Privacy Policy
Last updated: 11 September 2026 · Version française
1. Who is responsible for your data
The Keeps mobile application (the “App”) is published by MEMORY MAP, a French simplified joint-stock company with a single shareholder (SASU) with share capital of 1,000 euros, whose registered office is at 18 avenue Émile Deschanel, 75007 Paris, France, registered under number 994 103 257 R.C.S. Paris.
The publisher acts as data controller within the meaning of Regulation (EU) 2016/679 (“GDPR”) for all processing described in this policy.
| Contact | Details |
|---|---|
| Data protection enquiries | contact@keepsmap.com |
| Data protection officer | Bruno Déborrah, President of MEMORY MAP, 18 avenue Émile Deschanel, 75007 Paris, France |
| Postal address | 18 avenue Émile Deschanel, 75007 Paris, France |
2. The data we process
We process only the data necessary to operate the App. We do not sell personal data.
| Category | Data | Source |
|---|---|---|
| Identity and account | Email address, hashed password, username, profile photograph, biography, technical identifier of the Google or Apple account when used to sign in | Provided by you |
| Content | Memories (title, description, photographs, categories, tags), albums, drafts, visibility status | Provided by you |
| Location | Device position when a memory is created, where you allow it; place entered manually; approximate position used to show nearby public memories | Device, with your permission |
| In-app social activity | Accounts followed and followers, saved memories, searches performed, reports and blocks | Generated by your use |
| Subscription | Premium status, plan purchased, start and expiry dates, transaction identifier provided by the store | Apple / Google |
| Notifications | Push notification token, notification preferences | Device |
| Technical data | Device type and model, operating system, app version, language, connection logs, IP address, error identifiers | Generated automatically |
| Analytics | Anonymised or pseudonymised usage events (screens viewed, actions taken), installation identifier | Collected with your consent |
We collect no payment card data. Subscription payments are handled entirely by the Apple App Store or the Google Play Store, which act as sellers and as controllers for those transactions.
3. Why we process it and on what basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Create and manage your account, authenticate you | Performance of the contract (Art. 6.1.b GDPR) | Life of the account |
| Create, store and display your memories, albums and drafts | Performance of the contract | Life of the account |
| Attach a memory to a place and show it on the map | Consent for precise location (Art. 6.1.a), withdrawable at any time | Life of the memory |
| Manage follows, followers and the discovery feed | Performance of the contract | Life of the account |
| Manage your Premium subscription and entitlements | Performance of the contract | 10 years (accounting supporting records) |
| Send you notifications about your account activity | Consent (system permission) | Until permission is withdrawn |
| Ensure security, prevent fraud and abuse | Legitimate interest (Art. 6.1.f) | 12 months |
| Handle reports and moderate illegal content | Legal obligation (Art. 6.1.c) and legitimate interest | 1 year from when the report was handled |
| Measure audience and improve the app | Consent (Art. 6.1.a) | 14 months |
| Respond to your requests and handle your rights | Legal obligation | 3 years after the last exchange |
We make no decision producing legal effects concerning you based solely on automated processing, and we carry out no advertising profiling.
4. Location: what it means in practice
Location is captured only when you create a memory and only if you have granted the corresponding permission. You may enter a place manually instead of using your position, and withdraw the permission at any time in your device settings.
When you publish a memory publicly, the attached place becomes visible to other users, on the map, in search results and in the discovery feed. Think carefully before attaching a public memory to your home, your workplace, or a place frequented by your family or by minors.
A memory saved as a draft is never published or indexed.
5. iOS: App Tracking Transparency
On iOS, the App displays Apple’s App Tracking Transparency prompt before any tracking that could be linked to an advertising identifier. If you decline, no tracking identifier is used and any audience measurement remains limited to data unconnected to your advertising identity.
On both platforms, a consent screen lets you accept or decline audience measurement, and you may change your choice at any time in the App settings.
6. Who has access to your data
Your data is accessible to the publisher’s authorised staff and to technical providers acting as processors, strictly within the scope of their assignment:
| Recipient | Role | Processing location |
|---|---|---|
| Supabase Pte. Ltd. | Hosting of the database, authentication and photographs | Europe |
| Cloudflare, Inc. | Domain name and content delivery | United States |
| Google Ireland Ltd. — Google Maps | Map display and place search | European Union and United States |
| Google Ireland Ltd. — Firebase | Audience measurement and push notifications | European Union and United States |
| Apple Distribution International | Apple sign-in, in-app purchases, notifications | European Union and United States |
| Google Play | In-app purchases and distribution | European Union and United States |
| Digital Unicorn | Corrective maintenance and technical support, strictly controlled access | France |
Your data may also be disclosed to administrative or judicial authorities where the law requires it.
Content you publish publicly is by nature accessible to other users of the App, who may save it to their own space.
7. Transfers outside the European Union
Some of the providers listed above may process data outside the European Union, in particular in the United States. Such transfers are governed by the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional technical measures, or by an adequacy decision where the provider is covered by one.
A copy of the applicable safeguards can be obtained on request at the address given in section 1.
8. How long we keep it
Your data is kept for the life of your account. When the account is deleted:
- your profile, memories, albums, drafts and follows are removed from our production systems within thirty (30) days;
- copies held in our encrypted backups are erased at the end of the rotation cycle, i.e. thirty (30) days;
- connection logs are kept for twelve (12) months for legal compliance and service security;
- accounting records relating to a subscription are kept for the applicable statutory period;
- data strictly necessary to establish, exercise or defend legal claims is kept until the end of the proceedings.
An account left inactive for three (3) years is sent a reminder; absent a reply, it is deleted.
9. Your rights
Under the GDPR you have the following rights:
- access to your data and to obtain a copy;
- rectification of inaccurate or incomplete data;
- erasure of your data, which you can exercise directly through the account deletion feature in the App;
- restriction of processing;
- objection to processing based on our legitimate interest;
- portability of the data you provided to us, in a structured, machine-readable format;
- withdrawal of your consent at any time, without affecting the lawfulness of processing already carried out;
- instructions regarding the fate of your data after your death.
These rights may be exercised at contact@keepsmap.com. We reply within one month, extendable by two months for complex requests. Proof of identity may be requested where there is reasonable doubt as to your identity.
You may lodge a complaint with the French data protection authority (CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07) or with the supervisory authority of your country of residence.
10. Security
We implement appropriate technical and organisational measures: encryption of communications, password hashing, environment segregation, access control, access logging and regular backups.
In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you in accordance with Article 34 GDPR.
11. Minors
The App is not intended for people under fifteen (15), or a higher age where local law requires it. We do not knowingly collect data about people below that age. If you become aware that an account has been created by a minor in breach of this rule, write to us at contact@keepsmap.com and the account will be deleted.
12. Changes to this policy
This policy may be amended to reflect legal, technical or functional developments. Any material change is notified to you in the App or by email before it takes effect. The date of the latest update appears at the top of this document.
13. The keepsmap.com website
The keepsmap.com website, which presents the App, has no forms, sets no cookies and uses no audience measurement tool; its fonts are hosted on its own server. The website host keeps no technical logs (IP address, date and time, page requested, browser). The “Suivre @keepsmap” buttons are plain links to Instagram: no data is sent to Meta unless you click.