Privacy Policy

1. Data controller

The controller of your personal data is:

• Benjamin Cohen Solal, sole trader (auto-entrepreneur)
• Email: privacy@seniorhub.fr

2. Data collected

We collect the following categories of data:

2.1 Account data

• Surname, first name, email address (via sign-up or Google OAuth)
• Telephone number (optional — SMS invitations and the member's profile page)
• Postal address and date of birth of the member (optional, entered in their profile)
• Profile photo (if provided via Google)

2.2 Household data

• Household name, list of members and their roles (senior, caregiver)
• Appointments, tasks, checklists, everyday reminders and the related comments
• Documents and photos shared within the household
• Emergency contacts and shared address book
• Entries in the shared family logbook, visitor notes, mood of the day and related trends, as well as the links you create between a logbook entry and an appointment, a task, a list or a document of the household
• Messages exchanged between caregivers in the household's discussion space
• Tablet settings and audio/video calls
• Country and time zone of the household: when a household is created, they are taken from the settings of the phone or browser of the caregiver who creates it (the phone's or browser's time zone and region), without any geolocation. They are used to send reminders at the household's local time, to date entries by the household's day, to suggest the country's emergency number, to write dates the way the country does and not to show French financial aid to a household outside France. The caregiver who manages the household's members can correct them in the household settings. They are separate from the country derived from a member's IP address at sign-in, which is used only for internal usage statistics and never to set up the household.
• Calendar synchronisation connections (Google Calendar, iCloud/CalDAV, ICS link)
• Google Drive synchronisation connection (household documents synchronised with a Drive folder chosen by the administrator)
• Voice messages: audio recording captured via the microphone of the senior's device, automatic text transcription of that audio, and AI analysis of the content of the transcription (non-medical memory aid). These three elements (audio, transcription, analysis) are stored in the household and accessible to authorised members. This processing requires your explicit consent before any recording.
• Memos dictated by a caregiver: when a caregiver dictates a memo about the household or the person being helped (see §2.6), their voice is recorded while they speak and then sent for transcription; the audio itself is not kept on our servers (see §7 for the temporary copy that remains on the caregiver's device). The resulting text is then analysed in order to suggest a logbook entry, an appointment or a task: nothing is saved until the caregiver has reviewed and approved the suggestion (see §9.2).

2.3 Technical data

• IP address, browser user-agent
• Session identifiers and authentication tokens
• Audit logs: the actions carried out in the app (who, when, on which item), without the content of the texts concerned
• Crash reports from the caregivers' app (only with your consent, via Firebase Crashlytics)
• Crash reports from the SeniorHub Assistance app: when it crashes, it automatically sends a report to Sentry, without prior consent. This report contains the technical cause of the error, the phone's model and system, the app version, and technical identifiers for the household, the member, the call, the session and the installation. It contains neither name, nor email address, nor household content, nor a screen image.

2.4 Subscription data

• Type of subscription, start and end dates (via RevenueCat)
• Complimentary periods: the plan that Senior Hub offers to your household, its start and end dates, and the internal reason for granting it. This information is recorded by Senior Hub and does not pass through RevenueCat: no purchase takes place.
• No banking data is collected by Senior Hub (payment handled by Apple / Google)

2.5 Financial support profile (optional module)

If you use the « Aides & conseils » (Support & advice) feature, Senior Hub collects the following data, only after your explicit consent (separate from the general consent to processing):

• Year of birth of the person being helped and, where applicable, of their spouse or partner.
• Level of independence — entered each time support is looked up for the eligibility calculation, then immediately forgotten. This information is never recorded on our servers: it passes through only for the duration of the calculation. Consequently, Senior Hub is not a host of health data (HDS).
• Monthly income bracket of the household or reference taxable income.
• Family situation (single, in a couple, widowed) and housing situation.
• Postcode and département code, used to suggest the local support available in your département.
• List of the support you declare you already receive (to exclude it from the estimates).

Purposes: suggesting the support for which your household is eligible, estimating the amounts likely to be granted, and surfacing personalised suggestions (e.g. tax credit for home help).Legal basis: explicit consent.Retention: until your support profile or your account is deleted. You can withdraw this consent at any time from the « Aides & conseils » screen, which deletes the information you have given us about your household's situation and your advice preferences, and ends any eligibility calculation.No data from this profile is passed on to a third party: it is used exclusively for the eligibility calculation on our servers.

Your application files are not deleted with the profile. A file is the record of a procedure you are carrying out — often over several months, with its history and supporting documents. It is based not on the consent to the eligibility calculation but on the performance of the service you use, and withdrawing that consent therefore does not destroy it. You remain in control: each file can be deleted from its page, and the « Mes démarches » (My procedures) tab lets you delete all your files at once. This deletion is permanent and affects the whole household.

Also retained after consent is withdrawn are the counters used to apply the limits of your subscription plan (number of support and advice pages viewed). They are used for that purpose only.

2.6 Consents

Senior Hub keeps proof of your consents (type of consent, date, policy version, IP address, user-agent) in order to demonstrate that the processing complies, for the consents recorded on our servers. Two categories of consent coexist:

• Caregiver consents: terms of use, privacy policy and data processing (mandatory to access the service), as well as optional consents (anonymous statistics, crash reports, push notifications). These consents are recorded on our servers, with proof.
• Senior consents: the person being helped is invited, from the first use of their device (companion app SeniorHub Simple launcher and/or SeniorHub Assistance), to give their explicit and independent agreement for each of the following uses:
  • being supported via the app: their loved ones viewing their appointments, tasks and shared family logbook, and organising the home screen of their phone for them — the contacts they call with a single tap, the apps, the shortcuts to websites and the wallpaper (see §2.9);
  • receiving video calls from their loved ones, via SeniorHub Assistance;
  • allowing a loved one to take remote control of their phone (screen sharing and sending gestures — see §2.8);
  • sharing the technical status of their device with their household (telemetry — see §2.8).
  Each of these four agreements is separate from the other three and from the caregiver consent: it can be refused or withdrawn at any time, unconditionally, and governs only access to the features it concerns. Withdrawing remote control or telemetry never affects, for example, the receipt of video calls. Consent to video calls is recorded on our servers, with proof. Consents to remote control and to telemetry are recorded on the senior's device itself, where they take precedence; they can be viewed and revoked at any time, including in a single action (« Tout arrêter » — Stop everything), from the « Qui peut voir mon téléphone » (Who can see my phone) screen of SeniorHub Assistance. In addition, the person being helped is informed that the caregivers of their household may dictate voice memos about them, intended for the shared family logbook (see §2.2); this processing is not part of these four consents, because it is based on the performance of the contract and not on consent (see §3).

2.7 Location data (on-the-spot reminders)

If you enable the optional « Rappels sur place » (on-the-spot reminders) feature (proximity reminders for tasks to be done at a household place), the mobile app monitors your position in the background in order to detect your arrival near a saved place and remind you of the tasks to be done there.

• Processing on the device only: your position is never sent to our servers or shared with a third party. It is used exclusively, on your phone, to trigger a local notification. No location history is kept.
• Only the addresses of the places you enter (e.g. a senior's home, a pharmacy) are recorded, converted into coordinates via the public Base Adresse Nationale API (see processors).
• This feature requires your explicit consent and the « Always » location permission. You can disable it at any time from the « Lieux du foyer » (Household places) screen or withdraw the permission in your phone's settings.

2.8 Remote assistance (SeniorHub Assistance)

When a senior installs the companion app SeniorHub Assistance on their phone, their loved ones can, according to the agreements the senior has given personally (see §2.6), support them remotely in several independent ways:

• Screen sharing during a call. During an active assistance session, the senior's screen can be broadcast live, as in a video conference, to the loved one supporting them, so that they can see what is happening and guide them. The sharing covers the entire screen, and not a single app: the loved one therefore sees everything displayed on it during the session, including incoming notifications and the other apps the senior opens. This is necessary so that they can guide the senior wherever they are on their phone — and it is also why the senior must confirm twice before it starts: in the app, then in an Android system window. This sharing takes place only during the current session, with remote control enabled, and stops automatically when it ends. A banner permanently displayed on the senior's screen, as well as a notification that cannot be hidden, inform them in real time that their screen is being shared.
• Sending gestures. Once remote control has been allowed, the loved one can, during the session, perform simple gestures on the senior's behalf (tapping, scrolling) to help them carry out an action on their phone. The technical mechanism used for this never automatically reads the content displayed on the screen — texts, messages, passwords — whatever it may be: it is configured only to perform gestures, never to extract information from them (Android technical setting canRetrieveWindowContent disabled on the service used).
• Explanation by image, outside any call. A loved one can also send the senior a still image to help them understand an action — for example a screenshot of their own phone, which they annotate with a circle or an arrow before sending it. This image is made by the loved one themselves: at no point is the senior's screen captured or observed to produce this explanation. It is displayed full screen on the senior's device, with the sender's name and a button to close it. The bytes of the image pass through our database — never through our file storage — for one hour at most, and are erased as soon as the senior first opens it, or earlier if either of them deletes it. After that time, it disappears automatically even if it has never been opened; only the event (who sent it, to whom, when) then remains logged, never its content. No analysis, text recognition or artificial intelligence is applied to these images.
• History of remote-control sessions. Each remote-control session (who requested it, when, and for how long) is logged and can be viewed by the senior themselves, at any time, from the « Qui peut voir mon téléphone » (Who can see my phone) screen of their device. This history never contains the content of the screen or the details of the gestures performed — only this tracking information, for the purposes of security and transparency for the senior.
• Device telemetry. With their separate agreement, the technical status of the senior's phone — battery level and charge, type of network connection, system version, app version, free storage space — can be shared with their household, for example to spot a low battery or a connection problem. This telemetry never includes the app displayed on the screen or the name of the Wi-Fi network used: these two items of information are deliberately excluded from the technical reporting.
• Which phone it is. The make and model of the device (for example « Samsung SM-A536B ») are sent by the apps installed on the senior's phone, and they do not depend on the telemetry agreement above: they are used only to recognise which device is meant in the household's list of devices. Without them, the same phone appears there twice — once per app — and the family may believe that an app is missing when it is working, or remove from its list the phone it actually uses. That is why this information falls under the performance of the contract and not under a separate agreement. A make and model are shared by millions of devices and do not make it possible to identify anyone. The system version is deliberately excluded: otherwise an Android update would be enough to make the same phone appear as two different devices. No serial number, no IMEI and no hardware identifier is collected.
• When this reporting takes place, and by which app. It is sent by SeniorHub Assistance, installed on the senior's phone, and only by that app: the app intended for family caregivers does not report any device status. The reporting does not depend on the senior being in front of their screen and does not stop when they close the app: the Android system wakes it up periodically, and our server can wake it up with a silent notification. We do not promise « real time » or a fixed frequency: Android guarantees no background wake-up rate, and the gap between two updates depends mainly on how much the senior actually uses the phone — from a few minutes if they use it often, to much longer if they do not open it. An explicit request from a loved one triggers an attempt to update within a few seconds, with no guarantee of success if the phone is switched off or out of network coverage. In all cases, the app shows the date of the last value received rather than implying a freshness it cannot guarantee. As long as this sharing is active, a permanent notification remains displayed on the senior's phone, and a reminder is sent to them each month.
• The household's display tablet reports the same type of technical status, for the same reason and without location or network name. It is a shared household device, installed by the family, and not the senior's personal phone.

What the tablet displays. The display tablet is a screen that stays on continuously, placed in the home of the person being helped. It scrolls, in large print, household information: upcoming appointments, the day's tasks, messages written by the family, photos and the weather. This information is visible to anyone present in the room, including a visitor or an outside professional. The name of the appointment is displayed by default, because that is what allows the person being helped to understand what lies ahead; the place and the name of the person accompanying them are, for their part, hidden by default. These three displays are three separate settings, which the household can switch on or off at any time from the caregivers' app, and the household is informed of this when it activates this screen. The household also chooses where to place the tablet and which screens to display. The tablet is read-only: it never records or changes anything.

The senior can, at any time and from their own device, withdraw each of these agreements independently of the others, or stop everything in a single gesture via the « Tout arrêter » (Stop everything) action on the « Qui peut voir mon téléphone » (Who can see my phone) screen.

On iPhone, none of the above exists. Paragraph 2.8 describes mechanisms specific to Android. iOS offers no equivalent, and we do not look for one: on an iPhone, SeniorHub never takes control of the device, does not share the screen continuously and takes no periodic readings in the background. What the app does there is limited to what the person being helped triggers themselves by pressing a button.

2.9 Configuration of the home screen of the person being helped

The companion app SeniorHub Simple launcher replaces the home screen of the phone of the person being helped with a grid of large tiles. What this grid contains is chosen by the members of their household: the contacts they call with a single tap, the apps they find in their app drawer, website addresses (an internet radio station, a music playlist, an organisation's website) and the wallpaper. This configuration is personal data concerning them: it describes what they see in front of them every day.

• Where it is stored. When the household chooses to share it — so that a loved one can prepare this screen remotely from the website or the caregivers' app —, it is stored on our European servers, like the rest of the household's data. When the home screen is set up directly on the phone of the person being helped, without sharing, this configuration remains only on that device: it is never sent to us and we have no knowledge of it.
• What we never do. We never open these addresses from our servers: no request is sent to the target site, either to check that it exists or to retrieve its logo or a preview. We never record what the person being helped views, or when, or for how long: there is no browsing history, either on our servers or in the app. We do not read the content of the pages opened and we do not classify these addresses by topic.
• What happens when it is opened. A tile of this type opens the address in the phone's browser, the very same one used for any other page. From that moment, it is the privacy policy and the terms of the site visited that apply, and not ours: the cookies it sets, the audience measurement it carries out and the data it collects are neither our responsibility nor under our control. SeniorHub never displays these sites inside its app, precisely so that the browser's address bar — and the site name it displays — remain in view of the person being helped.
• How long it is kept. On the phone: for as long as the app is installed there; it disappears with the app, or when the app's data is erased from the phone's settings. On our servers, when it is shared: for as long as the household exists, then for at most 35 days in our encrypted backups, until they expire (see §7 and §10). It is part of the export of your data and it is deleted with the household.
• Refusing an item on this screen. The person being helped may, at any time and without having to give reasons, ask for one of these items — a shortcut to a website, a contact, an app, the wallpaper — to be removed from their screen. This request is addressed to the members of their household, who have the means to act on it immediately: the removal is carried out from the home screen settings, protected by a code held by the household, or remotely from the caregivers' app or the website when the configuration is shared. The phone of the person being helped, for its part, has no setting they can change themselves: their home screen is deliberately fixed, so that an accidental tap does not change it and they find the same thing there every day. This refusal is not a mere preference: the members of the household undertake, under the terms and conditions (§5.4), to act on it. If it were not acted upon, the person being helped — or anyone acting on their behalf — may exercise their right to object with us, under the conditions set out in §10.

Why you are not asked to tick a box for this. Organising the home screen of the person being helped is one of the very functions of the service to which your household has subscribed: the processing is therefore based on the performance of the contract (art. 6.1.b GDPR) and not on your consent. When this configuration remains only on the phone of the person being helped, storing it locally is strictly necessary for the service expressly requested and, on that basis, requires neither consent nor a banner (art. 82 of the French Data Protection Act, « loi Informatique et Libertés »). What remains in the hands of the person being helped is their general agreement to be supported (§2.6), which they can withdraw themselves at any time from their phone, and the right to refuse a specific item on this screen without giving up the rest — a refusal they address to the members of their household, as described above.

3. Purposes and legal bases

4. Data sharing

Senior Hub does not sell your personal data to third parties. Your data is shared only with the processors needed to operate the service.

4.1 Access by our team to the content of your household

The content of your household — your notes, for example — is not viewable by our team in the normal course of the service. Our administration tools display only counters, statuses and dates.

Access to the content of a household is possible only in three situations, and never out of mere curiosity: a support request you send us, the exercise of your rights (access, erasure, rectification…), or a technical incident. Such access is then:

• subject to entering a written reason, which is kept;
• limited to a single household and to 30 minutes, after which it closes by itself;
• logged — who looked, when, for what reason, and how many times;
• closed to notes that their author has marked “private”: those can only be opened under a court order, or at your own request.

We inform you of any access of this kind, except where a court order prohibits us from doing so. Legal basis: legitimate interest (art. 6.1.f) for support and technical incidents, legal obligation (art. 6.1.c) where it is a matter of responding to the exercise of your rights.

5. Processors

6. Transfers outside the European Union

Some processors are located in the United States or may process data outside the European Union (Railway, Firebase, Anthropic, Groq, RevenueCat, Resend, Expo, LiveKit, Google Calendar API, Google Drive API, and Google Cloud Storage solely for newsletter images sent before 3 August 2026). These transfers are governed by:

In particular, the audio of voice messages and of memos dictated by a caregiver, and their text transcription, are processed in the United States by Groq (transcription) and Anthropic (AI analysis), under the safeguards mentioned below.

• The EU-U.S. Data Privacy Framework for certified processors
• Standard Contractual Clauses (SCCs) approved by the European Commission for other cases

We prefer to tell you clearly where the limits of this protection lie. The fact that we do not keep the audio of the dictated memo is a commitment that concerns our servers: it means that we do not write it anywhere and that it does not appear in any backup. It does not mean that the recording has never left the European Union — it has left it, for as long as it takes to be transcribed — nor that our provider has not read it: it necessarily has to hear it in order to write it down. What it cannot do, contractually, is keep it longer than the service requires, use it for other purposes, or train its models on it.

7. Retention periods

8. Security

We implement the following measures to protect your data:

• Encryption in transit (HTTPS / TLS) for all communications
• Encryption at rest of the database
• SSL connection between the application and the database
• Secure password hashing (scrypt)
• Signed authentication tokens (HMAC-SHA256) with expiry
• Rate limiting on authentication endpoints
• HTTP security headers (HSTS, X-Frame-Options, etc.)
• Access logging with IP address and user-agent
• Daily backup of the database and weekly backup of the files, encrypted before leaving our servers and stored with a provider separate from the one hosting the application
• Restore test carried out every month on a real backup: a backup that no one has ever restored is not a guarantee

9. Artificial intelligence

9.1 Summaries of the shared family logbook

Senior Hub uses the Anthropic service to generate summaries, trends and suggestions from the entries in the shared family logbook, as well as observations on how caregiving roles are shared out within the household. This processing is carried out only when the feature has been enabled by the household.

• The data sent to Anthropic is limited to shared family logbook entries (no documents, no files). For the observations on caregiving roles, only an anonymised snapshot is sent: the caregivers' first names (no email, no identifier), the name and estimated mental load of each role, and who is assigned to what. The observations generated are cached for 24 hours and invalidated as soon as anything changes.
• Anthropic does not retain the data sent in order to train its models (API usage policy).
• The summaries generated are stored in our database and subject to the same retention rules.
• This processing does not constitute an automated decision within the meaning of Article 22 of the GDPR: the summaries are purely informative and produce no legal effect.

9.2 Transcribed voice — voice messages and dictated memos

When a senior sends a voice message, Senior Hub carries out the following two AI processing operations, subject to your prior consent (given when the feature is set up):

1. Transcription by Groq (Whisper) — the audio is sent to the Groq transcription service (United States). The resulting text transcription is stored in the household. Contractually, Groq does not keep the audio data beyond what is necessary for the service (Groq's API usage policy).
2. Analysis of the transcription by Anthropic (Claude) — the text transcription (never the audio) is sent to Anthropic in order to produce a non-medical memory aid for caregivers. This summary is purely informative; it does not constitute a medical analysis, a diagnosis or an automated decision within the meaning of Article 22 of the GDPR. Anthropic does not retain the data sent in order to train its models (API usage policy).

• The audio, the transcription and the analysis are stored in your household and accessible to authorised members, in accordance with the retention rules in section 7.
• You can withdraw your consent at any time — future voice messages will no longer be processed by these services. Messages already sent remain stored until you request their erasure (Settings > Privacy or privacy@seniorhub.fr).

When a caregiver dictates a memo (see §2.2), Senior Hub carries out a transcription by Groq and then an analysis by Anthropic on the same technical principle, but with three differences:

• Legal basis: the dictated memo is based on the performance of the contract (art. 6.1.b), and not on consent — without transcription, there would be no memo at all, which would mean that consent requested at this stage would not be freely given within the meaning of Article 7(4) of the GDPR (see §3).
• Retention of the audio: unlike the voice message, whose audio is stored in your household (see above), the audio of the dictated memo is not kept on our servers — see §7 for the temporary copy that remains on the caregiver's device while it is being sent.
• What results from it: the voice message is delivered directly to the household, whereas the dictated memo produces only a suggestion (logbook entry, appointment or task) that the caregiver must review and approve before it is saved.

In addition, a demonstration household (explicitly identified on the server side) may be populated each week with fictitious data generated by Claude (fictitious appointments, tasks, messages, logbook entries, contacts and documents) in order to present the features of the service to prospective customers. No real user data is used to produce this content; only the household marked as a demonstration household is concerned and no customer household undergoes this processing.

9.3 Data from Google APIs (Limited Use)

When you connect your Google account (Google Calendar or Google Drive synchronisation), Senior Hub receives data via the Google Workspace APIs. The use of this data is strictly governed:

• It is used only to operate the features you have enabled: displaying and synchronising the household's appointments with your calendar, and synchronising the household's documents with the Drive folder you have chosen.
• To keep this folder and the app consistent, Senior Hub may rename and move files within the Drive folder you have linked. Deleting a document in Senior Hub never destroys a file that comes from your Drive: it leaves the synchronised folder and is moved to a separate folder, shared with your Google account, where you can find it. A file created from Senior Hub, on the other hand, goes to the bin of your Drive.
• It is never used to create, train or improve an artificial intelligence model, whether general-purpose or specialised — neither by Senior Hub nor by our providers. Our AI providers (Anthropic, Groq) do not train their models on the data sent via their APIs.
• It is neither sold nor transferred to third parties for advertising, profiling, market research or creditworthiness assessment purposes.
• An appointment imported from Google Calendar is then treated as a household appointment: it may therefore appear in a summary of the shared family logbook (section 9.1) if the household has enabled that feature. This processing remains subject to all the restrictions above. Google Drive files are never sent to an AI service.
• Senior Hub staff do not read this data, except with your explicit agreement, for security reasons, to comply with a legal obligation, or on aggregated and anonymised data.

Senior Hub's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Senior Hub does not use, transfer or sell Google Workspace API data — raw, aggregated or derived — to develop, train or improve generalized or foundational artificial intelligence or machine learning models.

10. Your rights (GDPR)

In accordance with the General Data Protection Regulation, you have the following rights:

• Access: obtain a copy of your data (export available in Settings > Privacy).
• Rectification: correct your inaccurate data (editing your profile in the app).
• Erasure: delete your account and the associated data (Settings > Delete my account). Deletion is immediate in the app, and for your documents it is also immediate with our storage host: unlike an ordinary deletion (see the table in section 7, row “Deleted documents, photos and voice messages”), a request for erasure under this right immediately erases all the technical copies that this storage normally keeps for up to 90 days, without waiting for that period. Your data remains for at most 35 days in our encrypted backups, until they expire: it is not accessible to anyone there in day-to-day use, it is used only to restore the service after an incident, and if a backup had to be restored, your deletion would be reapplied to it before the service is put back into operation. Only exception: crash reports already sent by the SeniorHub Assistance app remain with Sentry for the duration indicated in section 7; they contain neither name nor email address. When you delete an item you created — a comment, a note — its content is genuinely erased: the household activity log keeps a record of the action (who, when, on which item) but never the text itself.
• Portability: receive your data in a structured and readable format (JSON export).
• Withdrawal of consent: at any time for optional processing (analytics, crashlytics, push notifications) and, for the senior, for the consent to be supported via the app.
• Objection and restriction: object to certain processing or request its restriction.

To exercise these rights, use the features of the app or contact us at privacy@seniorhub.fr.

11. Complaint to the CNIL

If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL):

• Website: www.cnil.fr
• Address: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07

You may also lodge your complaint with the data protection authority of the European Union country where you live (Article 77 GDPR): see §11a for Ireland.

11a. If you live in Ireland

Senior Hub is established in France and your data is hosted in the European Union; some providers process it in the United States (§5 and §6). Outside the European Union, it may be accessible to the authorities of those countries under their laws. To exercise any of the rights below, write to us at privacy@seniorhub.fr or use the features of the app (§10).

Ireland

• Rights: the GDPR applies, with all the rights in §10.
• Where to complain: you may lodge a complaint with the Data Protection Commission (DPC), the Irish authority, instead of the CNIL (Article 77 GDPR): www.dataprotection.ie.
• If there is a data breach: we notify it to the CNIL, our lead authority, where feasible within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people (Article 33 GDPR), and we tell you directly when it is likely to result in a high risk to you (Article 34).

12. Cookies and local storage

Senior Hub uses no advertising cookies and no third-party audience measurement cookies. No consent banner is required for browsing the showcase website, because it loads no external tracker (the Inter fonts are self-hosted, and no third-party analytics is integrated).

To keep you signed in, the web app relies on two strictly necessary cookies, and on no others: sh_refresh, which carries your session and which the page's code cannot read (HttpOnly, Secure, SameSite=Strict, maximum duration 90 days, erased on sign-out), and sh_csrf, which is used to check that your actions really come from our pages. The showcase website, for its part, sets no cookies.

The web app and the showcase website also use the browser's local storage (localStorage), strictly necessary for the service to work, to keep:

• Language preference (keys lang on the showcase website, seniorhub:locale in the web app): to display the interface again in the chosen language on your next visit.
• Identity of the open session (key seniorhub:email_auth_session): your technical identifier, your email address and your name, to show you as signed in again when the page is reloaded. No authentication token is kept there — it lives only in the sh_refresh cookie described above.
• Active household (key seniorhub:active_household_id): to reopen the right household the next time the app is launched.
• Set-up step reached (key seniorhub:household_status): so that you are not offered the creation of a household again once it has been completed.
• Technical session renewal lock (key sh_auth_refresh_lock): a random identifier and an expiry date, to prevent several tabs from renewing your session at the same time. It contains no information about you and expires within a few seconds.
• First name left on the visitor page (key seniorhub:visitorName): only if you have left a note for a family after scanning their QR code, so that you do not have to type your first name again the next time. This first name remains on your device; the note you sent, for its part, is recorded in the household's shared family logbook (see §2.2 and §7).

This data does not leave your browser. You can erase it at any time via your browser's settings or by signing out. The Senior Hub mobile app does not use HTTP cookies; it stores the same information locally via your system's secure native mechanism (iOS Keychain / Android Keystore for tokens). The companion app SeniorHub Simple launcher likewise keeps, only on the phone of the person being helped, the configuration of their home screen (§2.9) when it is not shared with the household: this storage is strictly necessary for the requested functionality and therefore gives rise neither to a request for consent nor to a banner.

13. Changes to this policy

This privacy policy may be updated. In the event of a substantial change, you will be informed via the app. The date of the last update is shown at the top of this page.

An update to the content (such as this one) does not automatically lead to a new request for consent: such a request is triggered only when moving to a new numbered version (the « v » suffix shown at the top of this page), announced via the app when it comes into force.

Contact

For any question relating to the protection of your data: privacy@seniorhub.fr.

Terms of Use | Legal Notices