Privacy Policy

1. Who We Are

Callipso is operated by an individual developer registered as a micro-entreprise in France. Callipso provides a macOS desktop application for voice-to-terminal routing in software development environments.

Data Controller: Callipso (micro-entreprise), France
Contact: support@callipso.dev
Website: https://callipso.dev

2. What Data We Collect

2.1 Account Data

When you create an account, we collect:

• Email address -- used for authentication, account recovery, and essential service communications
• User ID -- a unique identifier generated at registration
• Subscription status -- whether you are on the Free, Pro, or Lifetime plan
• Referral codes -- if you participate in the referral program

This data is stored in Supabase (our authentication and database provider) and retained until you delete your account.

2.2 Payment Data

When you subscribe to a paid plan, Stripe processes and stores:

• Email address
• Full name
• Payment method information (card number, expiry, CVC -- handled entirely by Stripe; we never see or store your full card details)
• Billing address

This data is retained by Stripe for as long as your subscription is active, plus any additional period required by applicable financial record-keeping laws.

2.3 Analytics Data

We collect anonymous usage analytics through PostHog to understand how the product is used and improve it. This includes:

• Feature usage events (e.g., "user activated voice routing," "user opened Space tab") -- no content is captured, only the event name
• Device type and OS version
• App version

Analytics data is retained for 12 months and then automatically deleted. You can opt out of analytics at any time in the app Settings. When you opt out, no analytics events are sent.

2.4 Crash Reports

When the app encounters an error, Sentry may receive:

• Error stack traces
• OS version and app version
• General device information

No personally identifiable information is intentionally collected in crash reports. Crash data is retained for 90 days and then automatically deleted.

3. What We Do NOT Collect

4. How We Use Your Data

We use the data we collect for the following purposes:

• Account management: To authenticate you, manage your subscription, and provide account-related features (Supabase)
• Payment processing: To process subscription payments and manage billing (Stripe)
• Product improvement: To understand feature usage patterns and prioritize development work (PostHog)
• Bug fixing: To identify and fix application crashes and errors (Sentry)

We do not sell, rent, or share your personal data with third parties for marketing purposes.

5. Legal Basis for Processing (GDPR Article 6)

We process your personal data under the following legal bases:

• Contract performance (Art. 6(1)(b)) -- Account data and payment data are necessary to provide the service you subscribed to
• Legitimate interest (Art. 6(1)(f)) -- Crash reports are collected to maintain and improve service reliability. Our legitimate interest in providing a stable product is balanced against the minimal privacy impact, as no PII is intentionally included
• Consent (Art. 6(1)(a)) -- Analytics data is collected based on your consent. You can withdraw consent at any time by disabling analytics in the app Settings

6. Sub-Processors

We use the following third-party services to operate Callipso:

7. International Data Transfers

Some of our sub-processors are based in the United States. For transfers of personal data from the European Economic Area (EEA) to the US, we rely on the following safeguards:

• Data Processing Agreements (DPAs) with each sub-processor
• Standard Contractual Clauses (SCCs) as approved by the European Commission
• The EU-US Data Privacy Framework, where applicable

Each sub-processor maintains appropriate technical and organizational measures to protect your data in compliance with GDPR requirements.

8. Your Rights (GDPR Articles 15-22)

As a data subject under the GDPR, you have the following rights:

• Right of access (Art. 15): You can request a copy of all personal data we hold about you. A data export feature is available directly in the app Settings.
• Right to rectification (Art. 16): You can request correction of inaccurate personal data. Contact us at support@callipso.dev.
• Right to erasure (Art. 17): You can delete your account and all associated data at any time from the app Settings. Upon account deletion, we remove your data from Supabase and request deletion from Stripe (subject to their legal retention obligations).
• Right to data portability (Art. 20): You can export your data in a machine-readable format from the app Settings.
• Right to object (Art. 21): You can object to processing based on legitimate interest. Contact us at support@callipso.dev and we will review your request.
• Right to restrict processing (Art. 18): You can request that we limit the processing of your personal data in certain circumstances.
• Right to withdraw consent (Art. 7): You can withdraw your consent for analytics data collection at any time by disabling analytics in the app Settings. Withdrawal does not affect the lawfulness of processing performed before withdrawal.

To exercise any of these rights, use the in-app controls in Settings or contact us at support@callipso.dev. We will respond to your request within 30 days.

9. Data Retention

• Account data (Supabase): Retained until you delete your account
• Payment data (Stripe): Retained for the duration of your subscription, plus any period required by financial record-keeping laws (typically 10 years under French law)
• Analytics data (PostHog): Automatically deleted after 12 months
• Crash reports (Sentry): Automatically deleted after 90 days

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• All data in transit is encrypted using TLS/HTTPS
• Authentication is handled through Supabase with industry-standard security practices
• Payment data is handled entirely by Stripe, a PCI DSS Level 1 certified provider -- we never store card details
• Access to production systems is restricted and logged

11. Cookies and Local Storage

The callipso.dev website does not use cookies.

The Callipso desktop application uses localStorage to store your preferences (such as theme settings, window position, and feature flags). This data is stored entirely on your device and is never transmitted to our servers or any third party.

12. Children's Privacy

Callipso is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support@callipso.dev and we will delete that data promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app or by email. The "Last updated" date at the top of this page indicates when the policy was last revised.

We encourage you to review this policy periodically. Continued use of Callipso after changes constitutes acceptance of the updated policy.

14. Supervisory Authority

If you are located in the European Economic Area and believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with your local supervisory authority.

As we are based in France, our supervisory authority is:

CNIL (Commission Nationale de l'Informatique et des Libertes)
3 Place de Fontenoy, TSA 80715
75334 Paris Cedex 07, France
www.cnil.fr

15. Contact

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

Email: support@callipso.dev