Privacy Policy

Legende.ai SAS (French simplified joint-stock company)

Last updated: July 16, 2026

1. Data Controller

Company name: LEGENDE.AI

Legal form: SAS — Société par Actions Simplifiée (French simplified joint-stock company)

Registered office: 42 rue Beaubourg, 75003 Paris, France

SIREN: 100 341 866

SIRET: 100 341 866 00018

EU VAT number: FR78 100 341 866

Email: contact@legende.ai

DPO contact: privacy@legende.ai

LEGENDE.AI is committed to protecting your personal data. This Privacy Policy explains what data we collect, why we collect it, how we use it, and what your rights are under applicable data protection laws, including the General Data Protection Regulation (GDPR).

2. Data We Collect

As part of our AI-guided interview service for creating memoir books, we collect the following categories of data:

2.1 Account Data

  • First and last name

  • Email address

  • Phone number (where applicable)

  • Password (stored in encrypted form)

2.2 Interview Content

  • Personal stories and family memories shared during interview sessions

  • Photographs and images uploaded for your book

  • Responses to guided questions within the application

This content is personal and potentially sensitive in nature. We treat it with the utmost care and use it solely to provide the service you have requested.

2.3 Technical and Browsing Data

  • Session identifier

  • Browser or device type and version

  • Operating system

  • IP address (anonymized)

  • Pages visited and duration of visit

2.4 Transaction Data

  • Order history

  • Delivery address (for physical products)

LEGENDE.AI does not collect or store any banking or payment card data. All paid features are handled exclusively through Apple In-App Purchase (Apple IAP). Our servers never receive or process payment card information.

3. Purposes and Legal Basis

Purpose

Legal Basis

Creating and managing your user account

Performance of contract

Providing the AI-guided interview service

Performance of contract

Producing and printing your memoir book

Performance of contract

Processing orders and deliveries

Performance of contract

Sending service-related communications (confirmations, updates)

Performance of contract

Improving our service and usage analytics

Legitimate interest

Sending marketing communications (with consent)

Consent

Compliance with legal and tax obligations

Legal obligation

4. Third-Party Service Providers

To deliver our service, we use the following third-party providers. All are bound by strict contractual obligations regarding data protection:

Service

Provider

Data Location

Purpose

Database hosting

Supabase

France / European Union

Secure data storage

Artificial intelligence

OpenAI

United States (Standard Contractual Clauses)

Processing guided interviews

Application hosting

Railway

United States (Standard Contractual Clauses)

Hosting the application backend

Cloud storage

Amazon Web Services (S3)

European Union

Storage of user audio recordings, photos, and exported PDFs

In-app payments

Apple In-App Purchase (Apple IAP)

See Apple's privacy policy

Processing in-app purchases. LEGENDE.AI never receives or processes payment card data.

Usage analytics

Firebase Analytics (Google)

European Union

Service improvement

SMS messaging

Twilio

United States (Standard Contractual Clauses)

Sending verification codes and service notifications

Service

Provider

Data Location

Purpose

Database hosting

Supabase

France / European Union

Secure data storage

Artificial intelligence

OpenAI

United States (Standard Contractual Clauses)

Processing guided interviews

Application hosting

Railway

United States (Standard Contractual Clauses)

Hosting the application backend

Cloud storage

Amazon Web Services (S3)

European Union

Storage of user audio recordings, photos, and exported PDFs

In-app payments

Apple In-App Purchase (Apple IAP)

See Apple's privacy policy

Processing in-app purchases. LEGENDE.AI never receives or processes payment card data.

Usage analytics

Firebase Analytics (Google)

European Union

Service improvement

SMS messaging

Twilio

United States (Standard Contractual Clauses)

Sending verification codes and service notifications

For data transfers outside the European Union, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and verify that our subprocessors provide an adequate level of protection.

5. Data Retention

Data Type

Retention Period

Account data

Duration of the contractual relationship + 3 years

Interview content and book

Duration of the contractual relationship + 1 year, unless earlier deletion is requested

Transaction data

10 years (legal accounting obligation)

Technical data

13 months maximum

Marketing data

3 years after last contact

When these periods expire, your data is deleted or irreversibly anonymized.

6. Your Rights

Under the General Data Protection Regulation (GDPR) and French data protection law, you have the following rights:

  • Right of access — obtain a copy of all your personal data.

  • Right to rectification — correct inaccurate or incomplete data.

  • Right to erasure ("right to be forgotten") — request the deletion of your data, including your account and all associated content.

  • Right to data portability — receive your data in a structured, commonly used, and machine-readable format.

  • Right to object — object to the processing of your data for direct marketing purposes.

  • Right to restriction — request restriction of processing in certain cases provided by law.

  • Right to withdraw consent — at any time, without affecting the lawfulness of prior processing.

How to Exercise Your Rights

You can exercise any of these rights by contacting us:

  • By post: LEGENDE.AI — Data Protection, 42 rue Beaubourg, 75003 Paris, France

We will respond to your request within 30 days. We may ask for proof of identity to verify your request.

Account Deletion

You may request the complete deletion of your account and all associated data (including interview content, photos, and your book) by sending an email to support@legende.ai. Deletion will be completed within 30 days, subject to mandatory legal retention obligations.

Complaints

If you believe that our processing of your data does not comply with applicable regulations, you have the right to lodge a complaint with the French data protection authority (CNIL): www.cnil.fr

7. Data Security

We implement appropriate technical and organizational measures to protect your data:

  • Encryption of data in transit (TLS/SSL) and at rest

  • Secure authentication and encrypted passwords

  • Access restricted on a need-to-know basis

  • Primary data hosting in France

  • Regular backups and business continuity planning

  • Periodic security audits

8. Cookies

Our website uses strictly necessary cookies for service operation (authentication, session preferences). Analytics cookies may be used with your prior consent to improve our service.

You can manage your cookie preferences at any time through your browser settings or our consent banner.

9. Children

Our service is intended for adults (aged 18 and over). We do not knowingly collect data from children. If you are a parent or guardian and discover that a child has provided data without your consent, please contact us at privacy@legende.ai so we can delete it.

10. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. In the event of a material change, we will notify you by email or via an in-app notification. The date of the last update appears at the top of this page.

11. Contact

For any questions about your personal data:

Email: privacy@legende.ai

Support: support@legende.ai

Address: LEGENDE.AI, 42 rue Beaubourg, 75003 Paris, France