Privacy policy

1. Controller

M2S CONSULTING SERVICES, French limited liability company (SARL), RCS Nanterre 938 799 673, office 19 rue Alexandre Antonini, 92110 Clichy, France. Email: mehdi@mtougui.com.

No data protection officer is currently appointed under GDPR article 37. Requests go to the controller at the addresses above. A DPO will be named here if required or appointed voluntarily.

2. People we process data about

We process data about:

• users with an account (personal Arc);
• unsigned visitors (limited technical logs);
• people, public figures, creators, companies, associations, institutions and teams who have a catalog page, including unclaimed pages;
• representatives who claim a page for someone else.

3. Purposes

Purposes include:

• providing the Service: account (email or Google), Arc, visibility, Arc Story, following, search, explore;
• generating the Home and Following feeds automatically from life updates (chapters, present, future, events), without requiring a “post”;
• compiling and updating a public catalog of Arcs from information already public;
• claim, correction, report and removal;
• resolving place names to coordinates via OpenStreetMap Nominatim when the life map needs them;
• security, fraud and impersonation prevention, legal duties;
• analytics if you accept, and service messages (email confirmation, password reset).

4. Legal bases

Account and Service: GDPR article 6.1.b (contract).

Legal duties: article 6.1.c.

Legitimate interests (article 6.1.f), after balancing: security, abuse prevention, a catalog of already-public information, generating a feed for followers according to visibility, running the Service. You may object under article 21.

Consent (article 6.1.a): analytics cookies (Google Analytics) if you accept. Consent can be withdrawn via Cookies in the footer.

Special category data (article 9): we do not set out to process it. If it appears, only where made manifestly public by the person (article 9.2.e) or entered by the account holder. It can be removed on request.

5. Catalog pages and public sources

LifArcs may create and publish Arcs without the person’s account, from publicly available sources: official sites, releases, press, open registers, encyclopaedias, public social pages, open data. This is not an official biography, affiliation or endorsement.

The basis is a legitimate interest in informing the public about a path that is already public, balanced against the person’s rights. Publication weighs more for public figures, legal persons, institutions and teams; removal weighs more for a private person without public notoriety, a minor, or information that is inaccurate, outdated or intrusive.

We do not copy protected works in full. Historical and biographical facts are not owned. Dates, titles and links are for information, not to replace the source.

Correction, context, internal delisting or removal: use Report / Request a correction in the Service, or mehdi@mtougui.com. A public figure has no automatic right to erase accurate, current information of public interest that is already public. We review each request.

6. Automatic feed (no posts)

LifArcs is not microblogging. The feed is not a series of posts you write for the feed. The system produces it when life elements are created or updated in an Arc (a chapter, a present change, an event).

Following someone means receiving life updates they (or the catalog) made visible — not a stream of voluntary posts. You are responsible for what you enter in your Arc. LifArcs is responsible for what it enters on an unclaimed catalog page.

Feed distribution follows each item’s visibility. A private item does not feed third parties. Home shows people you follow.

7. Categories of data

Account: email, Google sign-in identifiers if you use Google, password (hashed by the auth provider), session identifiers.

Arc: display name, public handle, photo, biography, chapters, present, future, links, categories, page type, visibility, Arc Story layout and visibility.

Social: follows, lists, reports, claims.

Places: city or country name, geographic coordinates once resolved.

Catalog: biographical and public-interest data from public sources, claim status, source notes where relevant.

Technical: security logs, IP, user-agent, timestamps, strictly necessary cookies, language, cookie choice.

Arc Story video: the file is generated in your browser. We do not receive or store it. Sharing uses your device’s share sheet.

We do not sell data. We do not build credit files or behavioural ad scores.

8. Recipients and processors

Staff of M2S CONSULTING SERVICES on a need-to-know basis.

App host: Vercel Inc.. Data and auth: Supabase, Inc. (European Union (Ireland, AWS eu-west-1)). Google sign-in: Google Ireland Limited / Google LLC, only if you choose that option. Analytics: Google Analytics, only if you accept. Geocoding: Nominatim (OpenStreetMap), limited to the place name.

Competent authorities where the law requires.

The public: only what the holder made public, or what the catalog publishes as already public.

Followers: items whose visibility allows it, via the automatic feed.

Processors are bound by GDPR article 28 contracts.

9. Transfers outside the EU

Application traffic may pass through Vercel Inc. in the United States, under an adequacy decision (EU-US framework) and/or the Commission’s standard contractual clauses, with extra safeguards if needed. Google sign-in and, if you accept, Google Analytics also involve Google in the United States, on the same basis.

Core data is hosted in European Union (Ireland, AWS eu-west-1).

10. Retention

Account and Arc: for the life of the account, then deletion or anonymisation within a reasonable time after closure, unless the law or a dispute requires otherwise.

Catalog page: while the legitimate interest lasts, or until a well-founded removal. A claimed page follows the holder’s rules.

Security logs: limited, in principle no more than 12 months.

Claim and report evidence: as long as needed to handle the case and limitation periods.

11. Your rights

Access, rectification, erasure, restriction, objection, portability (where the basis is contract and you provided the data), and French post-mortem instructions.

Account: settings, edit, delete account.

A page about you: claim, correction, report, removal. ID or a mandate may be requested only to check standing, and is not kept longer than needed.

Requests: mehdi@mtougui.com or 19 rue Alexandre Antonini, 92110 Clichy, France. We answer within GDPR article 12 time limits.

Complaint: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

12. Children

The Service is not for anyone under 15 (French digital consent age). We do not intentionally compile catalog pages of minors.

If you hold parental authority and a page concerns a minor, write to mehdi@mtougui.com: removal is a priority.

13. Cookies

Strictly necessary cookies and storage: auth session, CSRF/PKCE, language, remembering your cookie choice. These do not require consent under French law.

Analytics: Google Analytics (Google Ireland Limited / Google LLC), only if you click Accept or enable that category. IP anonymisation on, Google ads signals off. Reject is as easy as accept. You can change your choice via Cookies in the footer.

No advertising cookies, Meta/TikTok pixels or commercial profiling as of this policy. If advertising is introduced later, this policy will be updated before any advertising tracker is set.

14. Security

Organisational and technical measures including encryption in transit, access control, and hashed credentials at the auth provider. Nothing is infallible. Report a vulnerability to mehdi@mtougui.com.

15. Changes

This policy may change. The date at the top controls. Material changes may be announced in the Service or by email.