device permissions, and platform services;
Professional advisers and authorities: lawyers, accountants, courts, regulators, law enforcement, or other authorities where reasonably necessary or legally required; and
A successor or transaction participant: if Imbutae is involved in a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality and data-protection safeguards. Our processors may use subprocessors to provide infrastructure and support. They may process data only on our instructions and under contractual data-protection obligations, except where they independently act as controllers under their own terms, as Apple may do for certain App Store and platform activities. When you open an original-source link or another third-party service, that third party receives data directly from your device under its own privacy policy. Imbutae does not control those third-party services.

5. International Transfers

Some providers or their subprocessors may process data outside France or the European Economic Area. Where required, we rely on an adequacy decision, the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism, together with supplementary safeguards where appropriate. You may contact us for more information about the relevant safeguards. Using an EU endpoint does not necessarily mean that every support or subprocessing operation takes place only in the EU.

6. Retention

We retain personal data only for as long as reasonably necessary for the purposes described above, including legal, accounting, security, and dispute-resolution needs. In particular:

Account and synchronized app data: retained while your account remains active and removed from active systems when your account is deleted, except where limited retention is legally required;
Local app data: retained on your device until you delete it, reset relevant settings, delete your account where the app clears that data, or uninstall the app;
Purchase and entitlement records: retained while needed to provide or restore the purchase and for applicable accounting, fraud-prevention, consumer-law, and limitation periods;
Support messages and reports: retained while we handle the request and for a reasonable follow-up and dispute period, normally no longer than 24 months after the last substantive interaction unless longer retention is required;
Analytics data: retained in identifiable or pseudonymous form for no longer than 24 months, then deleted or aggregated, unless a shorter period applies; and
Security and legal records: retained for the period reasonably necessary to investigate an incident, comply with law, or establish, exercise, or defend legal claims. Deletion from active systems may not immediately remove residual copies from encrypted backups. Backup copies are isolated from ordinary use and removed through normal backup-rotation processes, unless preservation is legally required.

Aggregated or genuinely anonymized information may be retained because it no longer identifies an individual.

7. Account Deletion and Your Choices

You may delete your Imbutae account from the app’s account settings. Account deletion removes your account and associated synchronized app data from our active systems, subject to the limited exceptions described in this Policy. We also clear account-related local app data as part of the in-app deletion flow. Deleting your Imbutae account does not automatically cancel an active App Store subscription. Subscriptions are managed by Apple and must be cancelled separately in your Apple subscription settings. Data independently retained by Apple is governed by Apple’s policies. You may also:

use core parts of Imbutae in guest mode;
manage or disable notifications in the app or iOS Settings;
refuse or withdraw optional analytics consent where that consent is required;
remove saved items or change the voices you are tuned in to and preferences in the app; and
contact us to exercise the rights described below.

8. Your Privacy Rights

Depending on your location and subject to applicable conditions and exceptions, you may have the right to:

obtain confirmation that we process your personal data and request access to it;
correct inaccurate or incomplete data;
request deletion of your data;
restrict or object to certain processing, including processing based on legitimate interests;
receive data you provided in a structured, commonly used, machine-readable format and, where technically feasible, transmit it to another controller;
withdraw consent at any time, without affecting processing carried out before withdrawal;
not be discriminated against for exercising applicable privacy rights; and
lodge a complaint with a competent supervisory authority. In France, the supervisory authority is the Commission nationale de l’informatique et des libertés (CNIL), www.cnil.fr. We normally respond to valid requests within one month where the GDPR applies. That period may be extended where permitted due to complexity or the number of requests. If we deny a request, we will explain the applicable reason and available appeal or complaint options.

9. Automated Decision-Making

We do not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning you. Community lift totals may influence editorial prioritization, but they do not make legal or similarly significant decisions about users.

10. Security

We use reasonable technical and organizational safeguards designed to protect personal data, including encrypted network transport, access controls, authentication, database security rules, and transaction verification. No service can guarantee absolute security. You are responsible for maintaining the security of your Apple account and device. If a personal-data breach creates a risk requiring notice under applicable law, we will notify the competent authority and affected individuals as required.

11. Children

The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13. A person who has not reached the age of legal majority in their jurisdiction may use the Service only with authorization from a parent or legal guardian. Where applicable law requires parental authorization for consent-based processing at a higher age, that higher threshold applies. In France, a child under 15 cannot independently consent to consent-based data processing for an online service. Optional purchases must also be authorized and supervised by the account holder or a parent or legal guardian. If you believe a child has provided personal data contrary to this section, contact us so we can investigate and take appropriate action.

12. No Sale, Targeted Advertising, or AI Training on User Data

We do not:

sell your personal data;
serve third-party targeted advertising in the Service;
use your activity to track you across services owned by other companies; or
use account data, support messages, saved items, community activity, or analytics data submitted through the Service to train generative artificial-intelligence models. This does not prevent us from using tools to operate or improve the Service where those tools process data only to provide services to us under appropriate protections.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes to the Service, our practices, providers, or applicable law. We will post the updated Policy and revise the date above. If a change materially affects your rights or how we use personal data, we will provide reasonable additional notice through the Service or another appropriate channel. Where required, we will request consent before applying a new processing purpose.

14. Contact Us

Questions, requests, and complaints may be sent to contact@imbutae.fr.