Privacy policy (application)

1. Data controller

The data controller is Mes Chasses (sole trader, entrepreneur individuel), 4 rue des Grandes Vignes, 44190 Clisson, France, SIRET 88977838700031. Contact: [email protected]. No Data Protection Officer (DPO) has been appointed; requests relating to your data are handled at this address.

Role allocation. For data that a hunting organisation (ACCA, society, association, hunting ground, private hunting) records about its own members and participants (identity, contact details, licence, insurance, harvests, positions), the organisation is the data controller and Mes Chasses acts as processor within the meaning of Article 28 of the GDPR, on its behalf and according to its instructions. For data relating to its own customer management (subscriber account, billing), Mes Chasses is the data controller.

2. Data we collect

3. Purposes and legal bases

• Providing the service (hunt management, events, maps, address book): contract performance.
• Real-time location and safety: consent (see §4).
• Hunting licence scan and verification: consent (sensitive data).
• Contact access to build your address book: consent.
• Push notifications: consent.
• Measuring the effectiveness of our ads and displaying them on social networks (Facebook, Instagram): consent (see §12).
• Sending you your hunting stands by SMS: contract performance (the message is sent when the organiser validates the hunt’s stand allocations).
• Sending you your hunting stands by WhatsApp: consent (see §6).
• Payments (participations, subscriptions): contract performance / legal accounting obligation.
• Security, fraud prevention, usage statistics and fault correction: legitimate interest.

4. Location data (geolocation), including in the background

The application collects your precise GPS position in two use cases only, and only during those sessions:

1. Live hunt: when you join a live hunt, your position is collected and shared in real time with other participants of that hunt, for safety purposes (location in an emergency, alert on leaving a zone or entering a protected zone) and coordination.
2. Blood tracking: when you conduct a blood tracking search, your position is recorded to trace your progress in order to find a wounded animal.

Background collection. For these two features, the position is collected even when the application is in the background, closed or the screen is locked (for example, phone in your pocket during the driven hunt). This collection takes place via a foreground service indicated by a persistent notification, and only during an active live hunt or blood tracking session.

Consent. No location data is collected without your explicit consent: an information screen is shown before any permission request, and activating tracking requires your acceptance. You can refuse (observer mode) or revoke the permission at any time in your device settings; tracking automatically stops at the end of the live hunt or when the blood tracking search is closed.

We do not sell your location data, use it for advertising purposes, or share it with any third party outside the participants of the same hunt.

5. Sensitive data

The hunting licence, insurance certificate (and their scans) and hunting ground treasury IBAN are sensitive data, collected with your consent, encrypted, and accessible only to authorised persons. The licence scan is read automatically to pre-fill information; the image is not used for other purposes.

5 bis. Your hunting licence: who sees it, why, for how long

You can record your hunting licence, validation and insurance in Mes Chasses. Apart from the sharing link (see below), this information is only visible to:

• yourself;
• the committee of a hunting ground of which you are an active member (administrator, owner, managers), to maintain the member register and verify compliance before hunts. Access covers your entire licence, including your date of birth, address and documents. It ends as soon as you are no longer a member of the hunting ground;
• the organisation of a hunt to which you are invited and have confirmed, or at which you are marked present (hunt organiser, hunting ground owner and managers), to verify your licence, validation and insurance before the driven hunt. Access lasts until the end of the day after the hunt, Paris time. After this period, the organisation only sees whether you were compliant on the day of the hunt (yes or no);
• the Mes Chasses team, solely to resolve a support issue.

You can also give your licence to someone who does not have Mes Chasses, an organiser for example. You decide, from the application: you create a link valid for 7 days, 30 days or until the end of the hunting season (30 June). Anyone with this link, without an account or application, sees: your name; your licence number, its country, type, date of issue and issuing authority, with, for a foreign licence, its validity dates and season; your season validation (number, type, dates, small game and big game departments); your insurance (insurer, number, expiry); and whether your licence is compliant or not. They never see your date of birth, address, IDGU or documents. The information is read live: it shows the current state of your licence. Only one link is active at a time, and creating a new one deactivates the old one. You can deactivate it whenever you want. It also stops working if you delete your licence or if you request deletion of your account. Each opening of the link is logged.

No one else has access. Adding someone to your address book, even linked to your account, does not give access to your licence. If the record is linked to your account, the person who has you in their address book only sees whether your papers are in order: “Up to date”, “Expired” or “Not provided” for the licence, the validation and the insurance. They never see a number, a date or the name of your insurer. Documents shared with hunt participants never show your licence, validation or insurance number. The attendance sheet is reserved for the hunt organisation and confirmed or present participants, and its licence numbers disappear after the day following the hunt, except for hunting ground members.

Each consultation of your licence by a third party is logged: the person’s account (if any), date, purpose (licence verification for a hunt, hunt documents, attendance sheet, hunting ground member records, opening of your sharing link), and the hunt or hunting ground concerned. You can view this log in your account (on web, Licence tab; in the app, Account, Licence, Who sees my licence). It shows the hunting ground and, where applicable, the dated hunt (the hunt alone if it has no hunting ground, “Shared link” for your link), but not people’s names. It counts one line per hunt (or per hunting ground, for member records), per purpose and per day. Attendance sheet consultations do not appear there, but they remain logged. The export of your data contains the entire log, including attendance sheet, with the person who consulted when they have an account. The log is retained for 12 months, then deleted. It is deleted with your account. A licence entered by an organiser on the record of a person who has no account is not logged: it remains in that organiser’s address book, who is then responsible for this data.

Legal basis: performance of your hunting ground membership for the committee, legitimate interest in hunt safety for the hunt organisation (verifying that a hunter holds a validated and insured licence), legitimate interest for support, and your choice for the sharing link, which you can deactivate at any time. You can at any time delete your licence from the application, request access to your data or object to processing by writing to [email protected].

6. SMS and WhatsApp messages

When the hunt organiser validates the stand allocations, Mes Chasses sends each placed hunter an email and, if the hunter has a mobile number, an SMS or WhatsApp message. The message includes the hunt title and date, the hunter’s stands and a personal link to their “My stand” page. It contains neither licence number nor payment data.

Where your number comes from. From your profile, or from the record created by the hunting organisation that invites you. In the latter case, the organisation is the data controller and Mes Chasses acts on its behalf (see §1). Only French and Belgian mobile numbers are accepted.

SMS. Without any choice on your part, you receive your stands by SMS. It is sent from the sender “MesChasses” and does not allow replies. To stop receiving them, choose “Email only” in your profile. Without an account, write to [email protected].

WhatsApp. You only receive WhatsApp messages if you have chosen this option and agreed to receive them. We keep the date, the place where you gave this consent and the version of the text you accepted. Reply STOP to a message to stop, or change channel in your profile: the proof of your consent is then deleted.

Who sends the message. Brevo sends SMS. Twilio sends WhatsApp messages, and SMS when Brevo cannot. WhatsApp is a Meta service. Transfers outside the European Union are described in §7.

7. Sharing and processors

We do not sell any data. We use technical processors, each contractually bound (GDPR):

• Cloudflare: application and site hosting, and file storage (Cloudflare R2: photos, documents), in France.
• Supabase: database and authentication, France region (European Union).
• Stripe: payment processing (we never store your card numbers).
• Firebase Cloud Messaging (Google) / Apple Push Notification service: push notifications.
• Brevo (France): transactional emails and SMS delivery.
• Twilio (United States): WhatsApp message delivery and, as backup, SMS.
• Meta Platforms (WhatsApp): WhatsApp message routing.
• Meta Platforms Ireland Ltd (ads): only with your consent, measuring the effectiveness of our ads and distribution on Facebook and Instagram (see §12). Your consent is the legal basis for this processing.
• Document reading provider (United States): reading hunting licence and insurance certificate scans, and helping draft support responses.
• Libredesk, hosted by us on Google Cloud: customer support (chat, emails) and help centre. To prepare a response, we may use a writing assistance tool that receives the conversation content; a team member reviews and sends each response.
• Sentry: error logging.
• PostHog: usage statistics (see §12).

Main data (database, files) is hosted in France. Some third-party providers (for example: payment, notifications, licence text recognition, error logging, audience measurement) may however process some data outside the European Union; these transfers are then governed by appropriate safeguards (standard contractual clauses). WhatsApp messages, and SMS sent as backup by Twilio, leave the European Union: your number and the message text are then processed in the United States. These transfers rely on standard contractual clauses or, where the provider adheres, on the EU-US Data Privacy Framework. Data transmitted to Meta for ads is processed in the United States by Meta Platforms, Inc., under the EU-US Data Privacy Framework. An SMS also travels in clear text over the telephone operators’ network.

8. Retention periods

Your data is retained for the duration of your use of the service:

• Account and activity data: as long as your account is active.
• After account deletion: data is masked immediately, then deleted or anonymised within 30 days, unless a legal obligation requires otherwise.
• Accounting and billing data: 10 years (Article L123-22 of the French Commercial Code).
• Payment data (via Stripe): according to applicable banking obligations.
• GPS positions: retained for the time needed for the history of the relevant hunt.
• Log of third-party consultations of your licence: 12 months, then automatic deletion; deleted with your account.
• Your licence sharing link: it works until the date you chose (7 days, 30 days or end of season), unless you deactivate it earlier. It is deleted as soon as you deactivate it, you delete your licence or you request account deletion.
• Internal technical logs (sensitive actions log, email and notification tracking): rolling 12 months, then automatic deletion.
• SMS and WhatsApp messages sent (number, text, delivery status): 12 months after sending, then automatic deletion.
• Channel choice and WhatsApp consent: as long as your number is registered with us. Withdrawing your consent deletes the proof, and deleting your account deletes this data.
• Ads consent: the date of your consent is retained as long as your account exists. The _fbp and _fbc identifiers and browser type are deleted when you withdraw your consent, and at most 6 months after consent. Deleting your account deletes everything, within 30 days like the rest of the account. This data is included in your data export.

9. Your rights (GDPR)

You have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to withdraw your consent at any time. To exercise these rights: [email protected]. We respond within 30 calendar days. You can also lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.

Account deletion (and associated data) is available directly from the application (Profile) or on request.

10. Security

Data is encrypted in transit (HTTPS) and at rest, access is restricted by role-based authorisation rules, and sensitive documents are stored privately.

11. Minors

The application is intended for holders of a hunting licence; it is not intended for minors under 15.

12. Cookies and trackers

The application measures its usage (PostHog: pages viewed, journey, session recording with masked inputs) to identify issues and improve. This measurement is active by default. On the web version, you can turn it off at any time from your account (“Audience measurement” setting): after that, nothing is measured and your refusal is retained for 6 months. In the mobile application, it cannot be disabled. These audience measurement trackers do not collect any advertising identifier. The mobile application does not use any, and sends nothing to Meta.

On the web version, your choice is retained by the mc_consent cookie, shared with the showcase site (.meschasses.com domain): a choice made on one also applies to the other. Unless you refuse, a cookie named mc_acq remembers the source of your arrival (campaign, referring site, entry page) to understand how you discovered Mes Chasses. It is retained for 90 days and is never shared with a third party. The showcase site has its own privacy policy.

Ads. On the web version, only if you accept, we measure the effectiveness of our ads and may display them to you on social networks (Facebook, Instagram), with Meta Platforms Ireland Ltd. Nothing is loaded or sent until you accept. A banner asks you on login and registration pages. Your choice is retained for 6 months by the mc_ads_consent cookie, shared with the showcase site.

With your consent, Meta sets in your browser the _fbp (which identifies your browser) and _fbc (which remembers the ad you clicked, if you came from one) cookies. They are retained for 90 days. On these pages, your browser also transmits directly to Meta the page viewed, your IP address and your browser type. At registration and then subscription, our servers send Meta your email address and account identifier in irreversibly encrypted form (hash), the subscription amount, your _fbp and _fbc identifiers and your browser type. We keep these identifiers for at most 6 months, and never your IP address.

You can withdraw your consent at any time in My account, Profile, Privacy (“Sharing with our partners” setting). Transmissions stop and our copies of these identifiers are deleted. What Meta has already received falls under its privacy policy.

13. Changes

We may update this policy; any substantial change will be notified to you in the application.

14. Contact

For any question relating to your data: [email protected].