REC Privacy Policy

Version 1.2 — in force since 15 September 2026

REC is a voice-note application. It therefore processes what is most personal about you after your face: your voice. This policy explains what data is collected, why, how long it is kept, who it is passed on to, and how to take back control of it. It supplements the Terms of Use.

Article 1 — Data controller

The controller, within the meaning of article 4(7) of Regulation (EU) 2016/679 (the “GDPR”), is:

• Name: Marie-Victoire WOLFF
• Legal form and share capital: Natural person — published on a non-professional basis
• Address: not published — non-professional publication; identity and address have been provided to the hosting provider in accordance with article 6-III-2 of French Act No. 2004-575 of 21 June 2004
• Registration: Not registered with the Trade and Companies Register
• VAT number: Not subject to VAT
• Publication director: Marie-Victoire WOLFF
• Contact email address: hello@rectheapp.com

Data protection officer: no data protection officer has been appointed; requests relating to personal data are handled directly by the publisher, at the contact address above

Article 2 — What REC does not do

It is quicker to start here, because it sets the boundaries of everything else. As at the date of this policy:

• REC displays no advertising and passes no data to advertising networks;
• REC embeds no audience measurement tool and no behavioural analytics kit;
• REC does not sell, rent or trade any personal data;
• REC does not use your voice to identify you biometrically (see article 5);
• REC does not use your content to train artificial intelligence models;
• REC places no advertising cookie and no tracker on your device (see article 15);
• REC collects neither your location, nor your contacts, nor your address book.

Article 3 — Data collected

3.1. Data you provide

• Account: email address, username, display name, password.
• Profile: biography, profile picture, display language, whether the account is public or private, haptic feedback setting.
• Content: sound recordings, titles, effects applied, comments, one-to-one or group private messages.
• Preferences: declared interests, keywords you correct on your own notes.

3.2. Data produced by your use of the service

• Interactions: follows, likes, comments, mentions of other users, notices, blocks.
• Plays: for each note you listen to, the furthest position reached and whether the full-play threshold was crossed. This data serves the play counter and resuming playback — it is NOT used for recommendations (see article 11).
• Thematic affinities: one score per keyword, calculated from your explicit interactions.
• Notification token, if you have allowed notifications.
• The version of the Terms of Use accepted and the date of that acceptance.

3.3. Data produced by automated processing

• A text transcript of each note.
• Thematic keywords and general tone inferred from the title and the transcript.
• A graphical representation of the sound signal (waveform).

3.4. Technical data

The application communicates with the server using an authentication token, not cookies.

When you create content — a note, a comment, a message, or your account itself — REC records the IP address and port of the connection used, together with the date and time and the identifier of the content created. This is a legal obligation for hosting providers (article 6-II of French Act No. 2004-575 of 21 June 2004 and Decree No. 2021-1362 of 20 October 2021), whose sole purpose is to answer requisitions from the judicial authorities. This data is kept for one (1) year from the creation of the content, then automatically erased; it is used for no other purpose, is never displayed, and is not recorded for your listens, your likes or your ordinary connections.

Your IP address also appears, as for any online service, in the technical logs kept by the hosting provider, under the conditions of article 9.

Article 4 — Purposes, legal bases and retention periods

Each processing operation serves a specified purpose and rests on an identified legal basis.

4.1. Performance of the contract (article 6(1)(b) GDPR)

This processing is necessary to provide you with the service; objecting to it means being unable to use it.

• Creating and managing the account, authentication — kept for the lifetime of the account.
• Email address verification — the token is destroyed on validation, and after thirty days at the latest.
• Password reset — the token expires after one hour.
• Recording, hosting and distributing your notes to the audience you have chosen — until they are deleted.
• Automatic transcription, keywords and tone — kept with the note.
• Social interactions and messaging — until the content or the account is deleted.
• Play counter and resuming playback — for the lifetime of the account.
• Content recommendation — for the lifetime of the account.

4.2. Consent (article 6(1)(a) GDPR)

• Push notifications: the token is recorded only after your authorisation, given at operating system level. You may withdraw it at any time in your phone’s settings; the token then becomes inoperative.
• Access to the microphone and the photo library: see article 16.

4.3. Legal obligation (article 6(1)(c) GDPR)

• Retention of connection logs, under the conditions of article L. 34-1 of the French Postal and Electronic Communications Code and of Decree No. 2021-1362 — one year.
• Handling of notices and the action taken on them, under Regulation (EU) 2022/2065 and French Act No. 2004-575 of 21 June 2004 — one year from the closure of the notice.
• Responding to requisitions from the competent judicial and administrative authorities.

4.4. Legitimate interest (article 6(1)(f) GDPR)

The interest pursued is the security of the service and of its users, balanced against your rights:

• preventing and detecting abuse, fraud and security breaches — twelve months;
• keeping proof of your acceptance of the Terms of Use — five years from the end of the contractual relationship, the ordinary limitation period;
• establishing, exercising or defending legal claims — for the duration of the proceedings.

Article 4 bis — Invitations

The Service allows you to invite people of your choosing, by sharing a link or by entering an email address.

Sharing a link records nothing: the link contains only your username, and the Publisher has no way of knowing who you send it to.

Entering an email address, on the other hand, records three pieces of information: your account, that address, and the date it was sent. Purpose: sending the message, and allowing the Publisher to check that the feature is not being misused to send unsolicited messages. Legal basis: the Publisher’s legitimate interest (article 6(1)(f) GDPR). You may object under the conditions of article 12.

A single message is sent to that address; no reminder follows. It feeds no mailing list and is used for nothing else.

The Publisher may observe that an invited address now corresponds to an account on the Service. That comparison is made at the moment of consultation, by simple matching, and is recorded nowhere: no link between your account and that of the invited person is kept.

All of this information is deleted no later than one year after it was sent.

Deleting your account anonymises your invitations: the link to your identity is removed, and the invited address remains on its own until it is deleted.

Article 5 — The particular case of your voice

5.1. A voice recording is personal data as soon as it makes it possible to identify you, and the voice is moreover an attribute of personality protected by article 9 of the French Civil Code.

5.2. REC does not, however, carry out any biometric processing. Your recordings are not analysed in order to establish a voiceprint or to identify you uniquely. They therefore do not fall within the special categories of data under article 9 GDPR, whose processing is in principle prohibited.

5.3. The content of your notes may nonetheless reveal sensitive information — opinions, beliefs, health, sexual orientation — because you choose to speak about it. REC neither seeks out nor exploits that information, but cannot prevent it from appearing in a recording you publish. A note published from a public account is accessible to anyone using the service.

5.4. You warrant that you have obtained the consent of the persons whose voice appears in your recordings. Failing that, you are processing their data without a legal basis, and you are answerable for it.

Article 6 — Whether data is mandatory

The data needed to create the account is mandatory: without it, registration is impossible. The biography, the profile picture and the interests are optional; their absence affects only the relevance of recommendations.

Article 7 — Who has access to your data

• Other users, within the limits of what your settings expose: a public account makes your notes accessible to everyone, a private account reserves them for the followers you have approved.
• Authorised persons at the Publisher, strictly within the limits of their duties, in particular for handling notices.
• The processors listed in article 8, on the Publisher’s documented instructions.
• Judicial and administrative authorities, upon a duly issued requisition.

Your private messages are not end-to-end encrypted. The Publisher has the technical ability to access them, and uses it only in the event of a notice, a requisition, or to ensure the security of the service.

Article 8 — Processors and transfers outside the European Union

8.1. The Publisher uses the following processors, each bound by a legal act complying with article 28(3) GDPR:

• Hosting: OVH SAS, a simplified joint-stock company with share capital of €10,174,560, registered with the Lille Métropole Trade and Companies Register under number 424 761 419, whose registered office is at 2 rue Kellermann, 59100 Roubaix, France. Data hosted in the European Union.
• Sending transactional emails: Mailjet SAS (Sinch group), France. Recipient of: your email address and your display name.
• Automatic transcription: ElevenLabs, United States. Recipient of: the sound content of your notes.
• Thematic classification and tone analysis: OpenAI, United States. Recipient of: the title and the transcript of your notes.
• Delivery of notifications: Expo, United States. Recipient of: your notification token and the text of the notification.

8.2. Transfers to the United States are governed by the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) and, where the recipient is certified under it, by the EU—US Data Privacy Framework. A copy of the safeguards in place may be obtained on request at the address given in article 18.

8.3. None of these providers is authorised to use your data for its own purposes, or to keep it beyond what is necessary to perform its service.

Article 9 — Retention and deletion

9.1. A note you delete is placed in a bin and remains restorable by you alone for thirty (30) days. After that period, the sound file is erased.

9.2. Deleting your account entails the erasure of your notes, your messages, your notifications and your personalisation data. Your identifying data — username, name, email address, biography, picture — is irreversibly anonymised rather than the row being deleted: this preserves the coherence of the conversations your correspondents legitimately received, while no data any longer makes it possible to identify you.

9.3. An account inactive for three (3) years is warned by email, and then deleted if there is no login within the following month.

9.4. Data kept under a legal obligation or for the defence of legal claims is kept for the periods stated in article 4, with restricted access, and is no longer used for other purposes.

Article 10 — Security

Passwords are stored as cryptographic hashes and are never accessible in clear text, including to the Publisher. Exchanges between the application and the server are encrypted in transit. Authentication relies on tokens with a limited lifetime. Access to administration tools is restricted and logged.

No system is invulnerable. In the event of a data breach likely to result in a risk to your rights and freedoms, the Publisher informs the CNIL within 72 hours and, where the risk is high, informs you directly, in accordance with articles 33 and 34 GDPR.

Article 11 — Profiling and automated decisions

11.1. The “For you” feed rests on profiling within the meaning of article 4(4) GDPR. Its parameters are: your declared interests, the keywords of the notes, your explicit interactions — likes, comments, follows — and how recent the content is.

11.2. Your plays are deliberately excluded from that calculation: scrolling through a feed does not mean liking what you hear in it. That choice is written into article 12 of the Terms of Use.

11.3. The “Following” feed is subject to no algorithmic personalisation. You may change or clear your interests at any time from your account.

11.4. No decision producing legal effects concerning you or significantly affecting you is taken solely on the basis of automated processing. Any moderation measure may be re-examined by a human, under the conditions of article 11 of the Terms of Use.

Article 12 — Your rights

Under the conditions laid down by the GDPR, you have the following rights:

• Access (article 15): obtain confirmation that data concerning you is being processed and receive a copy of it.
• Rectification (article 16): have inaccurate data corrected, which most fields allow you to do directly from the application.
• Erasure (article 17): obtain the deletion of your data, in particular by deleting your account.
• Restriction (article 18): obtain the freezing of a processing operation, in particular while a challenge is being examined.
• Portability (article 20): receive your data in a structured, commonly used and machine-readable format, or ask for it to be transmitted to another service.
• Objection (article 21): object, on grounds relating to your particular situation, to processing based on legitimate interest.
• Withdrawal of consent (article 7(3)): at any time, without affecting the lawfulness of processing already carried out.

These rights are exercised by email to hello@rectheapp.com. You will receive an answer within one month, extendable by two months where the request is complex, in which case you will be informed. Proof of identity may be requested where there is reasonable doubt as to the identity of the person making the request, and only in that case.

If you consider that your rights are not being respected, you may lodge a complaint with the supervisory authority: the French Data Protection Authority (Commission nationale de l'informatique et des libertés, CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.

Article 13 — Post-mortem directives

In accordance with article 85 of French Act No. 78-17 of 6 January 1978, you may set directives on what is to become of your data after your death, and designate a person to carry them out. Those directives may be sent to the Publisher. Failing that, your heirs may request the closure of the account and the deletion of the data, on proof of their capacity.

Article 14 — Minors

The service is reserved for persons aged at least fifteen (15), the threshold applied in France for a minor’s consent to the processing of their data in the context of an information society service. The Publisher does not knowingly collect data concerning anyone younger; it deletes without delay any account it learns was opened in breach of that rule. Holders of parental authority may report such an account at the address given in article 18.

Article 14 bis — Publicly shared notes

When you share a voice Note by means of a link, a web page accessible without an account is published. It contains your username, your display name, your profile picture where applicable, the title and description of the Note, its duration, its themes, the graphical representation of the sound signal and the recording itself.

That page carries a no-indexing instruction addressed to search engines. The services to which you send the link may nonetheless keep a copy of the preview, over which the Publisher has no power.

Deleting the Note, switching your account to private mode or deleting your account makes the page immediately inaccessible.

This publication concerns only the Notes you have shared yourself, from a public account. Private Messages are never concerned.

Article 15 — Cookies and trackers

The mobile application places no cookie: authentication relies on a token kept in the operating system’s secure storage, not on a browser cookie. No advertising or audience measurement tracker is embedded in it.

The service’s web pages — address verification, password reset, legal documents — place no cookie either. Only the administration area, reserved for authorised persons, uses a session cookie strictly necessary for authentication, exempt from consent under article 82 of French Act No. 78-17. No consent banner is therefore required.

Article 16 — Permissions requested on your device

• Microphone: requested at the moment you record a note, and for that purpose alone. No recording is made outside an explicit action on your part.
• Photo library: requested only when you choose a profile picture. Only the selected image is read.
• Notifications: requested in order to alert you to interactions concerning you.

Each of these permissions may be refused when requested, or withdrawn at any time from your phone’s settings. Refusing the microphone prevents recording; the other two refusals do not affect the remaining features.

Article 17 — Changes to this policy

This policy may be amended to take account of a change in the service or in regulations. Any substantial change is notified to you by email or in the application at least thirty (30) days before it takes effect. The version in force is always accessible from the application and from the service’s website, with its version number and its date.

Article 18 — Contact

Any question or request relating to your data may be sent to hello@rectheapp.com. You will receive an answer within the periods stated in article 12.

Article 19 — Language

This policy is drawn up in French. This English text is a translation provided for information only; in the event of any discrepancy, the French version prevails.