Privacy Policy

Last updated: November 3, 2026

This privacy policy (hereinafter the “Privacy Policy”) is established by Pictalk (Pictalk Speech Made Easy), a non-profit association under the French law of 1901, whose registered office is located at 13 rue Professeur Pierre Marion – 69005 Lyon, France. It sets out how Pictalk collects and processes the personal data of Users of the Pictalk Buddy application, on iOS, Android and the web (buddy.pictalk.org).

Pictalk is particularly committed to respecting the privacy of its Users and to protecting their personal data.

As Data Controller, Pictalk processes Users’ Personal Data in compliance with applicable national and European regulations, in particular the Loi Informatique et Libertés (French Data Protection Act) and the General Data Protection Regulation (hereinafter “GDPR”).

By using the Service, Users acknowledge that they have read this Privacy Policy and accept its terms.

1. Definitions

Term	Meaning
Account	Means a valid account giving access to the Service.
Personal Data	Means any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.
Loi Informatique et Libertés	Means French Law No. 78-17 of January 6, 1978 on information technology, data files and civil liberties, as amended.
Data Controller	Means the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing.
Service	Means the Pictalk Buddy application (formerly Agenda CAA), a planner, sequences and notebooks with an interface adapted to people with disabilities, available on iOS, Android and the web.
Processor	Means a service provider that processes Personal Data on behalf of Pictalk.
Processing	Means any operation performed on Personal Data, whatever the method used: collection, recording, organization, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, combination, erasure or destruction.
User	Means any natural or legal person using the Service and belonging to one of the user profiles described in the General Terms of Use. A User must have an active Account to access the Service.

2. Personal Data collected

Users may view certain Personal Data about another User with whom they share a space. Each User can edit their own profile.

The following data is collected when the Account is created and when the Service is used:

Account data: last name, first name and email address of the Legal Representative or the Caregiver, user ID.
Content created in the Service: planner events (title, date, time, location), sequences, notebooks, pictograms and their labels, descriptions, vocabularies, uploaded images and files, links added to notebooks and videos added to boards.
Preferences: application language, font size, voice type.
Membership and billing data: membership type, purchase history, name and email address of the member or of the contact person of the member organization, billing address, quotes and invoices. The Pro membership is paid in the application (App Store, Google Play), by bank card via Stripe, or by bank transfer on the basis of a quote and invoice. Pictalk never has access to bank card numbers.
Donation data: amount, frequency, name, email address and, to issue the tax receipt, postal address of the donor. Donations are paid via Stripe.
Technical data: IP address, device model and operating system, device ID, application version, push notification token, error reports.
Usage data: interactions with the application (screens viewed, features used).
AAC communication logs: pictograms used and sentences built in the application. They are collected only if the User consents, and this consent may be withdrawn at any time.

Content entered by Users (events, sequences, notebooks) and AAC communication logs may reveal information about the health or disability of the person being supported. This health data, within the meaning of Article 9 of the GDPR, is processed on the basis of the explicit consent of the User or, for a supported person, of their Legal Representative (Article 9(2)(a) of the GDPR). This consent may be withdrawn at any time by deleting the content concerned or the Account. This data is processed solely to provide the Service to the User who entered it and to the people with whom they choose to share it. It is never sold or used for advertising purposes.

3. Purposes and legal bases of Processing

Purpose	Legal basis
Creating and managing the Account, authentication, synchronizing content across devices	Performance of the contract (General Terms of Use)
Supporting the communication and organization of the people being supported (planner, sequences, notebooks, speech synthesis)	Performance of the contract
Sending notifications (event reminders)	Performance of the contract; notifications can be turned off in the device settings
Processing of health data entered in the Service	Explicit consent (Article 9(2)(a) of the GDPR)
Managing Pro memberships and in-app purchases: quotes, invoices, payments	Performance of the contract and legal obligations (accounting)
Managing donations and issuing tax receipts	Legal obligations (Articles 200 and 238 bis of the French General Tax Code)
Sending Account-related emails: address verification, forgotten password, inactivity warning	Performance of the contract
Detecting and fixing errors, security of the Service	Pictalk’s legitimate interest in providing a reliable and secure Service
Usage statistics, to improve the Service	Pictalk’s legitimate interest in measuring use of the Service
AAC communication logs, to track communication progress and improve the Service	User’s consent
Application updates	Legitimate interest

4. Use by an institution (school, health or social care facility, local authority)

When the Service is subscribed to by an institution for its students or the people it supports, the institution determines the purposes of use and acts as Data Controller. Pictalk then acts as Processor within the meaning of Article 28 of the GDPR: it processes the data solely to provide the Service, on the institution’s instructions, and does not use it for any other purpose. A data processing agreement may be entered into with the institution upon request at alex@pictalk.org.

5. Minors

The Service is designed for people of all ages, including children. A minor’s Account is created and managed by a parent, a legal representative or an institution, which chooses the content entered and gives, where applicable, the necessary consents. Minors’ data is used neither for advertising purposes nor for profiling.

6. Data hosting

The application, authentication, database and files are hosted in France by OVHcloud:

web application, authentication and API: Paris and Gravelines;
main database: Gravelines, accessible only from the infrastructure’s private network;
files (images, vocabularies, language files): Gravelines and Paris;
daily database backup: Strasbourg.

7. Recipients of Personal Data

Personal Data is accessible only to members of the Pictalk team responsible for administering the Service, within the limits of their duties, and to the Users with whom the User chooses to share their content.

Pictalk uses the following Processors, which receive only the data necessary for their task:

Provider	Use	Data transmitted	Location
OVHcloud	Hosting, database, backups, file storage	Account data, content and usage data	France
PostHog	Usage statistics	Usage events	European Union
Sentry	Crash and error reports	Error traces, device information, user ID	Germany
OneSignal	Push notifications	Push token, user ID	European Union
RevenueCat	Managing in-app purchases	User ID, purchases	United States
Stripe	Payment of memberships and donations	Name, email address, amount; card data is processed by Stripe alone	European Union (Ireland) and United States
SendGrid (Twilio)	Sending Account-related emails	Email address, name	United States

Some features rely on third-party services, only when the User uses them:

Apple (App Store) and Google (Google Play): distribution of the application and payment of subscriptions, under their own privacy policies;
OpenStreetMap: map display and address search (address entered, IP address);
YouTube (Google): playback of videos added to boards (IP address, video viewed); no video is loaded until the User has added one;
ElevenLabs: premium voice, only if the User enables it with their own key (text to be spoken);
ipify: determination of the IP address for the donation panel (IP address);
Hugging Face: download of the voice model used locally on the device; no personal data is transmitted other than the IP address inherent in the download.

Link previews in notebooks and the service status shown in the application are provided by Pictalk’s servers.

Finally, Pictalk may be required to disclose Personal Data to third parties when required by law, regulation or court order, or when necessary to protect and defend its rights.

8. Transfers of Personal Data outside the European Union

Service data (accounts, content, files, backups) remains hosted in France. Statistics, error reports and notifications go through providers hosted in the European Union.

Some services may, however, involve a transfer of data outside the European Union:

RevenueCat (United States), covered by the European Commission’s standard contractual clauses;
SendGrid (Twilio Inc., United States) and Stripe (Stripe, Inc., United States, for the data that Stripe Payments Europe, in Ireland, transmits to it), covered by the adequacy decision on the EU–US Data Privacy Framework;
Hugging Face (United States), which receives only the IP address when the voice model is downloaded;
YouTube (Google LLC, United States), covered by the European Commission’s adequacy decision on the EU–US Data Privacy Framework;
ipify (United States), which receives only the IP address;
ElevenLabs (United States), only if the User enables this option with their own key;
OpenStreetMap, some of whose servers are located in the United Kingdom, a country covered by an adequacy decision;

Where a transfer is not covered by an adequacy decision, Pictalk ensures that it is subject to appropriate safeguards, such as the European Commission’s standard contractual clauses, or limits the data transmitted to what is strictly necessary.

9. Retention period of Personal Data

Pictalk retains Users’ Personal Data until the User deletes the Account. An Account that has remained inactive for one year is deleted, together with its associated data.

AAC communication logs are retained for a maximum of 3 months.

Database backups are retained for 2 days and then replaced by subsequent backups. Error reports and statistics data are retained for as long as necessary for their purpose, within the limits of the retention periods applied by the providers concerned.

Quotes, invoices and accounting records relating to memberships are retained for 10 years. Duplicates of tax receipts and supporting documents for donations are retained for 6 years (Article L102 E of the French Book of Tax Procedures).

10. Security measures

Pictalk takes appropriate technical and organizational measures to preserve the confidentiality and security of Personal Data and to protect it against any loss, misuse or unauthorized disclosure, including:

encryption of exchanges between the application and the servers (HTTPS);
centralized User authentication;
isolated database, accessible only from the infrastructure’s private network;
daily backup in a separate data center;
access to data restricted to authorized persons.

11. Exercising the rights of data subjects

In accordance with the Loi Informatique et Libertés and the GDPR, Users have the following rights:

right of access (Article 15 of the GDPR) and rectification (Article 16 of the GDPR);
right to erasure of data (Article 17 of the GDPR);
right to restriction of processing (Article 18 of the GDPR);
right to data portability (Article 20 of the GDPR);
right to object to processing (Article 21 of the GDPR);
right to withdraw consent at any time, where processing is based on consent (Article 7 of the GDPR);
right to set guidelines regarding the handling of one’s data after death.

We invite you to visit the website of the Commission nationale de l’informatique et des libertés (CNIL, the French data protection authority) for more information on your rights.

Any User may exercise their rights by directly editing their information in their profile, or by deleting their Account from the application. They may also send any question or request relating to the processing of their Personal Data to the Pictalk team, by email: alex@pictalk.org.

If a User considers, after contacting Pictalk, that their rights have not been respected or that a processing operation does not comply with data protection rules, they may lodge a complaint with the CNIL (https://www.cnil.fr/fr/plaintes).

12. Changes to the policy

This Privacy Policy may change, in particular to comply with legislative and regulatory developments or changes to the Service. Changes will be published on Pictalk’s website (https://www.pictalk.org/en/privacy-policy), where possible at least thirty days before they take effect.

If the User disagrees with the terms of the new Privacy Policy, the User may delete their Account under the conditions set out in the General Terms of Use. By continuing to use the Service after the new provisions take effect, the User agrees to be bound by the new Privacy Policy.

13. Governing law and jurisdiction

This Privacy Policy is established in accordance with French law and European Union law. The French courts have territorial jurisdiction over any dispute relating to the Service.

PRIVACY POLICY FOR PICTALK

Last updated on October 22, 2026

Thank you for choosing to be part of our Pictalk community ("association," "we," "us," "our"). We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about our policy or practices regarding your personal information, please contact us at alex@pictalk.org.

When you visit our website https://www.pictalk.org, our mobile application, and use our services, you entrust us with your personal information. We take your privacy very seriously. In this privacy notice, we describe our privacy policy. We aim to explain as clearly as possible what information we collect, how we use it, and what rights you have regarding it. We hope you take the time to read this document carefully, as it is important. If you do not agree with any terms of this privacy policy, please stop using our Sites or Applications and our services.

This privacy policy applies to all information collected through our website (such as https://www.pictalk.org), our mobile application ("Applications"), and/or any related services, sales, marketing, or events (collectively referred to in this privacy policy as "Sites").

Please read this privacy policy carefully as it will help you make informed decisions regarding sharing your personal information with us.

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE USE YOUR INFORMATION?
3. WILL YOUR INFORMATION BE SHARED WITH OTHERS?
4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
5. WHERE IS YOUR INFORMATION HOSTED?
6. HOW LONG DO WE KEEP YOUR INFORMATION?
7. HOW DO WE PROTECT YOUR INFORMATION?
8. DO WE COLLECT INFORMATION FROM MINORS?
9. WHAT ARE YOUR PRIVACY RIGHTS?
10. CONTROLS FOR DO-NOT-TRACK FEATURES
11. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
12. DO WE UPDATE THIS POLICY?
13. HOW CAN YOU CONTACT US ABOUT THIS POLICY?

1. WHAT INFORMATION DO WE COLLECT?

Information collected through our Applications

In summary: We may collect information about you when you use our applications.

If you use our Applications, we also collect the following information:

Information collected from other sources

In summary: We may collect limited data from public databases, marketing partners, and other external sources.

We may obtain information about you from other sources, such as public databases, common marketing partners, as well as other third parties. Examples of information we receive from other sources include: social media profile information; marketing leads and search results and links, including sponsored ads.

2. HOW DO WE USE YOUR INFORMATION?

In summary: We process your information for purposes based on legitimate business interests, the performance of our contract with you, compliance with our legal obligations, and/or your consent.

We use the personal information collected through our Sites or Applications for various business purposes described below. We process your personal information for these purposes relying on our legitimate business interests ("Business Purposes"), to enter into or perform a contract with you ("Contractual"), with your consent ("Consent"), and/or to comply with our legal obligations ("Legal Reasons"). We indicate the specific legal bases we rely on next to each purpose listed below.

We use the information we collect or receive:
• To facilitate account creation and the login process. If you choose to link your account with us to a third-party account (like your Google or Facebook account), we use the information you have authorized us to collect from those third parties to facilitate account creation and the login process.

3. WILL YOUR INFORMATION BE SHARED WITH OTHERS?

In summary: We only share information with your consent, to comply with laws, to provide you with services, to protect your rights, or to fulfill business obligations.

We may process or share your data that we hold on the following legal bases:
• Consent: We may process your data if you have given us specific consent to use your personal information for a specific purpose.

• Legitimate Interests: We may process your data when it is reasonably necessary to achieve our legitimate business interests.

• Performance of a Contract: When we have entered into a contract with you, we may process your personal information to fulfill the terms of our contract.

• Legal Obligations: We may disclose your information when we are legally obligated to do so to comply with applicable law, governmental requests, a judicial proceeding, a court order, or legal process, such as in response to a court order or a subpoena (including in response to public authorities to meet national security or law enforcement requirements).

• Vital Interests: We may disclose your information when we believe it is necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person, and illegal activities, or as evidence in a lawsuit in which we are involved.

4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In summary: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (such as web beacons and pixels) to access or store information. Specific information about how we use these technologies and how you can refuse certain cookies is described in our Cookie Policy: https://www.cookiepolicygenerator.com/live.php?token=xm3SQ9mQ110UGGl6SaepTxYTdsOTfYFP.

5. WHERE IS YOUR INFORMATION HOSTED?

In summary: your information is hosted in France.

Pictalk's servers are hosted in France by OVHcloud. The third parties with whom we may share your personal information (see "WILL YOUR INFORMATION BE SHARED WITH OTHERS?" above) may process it in other countries.

If you reside in the European Economic Area, these countries may not have data protection laws or other laws as comprehensive as those in your country. We will however take all necessary measures to protect your personal information in accordance with this privacy policy and applicable law.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

In summary: We keep your information for as long as necessary to fulfill the purposes described in this privacy policy, unless the law requires otherwise.

We will only retain your personal information for as long as necessary for the purposes set out in this privacy policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this policy will require us to keep your personal information longer than the period during which users have an account with us.

When we no longer have a legitimate business need to process your personal information, we will delete or anonymize it, or, if this is not possible (for example, because your personal information has been stored in backup archives), we will securely store your personal information and isolate it from any further processing until deletion is possible.

7. HOW DO WE PROTECT YOUR INFORMATION?

In summary: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. However, please remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to protect your personal information, the transmission of personal information to and from our Sites or Applications is at your own risk. You should only access the services within a secure environment.

8. DO WE COLLECT INFORMATION FROM MINORS?

In summary: We do not knowingly collect data from children under 18 and do not market to them.

We do not knowingly solicit data from children under 18 and do not market to them. By using the Sites or Applications, you represent that you are at least 18 years of age or that you are the parent or guardian of such minor and consent to the use of the Sites or Applications by such minor in your charge. If we learn that personal information of users under 18 has been collected, we will deactivate the account and take reasonable measures to delete such data from our records quickly. If you become aware of any data we have collected from children under 18, please contact us at alex@pictalk.org.

9. WHAT ARE YOUR PRIVACY RIGHTS?

In summary: In certain regions, such as the European Economic Area, you have rights that provide you greater access and control over your personal information. You can review, change, or terminate your account at any time.

In certain regions (like the European Economic Area), you have certain rights under applicable data protection laws. These rights may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; and (iv) where applicable, to data portability. In certain circumstances, you may also have the right to object to the processing of your personal information. To make such a request, please use the contact details provided below. We will consider and act upon any request in accordance with applicable data protection laws.

If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. However, please note that this will not affect the lawfulness of the processing before its withdrawal.

If you reside in the European Economic Area and believe that we are unlawfully processing your personal information, you also have the right to lodge a complaint with your local data protection authority. You can find their contact details here: https://www.edpb.europa.eu/about-edpb/our-members_en. In France, where Pictalk is based, this is the CNIL: https://www.cnil.fr/fr/plaintes.

Account Information

If you wish to review or modify

the information of your account or terminate your account at any time, you can:
• Log in to your account settings and update your user account.

• Contact us using the contact information provided.

Upon your request to terminate your account, we will deactivate or delete your account and your information from our active databases. However, certain information may be retained in our files to prevent fraud, resolve issues, assist with investigations, enforce our Terms of Service, and/or comply with legal requirements.

Cookies and similar technologies: Most web browsers are set to accept cookies by default. If you prefer, you can generally choose to set your browser to remove cookies and reject cookies. If you choose to remove or reject cookies, this could affect the availability of certain features or services on our Sites or Applications. To opt out of interest-based advertising by advertisers on our Sites or Applications, visit http://www.aboutads.info/choices/. For more information, please review our Cookie Policy: https://www.cookiepolicygenerator.com/live.php?token=xm3SQ9mQ110UGGl6SaepTxYTdsOTfYFP.

Email marketing opt-out: You can unsubscribe from our marketing mailing list at any time by clicking the unsubscribe link in the emails we send or by contacting us using the contact details provided below. You will then be removed from the marketing mailing list – however, we will still need to send you service-related emails that are necessary for the administration and use of your account. To unsubscribe in other ways, you can:
• Note your preferences when registering for an account on the site.

• Access your account settings and update your preferences.

10. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting that you can activate to signal your privacy preference not to have your online browsing activities tracked and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized. As a result, we do not currently respond to browser DNT signals or any other mechanism that communicates your choice not to be tracked online. If a standard for online tracking that we must follow is adopted in the future, we will inform you of this practice in a revised version of this Privacy Policy.

11. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In summary: Yes, if you are a California resident, you have specific rights regarding access to your personal information.

California Civil Code Section 1798.83, also known as the "Shine The Light" law, allows our users who are residents of California to request and obtain from us, once a year and free of charge, information about the categories of personal information (if any) that we have disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with whom we have shared personal information during the preceding calendar year. If you are a California resident and wish to make such a request, please submit your request in writing using the contact details provided below.

If you are under 18 years of age, reside in California, and have a registered account on the Sites or Applications, you have the right to request the removal of unwanted data that you publicly post on the Sites or Applications. To request the removal of such data, please contact us using the contact details provided below, and include the email address associated with your account and a statement that you reside in California. We will ensure that the data is not publicly displayed on the Sites or Applications, but please be aware that the data may not be completely or comprehensively removed from all our systems.

12. DO WE UPDATE THIS POLICY?

In summary: Yes, we will update this policy as necessary to remain compliant with relevant laws.

We may update this privacy policy from time to time. The updated version will be indicated by an updated "Revision" date, and the updated version will be effective as soon as it is accessible. If we make significant changes to this privacy policy, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy policy frequently to be informed about how we are protecting your information.

13. HOW CAN YOU CONTACT US ABOUT THIS POLICY?

If you have any questions or comments about this policy, you can send us an email at alex@pictalk.org or by postal mail at:

Pictalk
13 rue Professeur Pierre Marion
69005 Lyon
France

The controller of your personal information is Pictalk, a French non-profit association (association loi 1901), 13 rue Professeur Pierre Marion, 69005 Lyon, France. Contact: alex@pictalk.org.

HOW CAN YOU REVIEW, UPDATE OR DELETE THE DATA WE COLLECT FROM YOU?

Depending on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, to modify that information, or to delete it in certain circumstances. To request to review, update, or delete your personal information, please write to us at alex@pictalk.org. We will respond to your request within 30 days.

Legal notice