Privacy Policy

The data controller is:

Autopoly

• Registered office: 68 Rue Nollet, 75017 Paris
• Email: contact@qomob.fr
• Phone: +33 1 76 31 06 55

Autopoly operates the Qomob brand: the website and car-sharing services (qomob.fr) as well as the mobile application used by end users of the service.

This privacy policy applies to the two services operated by Autopoly:

• qomob.fr website: commercial presentation site of the car-sharing service for companies and property developers.
• Qomob mobile application (Android and iOS): application used by employees of client companies to book vehicles, perform vehicle inspections and unlock the vehicle through the on-board IoT device.

Data processing differs depending on the service used. Each section specifies, where relevant, which service is concerned.

When using the qomob.fr website, we may collect the following personal data:

Via the contact form:

• Full name
• Professional email address
• Company name
• Phone number
• Profile type (business or property developer)
• Message

Browsing data:

• IP address
• Browser type and version
• Pages visited and duration of visit
• Date and time of connection

The Qomob mobile app collects the following categories of data:

Identity and user account:

• Email address, last name, first name (provided by your employer when you are linked to the company, or entered during signup)
• Unique user identifier
• Role (user, fleet manager, administrator)
• Linked company
• Password (hashed, never stored in plain text)

Service usage data:

• Bookings created (dates, selected vehicle, status)
• Vehicle inspections performed (notes, fuel level, mileage)
• History of vehicle actions (unlock, lock, start)

Vehicle inspection photos:

• Photos taken during vehicle inspections (pickup and return)
• Stored encrypted on OVHcloud Object Storage, hosted in France (European Union)
• Retained for 24 months after the end of the booking, then deleted

Location:

• Precise GPS position of the smartphone to display nearby vehicles
• Position at the moment of pickup and return (for contractual proof)
• Outside of these uses, position is neither stored nor tracked in the background

Bluetooth identifiers:

• Technical identifiers (MAC addresses) of nearby vehicle IoT devices, used to identify the device of the booked vehicle
• Used in real time during the interaction only, not stored afterwards

Technical diagnostic data:

• Device model, operating system version, app version
• Push notification token (Firebase Cloud Messaging)
• Application error and performance logs, associated with a pseudonymized user identifier

The Qomob mobile app requests the following permissions on your device. Each permission is strictly tied to a service feature:

• Camera (CAMERA): capture vehicle inspection photos
• Precise location (ACCESS_FINE_LOCATION) and approximate location (ACCESS_COARSE_LOCATION): display nearby vehicles, identify the on-board device during pickup
• Bluetooth (BLUETOOTH_SCAN and BLUETOOTH_CONNECT): communicate with the IoT device installed in the vehicle to unlock and lock it, including when no cellular network is available
• Notifications (POST_NOTIFICATIONS): booking confirmations, reminders and safety alerts
• Photo library (READ_MEDIA_IMAGES): select a profile picture from your photo library (optional)

Each permission can be revoked individually from your device settings. Some features may then become unavailable (for example, without the Bluetooth permission, unlocking the vehicle through the app is no longer possible).

The data collected is used for the following purposes:

Website qomob.fr:

• Handling contact requests: responding to your information requests, scheduling meetings and ensuring commercial follow-up
• Website improvement: analyzing website usage to improve content and usability
• Commercial communication: sending you information about our offers and services, only with your prior consent

Qomob mobile app:

• Provision of the car-sharing service: authentication, booking management, vehicle inspections, vehicle access control
• Security and service continuity: detection of abnormal behavior, incident management, backup
• Contractual proof: retention of vehicle inspections and photos in case of dispute over the condition of a vehicle
• Operational notifications: booking confirmations, reminders, vehicle safety alerts

Common to both services:

• Legal obligations: meeting our legal, accounting and tax obligations

The processing of your data is based on the following legal grounds (Article 6 of the GDPR):

• Performance of a contract: data processing in the Qomob mobile app is necessary to perform the car-sharing contract entered into by your employer with Qomob/Autopoly
• Legitimate interest: handling website contact requests, B2B prospecting, service security
• Consent: sending commercial communications, precise geolocation outside strictly contractual use, push notifications
• Legal obligation: data retention for accounting, tax and contractual proof purposes

Your personal data may be shared with the following recipients:

Internal Autopoly teams: sales, customer support and management.

Technical subcontractors of the website:

• Vercel Inc. (United States): website hosting
• Supabase Inc. (United States): database
• Resend Inc. (United States): transactional email delivery

Technical subcontractors of the Qomob mobile app:

• Supabase Inc. (United States): database and authentication
• OVHcloud SAS (France): storage of vehicle inspection photos
• Google LLC (United States) via Firebase Cloud Messaging: push notification delivery
• Sentry, Inc. (United States): application error and performance logs
• IoT device vendor (Dunasys SAS, France, or equivalent alternative): vehicle command delivery and telemetry. This vendor acts as a processor on our behalf or as a joint controller, depending on the applicable contractual terms.

Employer (client company): your employer receives aggregated fleet usage indicators (occupancy rate, average duration, mileage, etc.). Individual usage details are not shared without explicit contractual basis.

These subcontractors are contractually bound to ensure the confidentiality and security of your data. When they are located outside the European Union, appropriate safeguards are in place (European Commission standard contractual clauses).

Your data is never sold or transferred to third parties for commercial purposes.

The Qomob mobile app stores some data locally on your device, in secure spaces:

• Authentication session: stored in the system's secure storage (Keychain on iOS, EncryptedSharedPreferences on Android). Cleared upon sign-out or when the app's data is erased.
• Local business data cache: stored in an encrypted SQLite database (AES-256 algorithm, via SQLCipher). The encryption key is derived from a secret stored in the system's secure vault and is never transmitted to the server.
• Image cache: stored on the local device storage, under your user profile, to limit network usage.

All local data is wiped when the app is uninstalled or when you use the "Clear data" option in your device settings. Android Auto Backup is disabled to prevent any unintended session restoration to a new device.

With your consent, the Qomob mobile app sends push notifications for the following events:

• Booking confirmation
• Vehicle pickup reminder
• Safety alert (anomaly detected on the vehicle currently in use)
• Important service-related information

Notifications are routed through Firebase Cloud Messaging (Google LLC). The detailed notification payload is limited to non-sensitive information; complete data is fetched within the app when opened.

You can disable notifications at any time from your device settings or from the Qomob app settings.

Your personal data is retained for the following periods:

Website:

• Contact data: 3 years from the last exchange
• Browsing data: 13 months maximum
• Cookies: see the "Cookies" section below

Qomob mobile app:

• User account: duration of the contract between your employer and Qomob/Autopoly, plus an additional 12 months for the handling of any disputes
• Bookings and vehicle inspections: 5 years (contractual statute of limitations)
• Vehicle inspection photos: 24 months after the end of the booking
• Position at pickup / return: 5 years (as contractual evidence)
• Error and performance logs: 90 days
• Push notification token: lifetime of the installation, until uninstallation or revocation

At the end of these periods, your data is deleted or anonymized.

In accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights:

• Right of access: obtain confirmation that your data is being processed and obtain a copy
• Right to rectification: request the correction of inaccurate or incomplete data
• Right to erasure: request the deletion of your data in cases provided by law
• Right to restriction: request the restriction of processing of your data
• Right to data portability: receive your data in a structured, commonly used format
• Right to object: object to the processing of your data on legitimate grounds
• Right to withdraw consent: withdraw your consent at any time for consent-based processing

To exercise your rights, contact us at: contact@qomob.fr

You also have the right to lodge a complaint with the French Data Protection Authority (CNIL): www.cnil.fr

The qomob.fr website uses cookies to ensure proper functioning and improve the user experience. The Qomob mobile app does not use cookies in the traditional sense; data stored locally is described in the "Local Storage and Encryption on the Mobile Device" section.

Strictly necessary cookies:
These cookies are essential for the website to function. They cannot be disabled.

Analytical cookies:
These cookies allow us to measure traffic and analyze browsing on the website. They are only set with your consent.

You can manage your cookie preferences at any time through your browser settings.

Autopoly implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration or disclosure:

• Communications encrypted in transit (HTTPS/TLS on all exchanges)
• Local encryption on the mobile device (see dedicated section)
• Multi-tenant isolation via database-level access control (Row-Level Security)
• Strong authentication with second factor available for administrators
• Restricted data access on a strict need-to-know basis
• Secure hosting with certified providers
• Error and incident monitoring via Sentry, with internal notification procedures
• Regular database backups, retained encrypted

Autopoly reserves the right to modify this privacy policy at any time, in particular to reflect changes to the service, a new subcontractor or a regulatory obligation. In the event of a substantial change, a notice will be published on the website and, where relevant, within the Qomob mobile app. The date of last update is indicated at the top of this page.

For any questions regarding this privacy policy, the Qomob mobile app or the protection of your personal data, you can contact us:

Email : contact@qomob.fr
Address : Autopoly — 68 Rue Nollet, 75017 Paris
Phone : +33 1 76 31 06 55