1. Who processes your data?
Froggies Lab, represented by Charly Berthet, is the controller for processing related to its website, CulminApp accounts, customer relationships and billing. Contact: contact@culminapp.com; registered office and registration details appear in the Legal notice.
For personal data entrusted to it by customers to analyse their applications, Froggies Lab acts as a processor on their instructions. The data processing agreement governs this role. Aggregated statistics are anonymous only if they can no longer reasonably identify an individual.
2. Data and sources
- Contract acceptance: professional-use confirmation, accepted terms version and acceptance date.
- Account: name, email address, account identifier, authentication information and preferences.
- Connections: identifiers of authorised accounts and applications, permissions, access and refresh tokens, and connection keys where that method is used.
- Analyses: campaigns, ad groups, keywords, search terms, dates, countries, spending, installs, aggregated revenue, cohorts, annotations and histories from Apple Ads and RevenueCat.
- Billing: billing identity and address, VAT number, currency, Stripe identifiers, payment status, invoices and spending used to calculate the fee. Full payment card details are processed by Stripe.
- Assistant and support: questions, answers, relevant context, support messages and data you choose to include.
- Waitlist: name, email address, company, monthly revenue range, team size, campaign parameters in the URL, landing page and referring page.
- Technical operation: IP address, browser information, requests, errors, connection and security logs, to the extent recorded by the services used.
Data comes from you, your browser and the services you authorise. The intended analysis integration uses reports and aggregates; it does not require a named list of your applications’ subscribers. Avoid unnecessary personal data in free-text fields.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create accounts and provide the trial, analyses and requested support | Performance of the contract or pre-contractual steps for sole traders contracting in their professional capacity; legitimate interest in serving the organisation for its representatives. |
| Manage the waitlist and respond to access requests | Requested pre-contractual steps; legitimate interest in managing an organisation’s business contacts. |
| Bill, collect payments and retain accounting records | Contract, legal accounting and tax obligations; legitimate interest in debt recovery. |
| Protect accounts, prevent abuse and diagnose incidents | Legitimate interest in the security and continuity of the service. |
| Send business marketing updates relevant to your activity | Legitimate interest where permitted by law, with a simple opt-out; prior consent in other cases, including marketing to individuals where required. Joining the waitlist does not constitute consent to a general newsletter. |
| Handle requests to exercise data protection rights | Legal data protection obligations. |
| Process data entrusted by a customer | The customer’s documented instructions; the customer determines its own legal basis and the information provided to individuals. |
Fields marked as required are necessary for the relevant request or service. Without them, account creation, waitlist registration or billing may not be possible. Marketing messages include a way to opt out; you may also write to us. Opting out of marketing does not stop messages necessary for your subscription.
We keep contractual acceptance records to administer the business agreement and, on the basis of our legitimate interest, establish and defend legal claims. For representatives who are not personally party to the contract, account administration relies on our legitimate interest in managing the business relationship.
4. Who receives your data?
Access is restricted to authorised people at Froggies Lab and the providers needed for the following operations:
- Google Firebase: website hosting and form processing; Google Fonts: delivery of fonts, receiving technical request information.
- Vercel and Supabase: application infrastructure, authentication and database, depending on the production deployment.
- Stripe: payments, subscriptions, invoices and fraud prevention. Stripe may also act for its own regulatory obligations under its terms.
- Apple Ads and RevenueCat: data from accounts you connect, subject to their permissions and their own policies.
- OpenAI: generation of assistant answers when you send a question.
- Crisp: support messaging on the marketing website.
- Brevo: waitlist contact management and emails; Slack: internal registration notifications containing name, email, company, and revenue and team-size ranges.
Data may also be disclosed to advisers, accounting providers or competent authorities where necessary to meet a legal obligation or defend a legal right. We do not sell your personal data.
5. How the AI assistant works
Opening the dashboard or chat panel does not, by itself, trigger an AI request. When you send a message, the service transmits your question, part of the conversation history and relevant analysis context: selected settings, metrics, campaigns, keywords, search terms, changes or relevant annotations. Names and free-text content in these items may contain personal data you have entered.
The application asks the API not to save responses as persistent objects. This does not guarantee that the provider retains no data at all, particularly in security logs; the API account terms and data processing agreement must be taken into account. CulminApp does not use conversations to train its own model.
The visible history is kept in the browser tab’s session storage, with a 24-hour expiry enforced by the application and a maximum of 30 conversations per user per tab. Server logs include usage and error information. The assistant does not make decisions producing legal effects on you and does not automatically change your campaigns.
6. Retention periods
The periods below are the proposed retention policy for the service. Their implementation and backup retention periods must be validated before this version is published.
- Account and analysis data: for the contractual relationship, then deleted or returned within 30 days of account closure, except for legally required archives. Stopping renewal alone does not close the account.
- Prospects and waitlist: up to three years from the prospect’s last active contact, or until an applicable deletion or objection request.
- Support: up to two years after the request is closed, unless a dispute requires separate retention.
- Security logs: up to six months, unless an incident justifies longer, targeted retention.
- Accounting records and invoices: ten years from the end of the relevant financial year. Contractual records needed as evidence are archived for the applicable limitation period, generally five years.
The retention and deletion rules also apply to copies, including backups; keeping a backup does not justify indefinite retention. Copies and logs kept by a provider for its own obligations follow its applicable legal rules. Data involved in a dispute may be kept until the dispute is resolved and applicable appeal periods have expired.
7. Location and international transfers
Some providers operate internationally and may process data or make it accessible outside the European Economic Area (EEA). Hosting in a European region does not rule out support access or certain transfers.
A transfer subject to the GDPR must be covered by an adequacy decision applicable to the recipient and processing, or by appropriate safeguards, including European Commission standard contractual clauses with supplementary measures where necessary. A provider’s certification must not be assumed.
To complete before publication: contracting entities, active regions, countries of access, safeguards actually agreed and provider retention periods. You may request the relevant information and a copy of the safeguards, subject to protected confidential information, at our contact address.
8. Your rights and requests
You may request access to your data, its rectification, erasure or restriction of processing under the statutory conditions. You may object to processing based on legitimate interests on grounds relating to your situation, and to direct marketing at any time. Portability applies to data you have provided that is processed automatically on the basis of consent or a contract. Consent may be withdrawn at any time without affecting the lawfulness of earlier processing. You may also give instructions about your data after your death under French law.
Write to contact@culminapp.com from the email address associated with your account and describe your request. Proof of identity is requested only where there is reasonable doubt. We generally respond within one month. This period may be extended by two months for complex or numerous requests, with reasons provided during the first month.
If your request concerns an application operated by a CulminApp customer, first contact its publisher, who is the controller; we will assist where needed. You may lodge a complaint with your competent supervisory authority.
9. Security and updates
Planned measures include access controls, isolation of data by user, application-level encryption of connection tokens and permission validation. They must be accompanied by appropriate operational measures and do not eliminate all risk.
Cookies and browser storage are described below. Material updates to this policy are communicated through an appropriate channel.
Contact: contact@culminapp.com