Privacy Policy
Last updated: [publication date]
1. Summary
- You can use the App without an account.
- Your answers may reveal information about your health. We only save them with your explicit consent.
- Your data is stored in Western Europe.
- We never sell your data and we do not show advertising.
- Companies only ever see anonymized results for groups of at least 5 people.
- You can export or delete your data at any time.
2. Who is responsible for your data
The data controller is SAS Positive Solutions, a French simplified joint-stock company (société par actions simplifiée) with share capital of €1,000, registered with the Marseille Trade and Companies Register (RCS) under number 933 999 658, SIRET 933 999 658 00018, VAT number FR47933999658, registered office 14 rue Bonnefoy, 13006 Marseille, France.
Contact for any privacy question or request: Thierry Daher, privacy@positivesolutions.app
We have not appointed a Data Protection Officer. Thierry Daher is your contact person.
3. Scope
This policy covers the Positive Solutions app (the “App”): the website and web app at positivesolutions.app, the Android app and any future iOS app. It does not cover positivesolutions.fr, which has its own policy.
4. The data we collect
| Category | What it includes | When |
|---|---|---|
| Anonymous identifier | A random identifier created by Firebase Authentication | When you start a questionnaire, before any account |
| Questionnaire answers and scores | Your answers, the scores calculated from them, date of completion | When you take a questionnaire |
| Account data | Name, email address, password (stored encrypted by Firebase; we never see it). With Google sign-in: name, email address and profile photo provided by Google | When you create an account |
| Optional profile data | Job role, company, country, age band. Not always asked; always optional | When you choose to provide them |
| Sharing data | Email address of the person you share results with | When you share results |
| Usage and device data | Screens viewed, actions in the App, app version, device type, operating system, approximate location (country or city), analytics identifiers | When you use the App, only if you accept analytics |
| Communication preferences | Your choice to receive product updates, unsubscribe history | When you opt in or out |
We do not collect free-text answers, precise location, contacts, photos or files from your device.
5. Health-related data
Questionnaires on stress, well-being and burnout may reveal information about your health. Under the GDPR (Article 9), this is a special category of data.
- We only save your answers and results with your explicit consent, given separately through a box that is never ticked in advance.
- Without that consent, your results are shown on screen but not saved.
- You can withdraw your consent at any time from your account settings. Your saved answers are then deleted.
6. Why we use your data, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Run the questionnaires and show your results | Performance of our Terms (Art. 6(1)(b)) |
| Save your answers and results, anonymously or in your account | Your explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) |
| Create and manage your account | Performance of our Terms (Art. 6(1)(b)) |
| Share your results with the person you choose | Your consent (Art. 6(1)(a) and Art. 9(2)(a)) |
| Include your answers in your company’s anonymized statistics | Your explicit consent (Art. 9(2)(a)), given when you join through a company code |
| Measure and improve the App with Google Analytics | Your consent (Art. 6(1)(a)) |
| Send product updates by email | Your consent (Art. 6(1)(a)) |
| Send service emails (account, security, changes to our policies) | Performance of our Terms (Art. 6(1)(b)) |
| Keep the App secure and prevent misuse | Our legitimate interest (Art. 6(1)(f)) |
| Meet our legal obligations | Legal obligation (Art. 6(1)(c)) |
7. Company accounts
When your employer uses the App, Positive Solutions remains the sole controller of your data. Your employer:
- never sees your individual answers, scores or identity, nor whether you took part;
- only sees anonymized, aggregated results;
- only sees results, filters (such as team, site or age band) and participation counts for groups of at least 5 respondents.
Including your answers in your company’s statistics is your choice. You can withdraw that consent at any time; your answers are then excluded from future statistics.
8. Google Analytics
We use Google Analytics, through Google Analytics for Firebase, on the website and in the Android app, to understand how the App is used and to improve it.
- Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
- Analytics only start after you accept them, through the cookie banner on the website or the consent screen in the Android app.
- Your questionnaire answers and scores are never sent to Google Analytics.
- We do not use Google Analytics for advertising. Advertising features and the collection of the Android advertising ID are disabled.
- Analytics data is kept for 14 months.
- You can change your choice at any time through “Cookie settings” on the website or in the App’s settings.
- More information: Google’s privacy policy at policies.google.com/privacy.
9. The Android app
The Android app is distributed through Google Play. When you download it, Google processes some data under its own privacy policy.
- The app only uses internet access. It does not access your location, contacts, camera, microphone or files.
- The app does not currently send push notifications.
- The app uses the Firebase services described in this policy, including Google Analytics for Firebase (section 8), only with your consent.
- Uninstalling the app stops all data collection on your device. Data saved in your account stays until you delete your account.
- If we add new features, such as notifications or crash reporting, we will update this policy and, where required, ask for your consent.
10. Who receives your data
We only share your data with service providers who process it on our behalf, under contract and on our instructions:
| Provider | Role | Location |
|---|---|---|
| Google Ireland Limited (Firebase, Google Cloud) | Hosting, database, authentication, analytics, service emails | Western Europe (EU) |
Your data may also be received by:
- the people you choose to share your results with;
- your employer, only as anonymized aggregated statistics (section 7);
- public authorities, when the law requires it.
When we introduce paid features, payment providers (such as Stripe or Google Play) will be added to this list.
We never sell your data and we never share it for advertising.
11. Transfers outside the European Union
Your data is stored in Western Europe. Some providers or their parent companies are based in the United States. In that case, transfers are protected by:
- the EU–US Data Privacy Framework, for certified companies such as Google LLC; and/or
- the Standard Contractual Clauses approved by the European Commission.
You can ask us for a copy of these safeguards.
12. How long we keep your data
| Data | Retention |
|---|---|
| Answers saved without an account | 30 days, then deleted |
| Account data and results | As long as your account exists |
| Inactive accounts | Deleted after 2 years without login, after notifying you by email |
| After you delete your account or ask for deletion | Deleted within 30 days; removed from backups within 90 days |
| Product update emails | Until you unsubscribe; contact removed after 3 years without any interaction |
| Analytics data | 14 months |
| Consent records | For as long as needed to prove consent, then [5] years |
13. Security
We protect your data with encryption in transit and at rest, restricted access, access rules on the database and regular reviews. If a data breach creates a risk for you, we notify the French data protection authority (CNIL) within 72 hours and inform you where required.
14. Your rights
Under the GDPR, you have the right to:
- access your data and get a copy of it;
- correct inaccurate data;
- delete your data (“right to be forgotten”);
- restrict or object to some uses of your data;
- receive your data in a portable format;
- withdraw your consent at any time, without affecting what was done before;
- give instructions on what happens to your data after your death (French law).
Most of these can be done directly in your account settings (export, edit, delete, consent choices). Otherwise, write to privacy@positivesolutions.app. We reply within one month. We may ask you to confirm your identity.
You can also lodge a complaint with the CNIL (cnil.fr), 3 place de Fontenoy, 75007 Paris, France.
15. Cookies and similar technologies
- Essential: keep you signed in and remember your consent choices. No consent needed.
- Analytics: Google Analytics (section 8). Only with your consent.
- We do not use advertising cookies.
You can change your choices at any time through “Cookie settings” at the bottom of every page.
16. Automated calculations
Your scores are calculated automatically from your answers. No decision with legal or similarly significant effects on you is taken on that basis.
17. Age
The App is reserved for people aged 18 or over. We do not knowingly collect data from minors. If you believe a minor has used the App, contact us and we will delete their data.
18. Changes to this policy
We update this policy from time to time, for example when we add features, providers or apps, or when the law changes.
- The “Last updated” date at the top shows the current version.
- We notify you of significant changes by email or in the App. If a change requires your consent, we ask for it first.
19. Language
This policy is currently available in English. Once a French version is published, the French version prevails for users in France and the English version for users outside France.
20. Contact
SAS Positive Solutions, 14 rue Bonnefoy, 13006 Marseille, France — privacy@positivesolutions.app