Privacy policy
Last updated: 10 June 2026
This privacy policy describes how ODOWA (hereinafter "we") collects, uses, shares and protects the personal data of users of the KARTES mobile applications (KARTES Intervention, KARTES Nature, hereinafter "the Applications"), as well as the associated services accessible via the kartes.io website.
It complies with the General Data Protection Regulation (GDPR) and the French Data Protection Act of 6 January 1978 as amended.
1. Identity of the data controller
The controller of personal data is:
ODOWA SASU
6 rue d'Armaillé, 75017 Paris
SIRET: 945 053 015 00026
Email: support@kartes.io
2. Data collected
2.1 Data provided directly by the user
| Category | Data concerned |
|---|---|
| User account | Email address, password (hashed), surname, first name, phone number (optional), profile photo (optional) |
| Workspace | Organisation name, logo, settings, user role (member, administrator, owner) |
| Content produced in the application | Photos of infrastructure items taken from the application, entered descriptions, comments, inspection and intervention forms, electronic signatures, voice recordings for transcription |
| Payment (paid plans) | Billing data processed by Stripe (name, billing address). Card data never passes through our servers. |
2.2 Data collected automatically
| Category | Data concerned |
|---|---|
| Location data | GPS coordinates (latitude/longitude) when creating or viewing an item on the map, as well as for the optional team location-sharing feature (Pro plan and above, deactivatable) |
| Technical data | IP address, device type, OS version (Android/iOS/Web), application version, anonymised technical identifiers |
| Activity logs (audit log) | Timestamped history of actions performed (creation / modification / deletion of items, interventions, inspections) with user identifier — used for traceability and security |
| Usage data | Pages viewed, features used, time spent, for internal statistical purposes |
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creation and management of the user account | Performance of the contract (ToS) |
| Provision of the application's features (mapping, inspection, intervention, reporting) | Performance of the contract |
| Geolocation of items on the map | Performance of the contract — the feature requires location to work |
| Image analysis by artificial intelligence (AI Vision: object recognition, field suggestions) | Performance of the contract / consent (optional, activatable feature) |
| Voice transcription by artificial intelligence (AI Voice) | Consent (explicitly triggered by the user) |
| AI conversational assistant | Consent (optional feature) |
| Team messaging | Performance of the contract |
| Push notifications (alerts, messages, reminders) | Consent (system permission, activatable/deactivatable) |
| Gamification (badges, optional leaderboards) | Performance of the contract — deactivatable by the administrator |
| Team location sharing (Pro+ plans) | Consent (activatable by each member individually) |
| Subscription billing and payment | Performance of the contract / legal obligation (accounting) |
| Security, fraud prevention, traceability (audit log) | Legitimate interest / legal obligation |
| Anonymised internal usage statistics | Legitimate interest |
| Transactional communications (password reset, confirmations) | Performance of the contract |
4. Mobile application permissions
The KARTES applications request the following system permissions on Android and iOS. All are requested contextually at the time of their first use and can be revoked at any time in the device settings.
| Permission | Usage justification |
|---|---|
| Camera | Take photos of infrastructure items (equipment, signage, damage) to associate them with mapped items or with interventions/inspections. |
| Location (precise and approximate) | Geolocate items when creating them on the map, show your real-time position to help you get around in the field, and where applicable share your position with your team (optional feature). |
| Microphone | Record voice annotations transcribed by AI to quickly fill in fields without a keyboard (optional feature). |
| Storage / Photos | Select existing images from the gallery to attach them to an item or an intervention. |
| Notifications | Alert you to relevant events (new message, assigned intervention, important alert). |
| Internet | Sync data with our servers and use cloud AI features. |
5. Processors and data recipients
To provide the applications' services, we use technical processors selected for their GDPR compliance:
| Processor | Purpose | Data concerned |
|---|---|---|
| Amazon Web Services (AWS S3) | Storage of uploaded photos and files | Photos taken from the application, profile photos, covers |
| Anthropic (Claude API) | AI image analysis (Vision), voice transcription (Voice), conversational assistant — optional, deactivable features | Uploaded images, voice recordings, text prompts — only when explicitly triggered by the user, and only if the feature is enabled |
| Mapbox | Map display, address geocoding | GPS coordinates, searched addresses |
| Stripe | Processing of subscription payments | Name, email, billing address, card data (handled exclusively by Stripe, never by our servers) |
| DeepL | Automatic translation of content for non-French-speaking users | Text snippets to translate (labels, object-type descriptions) |
| Host (API servers) | Hosting of the database and application servers | All user data |
| Transactional email services | Sending emails (password reset, invitations, invoices) | Email address, first name |
The artificial intelligence features (image analysis, voice transcription, conversational assistant), which rely on the sub-processor Anthropic, are optional and deactivable. When they are not enabled, no data is sent to Anthropic.
No personal data is resold to third parties for commercial or advertising purposes.
6. Transfers outside the European Union
Some of our processors may process data from countries outside the European Union:
- Anthropic (United States): transfers governed by the European Commission's Standard Contractual Clauses (SCCs).
- Stripe (United States / Ireland): certified under the EU-US Data Privacy Framework (DPF), and SCCs.
- AWS: our S3 buckets are configured in the eu-west-3 region (Paris) — your photos and files remain stored in France.
- Mapbox: SCCs for map tile requests.
7. Retention periods
| Data category | Retention period |
|---|---|
| User account (profile, credentials) | As long as the account is active. Deletion on request, or after prolonged inactivity (3 years without login) |
| Content produced (photos, items, interventions) | As long as the workspace is active. Permanent deletion within 30 days after deletion of the account or workspace |
| Audit logs (audit log) | 2 years from the event |
| Billing data | 10 years (legal accounting obligation) |
| Technical logs (login, errors) | 12 months maximum |
| Backups | 30 to 90 days depending on criticality |
| Data sent to the AIs (Anthropic) | Not retained by Anthropic beyond the request (zero-retention policy for API usage) |
8. Data security
We implement technical and organisational measures to protect your data:
- TLS encryption for all client/server communications
- Hashed passwords (bcrypt algorithm) — never stored in plain text
- Authentication via short-lived JWT tokens + revocable refresh tokens
- Strict data isolation per workspace (multi-tenant partitioning in the database and cache)
- Encrypted backups
- Role-based access control (RBAC) on the server side
- Timestamped audit logs to trace any sensitive action
- Regular security updates of servers and dependencies
9. Your rights
In accordance with the GDPR, you have the following rights over your personal data:
- Right of access: obtain a copy of the data concerning you
- Right to rectification: correct inaccurate or incomplete data
- Right to erasure ("right to be forgotten"): request the deletion of your data, subject to our legal obligations
- Right to restriction of processing
- Right to object to processing based on legitimate interest
- Right to portability: receive your data in a structured and readable format
- Right to withdraw your consent at any time for processing based on it
- Right to lodge a complaint with the CNIL (www.cnil.fr)
To exercise your rights, contact us at support@kartes.io. We reply within a maximum of one month.
You can also delete your account directly from the applications, in the user settings.
10. Minors
The KARTES applications are professional tools intended for infrastructure-management stakeholders (local authorities, companies, asset managers). They are not intended for persons under 16 and we do not knowingly collect data concerning minors. If you believe a minor has provided us with data, contact us for immediate deletion.
12. Changes to the policy
This policy may be updated to reflect technical, legal or functional developments. Any substantial change will be notified to users (in-app notification or email). The date of the last update appears at the top of this document.
13. Contact
For any question relating to this privacy policy or the processing of your personal data:
Email: support@kartes.io
Post: ODOWA, 6 rue d'Armaillé, 75017 Paris