← Back to home

Privacy policy

Last updated: 21 September 2026

This policy describes how BAUGEY MATHEO, trading as DEVOLIM (the publisher, "we"), processes the personal data of users of the Estimation Objet mobile app and of visitors to estimationobjet.devolim.fr. It is drawn up in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and the French Data Protection Act of 6 January 1978 as amended.

1. Data controller

BAUGEY MATHEO, trading as DEVOLIM
248 rue de Bègles, 33800 Bordeaux, France
Company number (SIREN): 948 000 757
Email: contact.estimationobjet@devolim.fr

Given the nature and scale of the processing carried out, appointing a data protection officer is not required under Article 37 GDPR. Any request relating to personal data may be sent to the address above.

2. Principles

The app was designed to process as little data as possible, in line with the principles of data minimisation and data protection by design (Articles 5 and 25 GDPR). In practice:

• You create no account: no name, no email address, no password, no phone number.
• Your inventory does not leave your phone: objects, records, photos, collections, history and conversations are stored locally on the device.
• Photos sent for an estimate are not kept once the analysis is over.
• No advertising, no advertising tracker, no advertising identifier, no tracking across apps or websites.
• No data is sold, rented or transferred to third parties for commercial purposes.
• Processing takes place in Europe: the servers and the analysis model are located in the European Union.

3. Data processed

3.1 Data kept on your device

The following is stored in the app's private storage and transmitted to no one: the photos of your objects and their thumbnails, the estimate records, your collections, the history of your finds, objects set aside, your conversations with Filou, the listings written for you, and your settings (market, language, currency, sounds, valuable object threshold).

Where applicable, this data is included in your phone's backup: iCloud backup on iOS, Google automatic backup on Android, both managed by Apple or Google under your own account and according to your system settings. On Android, photos are excluded from that backup.

Uninstalling the app erases all of it. It can also be erased at any time from Settings, Your data, Delete my data, or exported as JSON from the same screen.

3.2 Data transmitted when an object is estimated

The analysis cannot run on the phone: it requires a model that only a server can execute. When you start an estimate, the following is sent to our server functions, located in Belgium (europe-west1 region):

• the photos of the object, reduced to 1,568 pixels on their longest side;
• the details you entered: the name you gave the object, notes, dimensions, answers to the questions asked;
• the market you selected (the country where you would sell), the language and the display currency;
• an anonymous technical identifier, created at first launch (Firebase anonymous authentication). It contains no identity data and is linked to no profile;
• an attestation token (Firebase App Check), proving that the call comes from a genuine installation of the app;
• your IP address, which any internet connection transmits by nature. It is not stored in the clear: it is used to compute a truncated SHA-256 fingerprint, used as an anti-abuse counter.

The same rules apply to conversations with Filou (your message and, if you attached it, the content of the object record) and to writing a listing (the characteristics of the record).

If you write to us from within the app, the text of your message, the app version and the platform are sent, so that we can give you a useful answer.

3.3 What is never collected

Name, postal address, email address (unless you write to us), phone number, location, address book, calendar, advertising identifier, browsing history, health data. The app does not request the iOS tracking permission (App Tracking Transparency), for the simple reason that it tracks no one.

4. Legal bases

5. Recipients and processors

Data is accessible only to the publisher and to the technical providers below, which act on instruction and under a processing agreement within the meaning of Article 28 GDPR.

No data is sold, rented or otherwise transferred to third parties for commercial purposes.

6. Transfers outside the European Union

The processing of photos and the execution of the model take place within the European Union, and the database is located in the Europe multi-region. That said, some providers belong to groups established in the United States, and access from a third country cannot be ruled out, in particular for maintenance operations.

Any such transfers are governed by the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) and, for certified US entities, by the adequacy decision of 10 July 2023 on the EU, US Data Privacy Framework, supplemented by the technical measures described in section 11.

7. Retention periods

8. Artificial intelligence analysis

The estimate is produced by an artificial intelligence system (Google Gemini models, run on Vertex AI, European Union endpoint). We state this expressly, including for conversations with Filou: you are talking to a machine, never to a person.

The model provider acts as a processor. Your photos and the details you enter are not used to train or improve the models: the terms applicable to Google Cloud's professional offering prohibit it, and we make no other use of them ourselves.

For objects likely to have some value, the model runs a web search to find comparable sales. That search uses words describing the object, never your photos.

The estimate is automated processing, but it produces no legal effect concerning you and does not significantly affect you: it conditions access to no right, no credit, no contract. It therefore does not fall under Article 22 GDPR. It can be wrong, and its limits are set out in the disclaimer.

9. Subscriptions and purchases

Subscriptions are taken out and collected by Apple or Google within their respective stores. The publisher sees neither your identity, nor your address, nor your payment details: it only receives the information that a subscription is active, and until which date, linked to the anonymous identifier of your installation. RevenueCat provides that link.

Restoring a subscription on a new device goes through your store account. The data the store processes on that occasion is governed by Apple's or Google's own privacy policy, as controllers.

10. Usage statistics and crash reports

The app measures its own usage (screens opened, features used, estimates started) and receives a report when it closes unexpectedly. This information is used only to improve it. No photo, no estimate result and no conversation content is included. It is neither combined with other sources nor used for advertising purposes.

This measurement is on by default and can be switched off at any time in Settings, Your data, Usage statistics. Switching it off takes effect immediately and constitutes an objection within the meaning of Article 21 GDPR.

11. Security

Exchanges between the app and the servers are encrypted in transit (TLS). Access to the server functions is protected by an app integrity attestation (App Check, App Attest on iOS and Play Integrity on Android) and by mandatory technical authentication. The database is closed to reads and writes from outside: only the server functions access it. IP addresses are only processed as fingerprints, photos are never stored, and administrative access is limited to the publisher, with two-factor authentication.

In the event of a data breach likely to result in a risk to your rights and freedoms, the CNIL would be notified within 72 hours and, where the risk is high, the persons concerned would be informed (Articles 33 and 34 GDPR).

12. Website

This website sets no cookies and uses no analytics tool, no social media button and no embedded video. Fonts are served from this website's own server: no request is made to a third party when you visit, and your IP address is therefore disclosed to no one other than the host. That is why you are not shown a consent banner.

The host, LWS, keeps technical connection logs (IP address, date, page requested) for twelve months, for security purposes and in accordance with its legal obligations.

13. Your rights

Under Articles 15 to 22 GDPR, you have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to give instructions concerning your data after your death (Article 85 of the French Data Protection Act). These rights can be exercised by email at contact.estimationobjet@devolim.fr. We reply within one month, extendable by two further months for complex requests.

Two points follow from the way the app is built. First, the data kept on your phone is in your hands: you delete it from Settings, Your data, Delete my data, or by uninstalling the app, without having to write to us, and you export it from the same screen. Second, the little data kept on the server side is linked only to an anonymous identifier: without that identifier, we have no way of knowing which data concerns you, and Article 11 GDPR then relieves us of the obligation to keep additional information for the sole purpose of identifying you. To exercise your rights over that data, please send us the technical identifier of your installation, shown at the bottom of the app settings, under the version number: tapping it copies it.

14. Complaint to the CNIL

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at cnil.fr.

15. Minors

The app is not intended for children. In France, the age of digital consent is set at fifteen by Article 7-1 of the French Data Protection Act: below that age, processing requires the authorisation of the holder of parental authority. We do not knowingly collect data concerning a child under fifteen. A legal guardian who becomes aware of such a situation may write to us: the data would be deleted without delay.

16. Changes

This policy may be amended to reflect legal or technical developments. The last update date appears at the top of this page; substantial changes are notified within the app.

This is a translation provided for convenience. In the event of any discrepancy, the French version prevails.