1The short version
- We collect what the service needs to work, and nothing for advertising.
- No analytics scripts, no advertising pixels, no third-party trackers on this website.
- We do not sell your data, rent it, or share it with advertisers. Ever.
- Your study data, notes, progress, answers, is yours; we use it to run the service, not to profile you.
- We never see your card number. Payment providers handle that.
- You can get a copy of everything, or have it all deleted, by sending one email.
2Who is responsible
The data controller is Avyx Group, trading as Pilote Autrement, whose registration details are on the Legal Notice.
For any privacy question, or to exercise a right, write to info@vectoredapp.com.
We have not appointed a Data Protection Officer: at our size and with the kind of data we handle, Article 37 GDPR does not require one. The address above reaches the person who is accountable for this.
3What we collect
If you use this website
The website has no account and takes no payment. It collected something in one case only, before the Android app came out: if you asked to be told when Vectored came to Android. That form sent:
- Your email address, so we can write to you.
- The language of the page and of your browser, so we write in a language you read.
- Where you came from, a short tag such as android:instagram, taken from the link you followed.
- Your browser's user-agent string, which says the kind of phone and browser you used.
- The date and time you signed up.
We use it for one confirmation and one email telling you the Android app is out. Nothing else, and no account is created. To be taken off the list, reply remove to either email, or write to us.
The early access list this site used to run before the iPhone launch is closed. If you signed up back then, your address is still in that table until we delete it, and you can have it removed today by writing to us.
If you create an account
- Your email address and a hashed password, we never store the password itself.
- Your licence and subscription status, which tier is active, and until when.
- Your study data, modules read, sheets completed, question attempts and scores, notes, flashcards, planning, exam dates you enter.
- Your settings, interface language, notification preferences.
If you use Captain
- Your questions, and the context of the sheet you had open when you asked.
- The answers returned, so the conversation still exists when you come back to it.
If you buy something
- A transaction reference and a receipt, what was bought, when, for how much.
- Billing country, for VAT.
- For in-app purchases, a signed Apple receipt identifying the subscription and its expiry date.
We never receive your card number, expiry date or security code. Those go straight to Apple or to our payment provider.
Automatically, when the app or site runs
- Technical logs, IP address, timestamp, and the request made, kept briefly by our hosting and database providers to detect abuse and diagnose failures.
- Crash and error reports, if the app fails, so we can fix it.
- Usage events in the app, such as a screen opened, a practice session finished or the subscription page shown. They never contain your answers, your notes or anything you typed, and they are tied to your account only to understand where the app needs fixing.
We do not collect your precise location, your contacts, your photos, or your device identifiers for advertising.
4Why, and on what legal basis
| What | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Your address on the Android list | Tell you when the Android app is out | Consent, 6(1)(a), withdrawn by replying remove |
| Usage events in the app | Find what is broken or confusing and fix it | Legitimate interests, 6(1)(f) |
| Account credentials | Let you sign in and sync across devices | Contract, 6(1)(b) |
| Study data | Show your progress, run the planner and the analytics | Contract, 6(1)(b) |
| Captain conversations | Answer your question and keep the thread | Contract, 6(1)(b) |
| Purchases and receipts | Grant access, handle refunds, keep accounts | Contract, 6(1)(b); legal obligation, 6(1)(c) |
| Support emails | Answer you and keep a record of the case | Contract, 6(1)(b); legitimate interests, 6(1)(f) |
| Technical logs | Keep the service up, detect abuse and fraud | Legitimate interests, 6(1)(f) |
| Aggregated statistics | Find the questions everyone fails and rewrite the sheet | Legitimate interests, 6(1)(f), on anonymised data |
| Product emails | Tell you about new modules and features | Consent, 6(1)(a), withdrawable in one click |
Where we rely on legitimate interests we have weighed them against your rights, and we will explain the assessment if you ask. Where we rely on consent, you can withdraw it at any time, that does not affect what we lawfully did before you withdrew it.
Service emails, a receipt, a password reset, a renewal reminder, a change to these terms, are not marketing and cannot be unsubscribed from while you have an account.
5Captain and AI
When you ask Captain a question, your question and the relevant part of the sheet you have open are sent to a third-party language-model provider, Anthropic (Claude), which generates the answer and returns it. Your name and email address are not sent with it.
Your conversations are not used to train anyone's model. Our agreement with the provider covers processing your prompt to produce your answer and nothing else. The provider may hold the request briefly for abuse monitoring, then deletes it.
Conversations are stored in your account so you can come back to them, and you can delete any of them from the app. Deleting a conversation removes it from our database. Any conversation is also deleted automatically 90 days after its last message.
Captain does not make any decision that produces a legal effect for you, so Article 22 GDPR does not apply. Nothing it says affects your subscription, your access or your money.
Please do not paste personal or confidential information into it beyond what your question actually needs.
6Payments
Inside the app: Apple takes the payment. Apple is the merchant of record; it holds your payment details, and it decides what it collects about the transaction under its own privacy policy. We receive a signed receipt telling us which subscription is active and when it expires, no card data, no billing address.
On this website: nothing is sold and no payment is taken. The site only links to the App Store.
Invoices and transaction records are kept for 10 years, because commercial and tax law requires it (Article L123-22 of the French Commercial Code). That obligation survives your account deletion.
7Who else processes it
We use a small number of providers. Each is bound by a data-processing agreement under Article 28 GDPR, may only act on our instructions, and may not use your data for its own purposes.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, authentication, file storage, edge functions | United Kingdom |
| Netlify, Inc. | Serving this website | United States |
| Apple | App distribution, in-app payments, subscription receipts | Ireland / United States |
| Anthropic (Claude) | Generating Captain's answers | United States |
| Resend | Sending account emails and the Android list emails | Ireland (sending) / United States (company) |
Beyond these, we disclose personal data only where the law requires it, a court order, a valid request from an authority, or to establish or defend a legal claim. If the business is ever sold, your data would transfer with it and you would be told before it happened.
8Where it is stored
Accounts, study data, purchases and Captain conversations live in a PostgreSQL database
operated by Supabase in the United Kingdom (region eu-west-2,
London). The UK benefits from a European Commission adequacy decision, so transfers
there need no additional safeguard.
Some providers, Apple, the system font stack, Resend and possibly the AI provider, process data in the United States. Those transfers rely on the EU, US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses. We can send you a copy of the clauses on request.
The Android list is write-only for the public key the page uses: the site can add an address, and cannot read a single one back. Neither your address nor anyone else's can be extracted through the website itself.
9How long we keep it
| Data | Kept for |
|---|---|
| Address on the Android list | Deleted on request, and in any case no later than 24 months after signing up |
| Usage events in the app | While your account is open, then deleted with it |
| Early access address, from the closed list | Deleted on request, and in any case no later than 24 months after signing up |
| Account and study data | While your account is open, then 30 days, then deleted |
| Captain conversations | 90 days after the last message, then deleted automatically. Sooner if you delete them or close your account |
| Invoices and transaction records | 10 years, legal obligation, survives deletion |
| Support emails | 3 years after the case is closed |
| Technical and security logs | Up to 90 days |
| Aggregated anonymous statistics | Indefinitely, no longer personal data |
The 30-day pause after you delete your account is a safety net: it lets us undo an accidental deletion if you tell us quickly. After that the data is gone and cannot be recovered, apart from the invoices we are legally required to keep.
10Your rights
Under the GDPR you have the right to:
- Access, get a copy of everything we hold about you (Art. 15).
- Rectification, have anything wrong corrected (Art. 16).
- Erasure, have it deleted (Art. 17), except what we must keep by law.
- Restriction, have us freeze processing while a dispute is resolved (Art. 18).
- Portability, receive your data in a machine-readable format, or have it sent elsewhere (Art. 20).
- Objection, object to processing based on legitimate interests (Art. 21).
- Withdraw consent, at any time, for anything based on consent (Art. 7(3)).
- Set instructions for what happens to your data after your death (Art. 85 of the French Data Protection Act).
Email info@vectoredapp.com. We answer within one month, and tell you if a complex request needs longer. It is free unless a request is manifestly unfounded or repetitive. We may ask you to confirm your identity, only to be sure we are not handing your data to someone else.
If you think we have mishandled your data you can complain to your national supervisory authority. In France that is the CNIL, cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07. We would rather you told us first, but it is your right either way.
11Security
- Everything travels over TLS. Nothing is sent in the clear.
- Passwords are hashed, never stored or logged in readable form.
- Database access is enforced row by row: your rows are readable only by your authenticated session.
- The public key used by the website can add an address to the Android list and nothing else.
- Card details never reach our servers.
- Backups are encrypted.
No system is perfectly secure. If a breach ever affects your data and creates a risk to your rights, we will notify the CNIL within 72 hours and tell you directly where the risk is high, as Articles 33 and 34 require.
12Children
The service is not intended for children under 16, and accounts are not available below that age, see the Terms of Use. We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will delete it.
14Changes
This policy will change as the product does, a new provider, a new feature, a new category of data. The date at the top always shows the current version.
For a change that materially affects you, a new purpose, a new recipient, a longer retention, we will tell you by email or in the app before it takes effect, and ask for your consent again where consent is the basis.
15Contact
info@vectoredapp.com, for a copy of your data, a correction, a deletion, or any question about this policy. Postal address on the Legal Notice.