Privacy policy

Who is responsible?

SYNERI publishes Comivio and is the controller for the processing needed to operate it. For privacy questions and requests, contact contact@scalesi.fr. SCALESI hosts the circles server in France on behalf of SYNERI. This policy covers the Android application fr.scalesi.comivio and its service pages.

Your notebook and AI on your phone

Your notebook, personal notes and conversations with Gemma are processed locally. Comivio does not send notebook content or AI conversations to the circles server or advertising network. The Android notebook is encrypted using a device key and protected by a code; it locks again after inactivity. Settings, the model and downloaded resources stay on your device until you erase them or uninstall the app.

Once installed, Gemma generates answers on the device. The initial model download uses Hugging Face, which receives technical connection information. Opening external sources, fetching a document or using an online translation requires Internet access: the requested website or service receives information including your IP address and the requested resource. This is separate from local conversations.

A notebook exported as a text file is no longer protected by the Comivio code. You choose its destination and whom to share it with. Choosing a cloud location can upload that file to another provider.

Data used for circles

An account is needed for online discussions. The server processes your username, display name, supplied email address and verification status, a secure password hash, sessions and login dates. It stores circle memberships, roles, declared professional badges, invitations, messages, replies, reports and administration records. Passwords are not stored as plain text.

This data enables accounts, conversations, access controls, moderation and account recovery. Confirmation and recovery emails use SYNERI’s email provider and contain the recipient address and a temporary link, without notebook or discussion content.

Circle members can see messages and shared profile information, including available history when they join. Any registered user may join an open circle. Its description appears in the directory; private circles require an invitation. Your email is not shown to other members. Moderators manage their circles; global administrators can access accounts, email addresses and circle management. Authorised SYNERI and SCALESI personnel can access data needed for support and security.

Discussions are not end-to-end encrypted. Other people can copy messages they see: avoid identifiable information about yourself or a relative, especially medical information. Comivio is not a medical record. Professional badges do not constitute official credential verification. Report content that infringes someone’s privacy.

Advertising and external services

Comivio includes Google AdMob and Google UMP privacy choices. The application requests non-personalised ads. When consent is required, choices are presented before ads; you can revisit them in “Advertising and privacy” when this option is available.

The advertising SDK may process IP addresses (including approximate location), device and app information, technical identifiers, ad interactions and diagnostics. The Android advertising ID permission is removed in this version of Comivio; other technical SDK processing may still occur. Comivio does not give the network your notebook, Gemma conversations, circle messages or a list of conditions you viewed.

Google and partners identified in the choice form apply their own terms. Some processing may take place outside the European Economic Area, under safeguards described by those providers. See Google’s privacy policy, Google services in partner apps and Hugging Face’s policy. Documentation sites and translation services also have their own policies. Comivio’s privacy and account deletion pages contain no ads or tracking tools.

Legal grounds

Providing your requested account and discussions is based on performance of the service. Security, abuse prevention, moderation and necessary technical records rely on SYNERI’s legitimate interest in a safe service. Advertising processing requiring consent relies on your choice, which you can withdraw without losing local Comivio content. Legal obligations and handling your rights justify processing necessary for those purposes.

Do not publish identifiable health information about another person. Accepting the community charter does not authorise disclosure of a relative’s sensitive data. You may remove a message or report content to moderators.

Retention periods

• Accounts: until you request deletion; accounts with no management responsibilities are also deleted after 730 days without login. Owner, administrator and moderator accounts remain while those responsibilities are assigned. For existing accounts, the inactivity period starts at this upgrade.
• Messages: up to 730 days after publication, unless deleted earlier. Deleting a topic also removes its replies, even more recent ones. Account deletion removes its messages and topics.
• Administration records: 90 days. Reports remain while being handled, then for 90 days after closure; reports associated with removed content are deleted with it.
• Temporary access: sessions last 30 days, invitations 7 days, email verification links 24 hours and password recovery links 30 minutes. Queued emails are deleted after delivery, replacement or expiry.
• Backups: 30-day rotation. Deleted data may temporarily remain in a protected copy not used for the live service. Deletions must be reapplied before the service resumes following restoration.
• Support requests: while being handled, then no longer than 90 days after closure. A legal obligation or identified dispute may require limited longer retention; you are informed of the reason and duration.

Automatic cleanup runs hourly. These periods concern data operated by SYNERI; external providers specify their own periods in their policies.

Data protection

Connections to the server use HTTPS. Access is role-restricted; passwords use a secure hashing scheme and tokens are temporary. Application backups are restricted to operations personnel. Detailed API access logs are disabled; rate-limiting information is temporarily held in memory. These measures reduce risks without guaranteeing absolute security.

Your rights and contact

You may request access, correction, erasure and, where applicable, portability or restriction. You may object to processing based on legitimate interests and withdraw consent for future processing. Email contact@scalesi.fr with your request and Comivio username. We never ask for your password. Proportionate verification may be needed to protect your account.

We respond within one month. Complex or numerous requests may require an extension of up to two further months; you will be informed within the first month. You can complain to CNIL or your country’s competent authority.

Delete your account and data

You can request account deletion free of charge, without reinstalling or signing into the app. The page below explains the information needed, what is deleted and the timeframes. The app’s privacy settings include an account deletion link leading to this procedure.

Policy updates

The date above identifies this policy version. If processing changes significantly, we will update the notice and inform users by an appropriate means. New consent will be requested where required.