Ibbou Privacy Policy

I. Key concepts

Personal data means any information relating to an identified or identifiable natural person. This includes in particular your name, surname, email address, phone number, account information, technical data and, when you authorise it, your location data.

Location data may be sensitive in certain contexts. Ibbou processes it only for specific purposes, in particular sending alerts, sharing position with your trusted contacts or improving service reliability.

Anonymised data is data that can no longer identify you in an irreversible manner.

Pseudonymised data is data that cannot directly identify you without additional information.

GDPR means the General Data Protection Regulation, applicable in the European Union.

The data controller is the entity that determines the purposes and means of processing. For the processing described in this policy, the data controller is Ibbou SAS, unless otherwise stated.

II. Data we collect

This privacy policy applies to the Ibbou mobile application, published by Ibbou SAS. The Ibbou application collects the following personal data:

• Email address;
• Phone number;
• GPS location data (collected only with your consent, for alerts and location sharing);
• Device identifiers and technical device data (for example device model, operating system version, application version);
• Account and profile data (name, surname, language, country, account preferences);
• Usage and diagnostic data needed to operate, secure and improve the application.

III. Origin of personal data we process

We collect personal data in the following situations:

• When creating and managing your Ibbou account.
• When using the mobile application, in particular when you trigger an alert, configure trusted contacts or use a location sharing feature.
• When using an Ibbou or service-compatible connected device.
• When you invite or add a relative, caregiver, emergency contact or "guardian angel".
• When you contact our customer support.
• When you visit our website or interact with our communications.
• When you accept certain optional processing, for example notifications, location sharing or certain marketing communications.

IV. Your consent

Your consent is collected for certain specific processing, in particular:

• access to your precise location;
• sending push notifications;
• adding or inviting trusted contacts;
• sharing your position with those contacts;
• sending marketing communications, when required by law;
• certain optional personalisation or service improvement features.

V. Processing of personal data

VI. Data sharing

Ibbou does not sell your personal data.

We may share certain data only in the following cases:

• With your trusted contacts, when you have designated them and the service requires it, for example during an alert.
• With our technical subprocessors, solely to provide the Services: hosting, notification delivery, emails, SMS, monitoring, customer support, technical analysis.
• With competent authorities, when a legal obligation requires us to do so.
• With partners, only when you have consented to sharing or when sharing is strictly necessary to provide the service.

VII. Third-party services and SDKs

The Ibbou application integrates a limited number of third-party services (SDKs). These services may collect data on their own behalf, in accordance with their respective privacy policies:

• Sentry (error and crash monitoring): collects technical and diagnostic data such as device model, operating system, application version, crash reports and IP address, to help us detect and fix malfunctions.
• Expo / Expo Notifications (push notification delivery): processes a push notification token and device identifiers to deliver notifications and alerts to your device.

VIII. Data retention

We retain your personal data only for as long as necessary for the purposes described in this policy.

When you delete your account, associated data is deleted or anonymised, unless retention is necessary to comply with a legal obligation, resolve a dispute, ensure service security or defend our rights.

Data in technical backups may be kept for a limited period before automatic deletion, solely for continuity and security purposes.

IX. Hosting, transfer and data security

Data is hosted by providers selected by Ibbou.

Where possible, Ibbou prioritises hosting within the European Union. However, certain technical subprocessors may involve transfers outside the European Economic Area. In that case, Ibbou implements safeguards provided for by the GDPR, in particular the European Commission's standard contractual clauses or any other appropriate legal mechanism.

Ibbou implements technical and organisational measures designed to protect your data against unauthorised access, loss, alteration or disclosure.

These measures may include encryption of communications, access control, security event logging, limitation of internal rights and system monitoring.

X. Your rights

Under the GDPR, you have the following rights:

• right of access to your data;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to object;
• right to data portability;
• right to withdraw your consent at any time;
• right to lodge a complaint with the CNIL.

XI. Account deletion

You can delete your account and the associated data directly from the Ibbou application, by going to Profile > Settings > Delete my account.

You can also request the deletion of your account and your data without using the application, by emailing us at contact@ibbou.co. We process these requests and delete or anonymise your data, subject to data we must retain for the reasons set out below.

Account deletion results in deletion or anonymisation of associated data, subject to data we must retain to comply with legal obligations, ensure service security or defend our rights.

XII. Minors

Ibbou Services may be used in a family context or to assist a vulnerable person. When the user is a minor or under the responsibility of a third party, use of the service must be carried out with the legal representative's agreement when required by law.

Ibbou may implement specific rules for accounts linked to minors or accompanied persons.

XIII. Changes to the privacy policy

Ibbou may update this policy to reflect changes to its Services, practices or applicable regulations.

In case of significant changes, we will inform you by an appropriate means, for example via the application, by email or at your next login.

Last updated: 30 June 2026

XIV. Contact

For any questions about this policy or our personal data protection practices, you can contact us at: contact@ibbou.co

or by mail: Ibbou SAS, Halle de l'Innovation, 10 place Françoise Héritier, 34000 Montpellier