1. Data Controller

Electro Renew SAS is the data controller for account, billing and website data: the accounts of the repair professionals who use ElectroRenew, their purchases and credits, and the data of visitors to this website, people who contact us or join our waiting list. For the data about devices that a repair shop tests for its customers (IMEI, serial numbers, component serial numbers, test results, grades and the reports and certificates built from them), the repair shop is the data controller and Electro Renew SAS is its processor, acting on its instructions under the data processing agreement in our Data Protection Notice. The GDPR and applicable French data protection law apply in both cases.

2. Data We Collect

We collect only data that is necessary to run the service:

2.1 Account Data

• Your e-mail address, and the name and company or shop name you enter at sign-up
• If you sign in through a third-party provider offered on the sign-in page, the e-mail address and name that provider shares with us
• If you tick the newsletter box at sign-up, your e-mail address and name on our newsletter list
• Account creation date and last sign-in time
• Your credit balance and purchase records for credit packs: pack, amount, date, and the Stripe customer and checkout references. Stripe collects your card details, name, e-mail address and billing address, and issues the invoice; card details stay with Stripe

2.2 Device data sent for a certificate or cloud report

Diagnostic results are shown on the technician's PC. Nothing about the tested device is uploaded until the technician asks for a certificate or a cloud report. At that moment the ERenew desktop software sends us:

• Model, operating-system version, storage size, battery capacity and cycle count
• The device's IMEI and serial number
• Other hardware identifiers read during the test — UDID, Wi-Fi and Bluetooth MAC addresses, component serial numbers — as the detail of individual checks
• Whether an iCloud or Google account was still signed in, recorded as present or absent (never the account itself)
• The pass/fail result of every check, from which our server computes the score and grade
• The technician's account e-mail address, which appears on the certificate as the technician of record
• The session number and the software version

A copy of each saved report (identifiers, results and the detail of every check) is also stored in the account's online dashboard, so the account holder can print, export or share it and, for shops, list the device for sale.

2.3 What a certificate shows to anyone who scans it

Each certificate carries a QR code and a 26-character certificate ID. Anyone who scans it, or types the ID on our verification page, sees the device model and storage, its IMEI and serial number, the battery figures, the checks performed and the grade, the test date, whether an account was still signed in, and the technician of record — the e-mail address of the account that saved the report. This is deliberate: it is what lets a buyer confirm that the paper matches the phone in their hand. The certificate also leads to the online copy of the report, which shows the detail of each check, including the hardware identifiers listed in Section 2.2. Treat a certificate ID as you would treat the IMEI itself.

2.4 Technical Data

• Authentication tokens (session management only)
• IP address and browser details, as recorded in the request and sign-in logs of our hosting and database providers
• Error logs for platform diagnostics and support
• Crash and error logs of the desktop software stay on the technician's PC and are not uploaded

2.5 ERenew Device Test (Android mobile app)

Our Android application ERenew Device Test runs hardware self-tests on the device it is installed on. It uses the camera and microphone solely to render live previews for the camera and audio tests; no photo, video or audio recording is stored or transmitted. It uses location solely to verify that the GPS receiver can obtain a fix; coordinates are displayed on screen and are never transmitted or stored. The biometric test invokes the device's own system prompt; no biometric data is read, stored or transmitted.

Used on its own, the app transmits nothing. When a technician starts a session from the ERenew desktop software, the app transmits the result of each test with any note entered for it, the resulting grade and score, the session number and the time of the test. The app itself does not collect your IMEI, phone number, contacts, messages, photos or advertising identifiers; the desktop software registers the session with the phone's IMEI so the results can be matched to the device. To request deletion of a test result, contact the shop that performed the test or write to the address in Section 1.

2.6 Telegram broadcast subscribers

If you start a conversation with our Telegram bot and tap “Confirm subscription”, we record your Telegram chat ID, the display name shown on your Telegram profile, your language code, and the link you arrived from, together with a timestamped copy of the exact wording you agreed to. We keep that record so that we can demonstrate your consent, as GDPR Art. 7(1) requires.

This data is used for one purpose only: sending you the product announcements you asked for. It is never sold, rented, or used to build a profile, and it is never combined with your ERenew account or with any diagnostic data. You can withdraw at any time by sending /stop to the bot or by blocking it — withdrawal is as easy as subscribing, is acted on immediately, and has no effect on your account or on anything else we provide. Following our public Telegram channel instead subscribes you to nothing: channel followers are anonymous to us and we hold no record of them.

2.7 Waiting list and contact form

If you leave your e-mail address to be told when ERenewPro is available, we store the address, the country and segment you selected, your language and the date, and a copy of the sign-up is e-mailed to us. If you use the contact form, your message is e-mailed to us and is not stored in a database. Both are used only to reply to you and to send the download link or product news you asked for; write to us at any time to be removed.

3. Data We Do NOT Collect

• The contents of a tested phone — contacts, messages, photos, apps or accounts. Device identifiers are processed as data about the device; we do not link them to the identity of its owner
• Payment card numbers or financial account information
• Advertising identifiers, cross-site tracking, or marketing profiles built about you
• Biometric data
• Location data beyond country level (the country you select on the waiting list)
• Third-party login tokens, except the eBay authorisation a shop explicitly grants when it connects its own eBay account (Section 6); no social media identifiers other than the Telegram chat ID you give us by subscribing to our broadcast bot (Section 2.6)

4. Legal Basis for Processing

Data Category	Legal Basis (GDPR Art.)	Purpose
Technician accounts	Art. 6(1)(b) — Contract performance	Authentication and access control
Device data, reports and certificates	Art. 6(1)(b) — Contract performance; Art. 6(1)(f) — Legitimate interests	Producing the certificate the technician ordered and letting a buyer verify it
Purchase records and invoices	Art. 6(1)(c) — Legal obligation	Accounting and tax obligations
Technical error logs	Art. 6(1)(f) — Legitimate interests	Platform reliability and security
Telegram broadcast subscribers	Art. 6(1)(a) — Consent	Sending the product announcements you subscribed to
Waiting list and contact form	Art. 6(1)(a) — Consent	Replying to you and sending the download link or news you asked for

5. Data Retention

• Active accounts: Retained while the account exists
• Reports and certificates: 24 months from the test date; the date is shown on the verification page and on reports printed from the dashboard. After it the report data is deleted and only the certificate ID and its status are kept, so a printed certificate can still be recognised as expired or revoked
• Dashboard copies of reports: Until the account holder deletes them or asks us to
• Purchase records and invoices: 10 years (French accounting law)
• Sign-in sessions: Access tokens expire after one hour; a remembered sign-in lasts until you sign out
• Technical logs: 30 days, on the technician's own PC
• Waiting list and contact messages: Until you ask to be removed
• Closed accounts: Deleted on request within 30 days, except records we must keep by law
• Telegram subscribers: Retained until you unsubscribe; the consent record is kept for 3 years afterwards as proof that consent was given and withdrawn

6. Data Sharing & Sub-Processors

We share data only with the following sub-processors, each bound by GDPR-compliant data processing agreements:

Sub-Processor	Role	Data Center Location
Supabase Inc.	Database, authentication and server functions	EU (Stockholm, Sweden)
Cloudflare, Inc.	Website and application hosting, request routing, delivery of contact-form and waiting-list e-mails, purchase receipts and account notifications	EU / US (with SCCs)
Stripe Payments Europe Ltd.	Payment processing and invoicing for credit packs	EU / US (with SCCs)
Google Ireland Ltd. (Google Workspace)	Sending account e-mails: sign-up confirmation, password reset	EU / US (with SCCs)
YouTube (Google Ireland Ltd.)	The video on our demo page. It loads from YouTube only after you press play; until then your browser sends nothing to YouTube or Google. Once you play it, YouTube sees your IP address	EU / US, under Google's own privacy policy
GitHub, Inc. (Microsoft)	Hosting of the software installer downloads — GitHub sees your IP address when you download	US (with SCCs)
eBay	Only for shops that connect their own eBay account: listing content and order data. Never a device's IMEI, serial number or certificate	Under eBay's own privacy policy
Telegram FZ-LLC / Telegram Messenger Inc.	Delivery of broadcast messages to subscribers only (Section 2.6)	Outside the EEA, under Telegram's own privacy policy

We do not share data with advertising networks or analytics platforms, and with no third party beyond those listed above. Stripe receives only what is needed to take a payment; eBay receives only what a shop chooses to publish; Telegram receives only what is inherent in sending you a message you asked for — your Telegram chat ID and the message itself — and only if you have subscribed; it receives no ERenew account or diagnostic data.

7. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of your personal data
• Right to rectification (Art. 16): Correct inaccurate personal data
• Right to erasure (Art. 17): Request deletion, subject to legal retention requirements
• Right to restriction (Art. 18): Limit processing in certain circumstances
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interests

To exercise any of these rights, contact: contact@electrorenew.fr

If you own a tested device: the shop that tested your phone is responsible for the certificate it issued. If you want a certificate removed, contact that shop or write to us with the certificate ID printed on it; we revoke the certificate and delete the report, and the verification page then shows it as revoked.

You also have the right to lodge a complaint with the French data protection authority (CNIL): www.cnil.fr

8. Security

We implement appropriate technical and organizational measures to protect personal data, including:

• Encryption in transit (TLS 1.2+); data at rest is encrypted with AES-256 by our database host, Supabase (supabase.com/security)
• Role-based access control limiting data access to authorized personnel
• Row-level security in database layer

9. Updates to This Policy

This Privacy Policy may be updated periodically. Account holders will be notified of material changes by e-mail to the address associated with their account. The date at the top of this policy reflects the most recent revision.

Questions: contact@electrorenew.fr