This policy explains what data Pazumi collects, why, how long it is kept and how to exercise your rights. It applies to the website https://pazumi.com, the web app https://app.pazumi.com and the Pazumi apps for iPhone and Android. In case of discrepancy, the French version prevails.
1. Data controller
RAHOUBI LIMITED, a private limited company registered in England and Wales, registered at Companies House (England and Wales) under company number 13732051, with its registered office at 7 Coronation Dephna House, London, NW10 7PQ, United Kingdom. Data protection contact: privacy@pazumi.com.
2. Data we collect
| Category | Data | Source |
|---|---|---|
| Account | email address, password (only stored as an irreversible hash), first name or nickname, username, optional profile photo, language | you |
| Sign in with Google or Apple | account identifier, email, name, photo (if you allow it) | Google / Apple, with your consent |
| Content | lists, items, icons and colors, archives, invitations you send or receive | you and the members of your lists |
| Activity | history of actions in shared lists (add, check…), notifications, progress (points, levels, badges) | generated by your use |
| Preferences | theme, animations, sounds, notifications, privacy | you |
| Technical data | device and browser type, app version, technical logs (including IP address), push notification tokens | automatic |
| Support | messages you send us | you |
We do not collect location data, phone contacts, health data or payment card data. Pazumi shows no ads and sells no data.
3. Why we use it (purposes and legal bases)
- Providing the service (creating your account, syncing your lists, enabling collaboration, sending essential emails such as address verification or password reset) — performance of the contract.
- Security and abuse prevention (protection against unauthorized access, invitation rate limits, handling reports) — legitimate interest.
- Product improvement based on aggregated, anonymized statistics (for example the number of lists created) — legitimate interest. These statistics cannot identify you and never contain the text of your lists.
- In-app news and announcements (can be turned off in Settings → Notifications) — legitimate interest.
- Promotional push notifications — only with your consent, off by default.
- Legal obligations (responding to authorities, keeping certain evidence) — legal obligation.
4. Who can see your data
- Members of your shared lists see the content of those lists, your name, username, photo and your actions in those lists. A list that is not shared is visible only to you.
- User search: someone who shares no list with you can only find you by typing your exact username, and you can turn this off. People who already share a list with you see you in their suggestions from the first letters of your name. There is no public directory.
- The Pazumi team does not access the content of your lists, except at your explicit request as part of a support request, or where required by law. Administration tools only show aggregated data and account information (status, dates), and every administrative action is logged.
- Our technical processors, strictly to operate the service:
| Provider | Role | Data location |
|---|---|---|
| Supabase | database, authentication, real-time sync | European Union (Frankfurt) |
| Render | hosting of the website and the web app (static files, no database) | global content delivery network (CDN) |
| Cloudflare | domain name, DNS, forwarding of emails sent to our contact addresses | global network |
| Transactional email provider (e.g. Resend) | sending verification, reset and invitation emails | see section 5 |
| Google, Apple | sign-in with their account, if you choose it | per their policies |
| Apple (APNs), Google (Firebase Cloud Messaging) | delivering push notifications on mobile | per their policies |
This list is kept up to date on this page. Each provider is bound by a data processing agreement compliant with Article 28 GDPR and offers a level of protection at least equivalent to the one described here.
5. Transfers outside the European Union
Your main data is hosted in the European Union. Our company is established in the United Kingdom, which benefits from a European Commission adequacy decision: your data is protected there to an equivalent standard. When a provider is established outside the EU (for example for emails or push notifications), the transfer is covered by the European Commission’s Standard Contractual Clauses or by the EU–US Data Privacy Framework, with additional safeguards where needed.
6. Retention periods
| Data | Period |
|---|---|
| Account and content | as long as your account is active |
| After a deletion request | 30 days during which you can cancel, then permanent erasure; removal from backups within a further 35 days |
| Invitations | valid 7 days; expired invitations are deleted after 90 days |
| Notifications | 6 months |
| Technical logs (including IP address) | 30 days maximum |
| Security and administration logs | 2 years |
| Support conversations | 3 years after the last exchange |
When you delete your account, items you added to shared lists remain visible to the other members (without your name, replaced by “deleted user”), and ownership of your shared lists is transferred to the longest-standing member. Your private lists and archives are erased.
7. Your rights
You have the rights of access, rectification, erasure, restriction, objection, data portability, the right to withdraw your consent at any time and, if you live in France, to set instructions regarding your data after your death.
- Export your data: Settings → Privacy → Export my data (JSON file).
- Delete your account: Settings → Danger zone → Delete my account, or via the Delete my account page.
- Any other request: privacy@pazumi.com. We reply within one month at the latest.
You can also lodge a complaint with a data protection authority: the ICO in the United Kingdom (ico.org.uk) or the authority of your EU country (in France, the CNIL, www.cnil.fr).
8. Security
Encrypted connections (HTTPS/TLS), hashed passwords, access control enforced directly by the database (each person can only read the lists they are a member of), regular backups, logging of sensitive operations and administration access protected by two-factor authentication.
9. Children
Pazumi is not intended for children under 15 without the consent of a parent or guardian. If you believe a child has given us data without such consent, write to privacy@pazumi.com and we will delete it.
10. Cookies and local storage
Pazumi uses no advertising cookies or third-party trackers. Only strictly necessary items are stored on your device (sign-in session, preferences, offline copy of your lists). Details: Cookies and storage.
11. Changes
We may update this policy. In case of a significant change, we will notify you in the app or by email before it takes effect. The last update date is shown at the top of this page.