PinStreet

Privacy Policy

Version 1.2 — May 2026

Important notice on language: This English version is an unofficial translation provided for the convenience of non-French-speaking Users. In the event of any inconsistency or contradiction between this English version and the original French version, the French version shall prevail.

1. Data Controller

Information	Value
Company	The Smart AI
Website	thesmartai.tech
Application	PinStreet
Contact	support@thesmartai.tech
DSA Point of Contact	support@thesmartai.tech
Country	France (EU)

2. Data Collected and Legal Bases

In accordance with Article 13 of the GDPR, we inform you of the data collected, its purpose, its legal basis and its retention period.

PinStreet is based on a strong principle of data minimization: no individual activity history is retained beyond 72 hours, except for specific legal obligations. Your account (email, pseudonym) persists as long as you wish, but your reports are never linked to your profile beyond their lifespan.

Data	Purpose	Legal Basis (Art. 6)	Retention
Email address	Authentication, service communication	Performance of contract (6.1.b)	Duration of active account
Pseudonym	Identification in the app	Performance of contract (6.1.b)	Duration of active account
Profile picture (optional)	Profile personalization	Consent (6.1.a)	Duration of account or withdrawal of consent
Real-time geolocation	Map display, proximity reports	Explicit consent (6.1.a)	Not stored — processed in memory on your device only
Home GPS (optional)	Personalized proximity alerts	Explicit consent (6.1.a)	Until withdrawal of consent
Geolocated reports	Collaborative safety map	Performance of contract (6.1.b)	72 hours maximum, with no link to your account beyond. Only aggregated and anonymized data remains thereafter.
Report author logs (technical identifiers)	Response to judicial requisitions (LCEN Art. 6-II); illicit content notification mechanism (DSA Art. 16)	Legal obligation (6.1.c)	1 year from publication of the report. Access strictly limited to judicial authorities.
Google connection (OAuth)	Simplified authentication	Consent (6.1.a)	Duration of active account
Advertising identifier (IDFA / GAID)	Display of personalized advertisements via Google AdMob	ePrivacy + GDPR consent (6.1.a)	13 months maximum, or until consent withdrawal (whichever is shorter)
Session data / notified illicit content (DSA)	Processing of illicit content notifications (DSA Art. 16)	Legal obligation (6.1.c)	3 years (proof of notification processing)

3. Geolocation — Specific Processing

Geolocation is treated with particular care due to its sensitivity.

Your real-time position is processed exclusively on your device to center the map. It is never transmitted to our servers without your explicit action.
When you create a report, an approximate position (rounded to 50 meters) is recorded. The precise position is never retained.
Geolocation can only be activated after your explicit consent, granted separately from other authorizations.
You can revoke this consent at any time in the application settings or your device settings.
Your position is never shared with other users. Only the approximate positions of reports are visible on the map.

Your home address, if you provide it, is stored in encrypted form and is only used to generate personalized proximity alerts.

4. Reports — Minimization and Protection of Third Parties

Reports of behavior or atmosphere on public roads may constitute personal data within the meaning of the GDPR when they allow indirect identification of individuals.

4.1 Nature and Lifespan of Reports

Reports describe a subjective perception at a location and a given moment. They constitute neither an official finding nor a legal qualification.
No identification of natural persons is permitted in the reports.
Each report automatically expires within 72 hours of its publication.
Beyond 72 hours, no individual report data is retained on our servers. Only aggregated and anonymized data (area statistics, trends, density) remains and may be displayed on the map as global visualizations.
The link between a report and its author’s account is not retained beyond the lifespan of the report. You therefore cannot consult your “history” of reports either in the application or through a data access request.
Any person who considers themselves concerned by a report may exercise a right of objection with us during the lifespan of the report (72h).

4.2 Author Logs — Retention under LCEN and DSA

Independently of the report’s lifespan, we retain for 1 year certain technical identifiers allowing, upon judicial requisition only, the identification of the author of a report. This retention responds to a legal obligation arising from Article 6-II of French Law No. 2004-575 of June 21, 2004 (LCEN) which applies to content hosting providers, and complements the illicit content notification mechanism provided for by Article 16 of Regulation (EU) 2022/2065 (DSA).

Data concerned: author’s pseudonym, publication timestamp, IP address of connection, session technical identifier.
Purpose: enable identification of an author in case of requisition by a judicial authority; document received illicit content notifications.
Legal basis: legal obligation (GDPR Art. 6.1.c; LCEN Art. 6-II; DSA Art. 16-17).
Retention: 1 year from the publication of the report.
Recipients: this data is never consulted by our team outside of a formal judicial requisition or the processing of a DSA notification, and is never transmitted to third parties for commercial or statistical purposes.
Right of objection: as this data is processed on the basis of a legal obligation, the right of objection (GDPR Art. 21) does not apply. The other rights (access, rectification) remain exercisable subject to proof of your identity.

4.3 DSA Point of Contact and Reporting of Illicit Content

In accordance with Articles 11, 12 and 16 of Regulation (EU) 2022/2065 on digital services (DSA), The Smart AI has designated a single point of contact for authorities, users and any person wishing to report illicit content present on PinStreet:

Email address: support@thesmartai.tech
Languages accepted for communication: French, English.

Any person may report content they consider unlawful via the “Report abuse” function available directly from the relevant report in the application, or by email to the address above.

5. Minimum Age — Protection of Minors

PinStreet is aimed at adolescents and adults from age 15.

Registration is strictly prohibited for persons under 15 years of age.
An age verification is required at registration. In case of detection of a profile under 15 years of age, registration is immediately refused and no data is retained.
The age threshold of 15 years corresponds to the digital consent age set by French law in application of Article 8 of the GDPR.

If you are a parent and believe your minor child has registered despite this threshold, contact us at support@thesmartai.tech for immediate account deletion.

Note: for users residing in other European jurisdictions, specific age thresholds may apply pursuant to GDPR Art. 8. The conditions applicable to your country will be presented to you at the time of registration.

6. Subcontractors and Transfers Outside the EU

We use the following subcontractors, with whom a Data Processing Agreement (DPA) is signed:

Subcontractor	Use	Location	Transfer Safeguard
Google (Maps, OAuth, FCM)	Mapping, authentication, notifications	USA	Standard contractual clauses — Decision 2021/914
Google AdMob	Advertising network (personalized and contextual advertising)	USA (Google LLC) / Ireland (Google Ireland Limited for EEA)	Standard contractual clauses — Decision 2021/914; ePrivacy consent required
Hosting provider (TBD)	Data storage	EU recommended	EU hosting or SCC

Details of processing operations carried out by Google AdMob are specified in section 8 of this policy.

7. Your Rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights:

Right	What You Can Do
Access (Art. 15)	Obtain a copy of all your personal data still stored. Reports expired beyond 72h are no longer individually accessible.
Rectification (Art. 16)	Correct inaccurate or incomplete data in your profile.
Erasure (Art. 17)	Delete your account and all your associated data. LCEN logs remain retained until the expiration of their legal duration (1 year).
Restriction (Art. 18)	Suspend processing without erasing your data.
Portability (Art. 20)	Receive your data in a structured format. Given the limited lifespan of reports (72h), portability essentially concerns profile data.
Objection (Art. 21)	Object to processing based on legitimate interest. Does not apply to processing based on a legal obligation (LCEN, DSA logs).
Withdrawal of consent	Revoke at any time a consent given, without retroactive effect (advertising, geolocation, profile picture).

To exercise your rights: use the account deletion function in the application (Profile > Settings), or contact us at support@thesmartai.tech. We respond within a maximum of 30 days.

You also have the right to lodge a complaint with the French Data Protection Authority (CNIL) — www.cnil.fr — if you consider that the processing of your data does not comply with the GDPR.

8. Advertising and Cookies

PinStreet is financed by the display of integrated advertisements. No paid subscription is required to use the application.

8.1 Single Advertising Partner — Google AdMob

The Smart AI has chosen to use a single advertising partner, Google AdMob, provided by Google Ireland Limited for users residing in the European Economic Area and Google LLC for others. No other advertising network operates on the application.

Subject to your explicit consent, Google AdMob may:

Place an advertising identifier (IDFA on iOS, GAID on Android);
Use in-app navigation data and presumed interests to display personalized advertisements;
Measure advertising performance (impressions, clicks).

The details of the processing carried out by Google are governed by Google’s policies, including the “Google Privacy Policy” and the “Google AdMob Privacy Policy”, accessible from policies.google.com. The transfer of data to Google LLC (USA) is governed by the standard contractual clauses adopted by the European Commission (Decision 2021/914).

In accordance with the ePrivacy Directive and the CNIL “cookies” recommendation of 2020:

No advertising identifier is collected or transmitted to Google before your explicit consent, obtained via a compliant consent banner displayed at first launch of the application;
You can accept personalized advertising, or refuse it while retaining full access to the application;
In case of refusal, non-personalized advertisements (contextual, without profiling) may be displayed;
Refusal is as simple as acceptance (same interface level);
You can revoke your consent at any time from Profile > Settings > Advertising. Revocation has no retroactive effect.

8.3 Editorial Curation of Advertisements

The Smart AI exercises active curation over the categories of advertisements distributed, in a logic of alignment with the values carried by PinStreet (safety, kindness, respect for users and their neighborhood). As such, and regardless of your consent to personalized advertising, the following categories are excluded from being displayed on the application:

Alcoholic beverages and derived products;
Tobacco products, electronic cigarettes and vaping products;
Gambling, sports betting, lotteries;
Dating services, dating applications and sites for sentimental or sexual matchmaking;
Private security services, sale of weapons, personal defense equipment.

Any report of advertising deemed inappropriate may be sent to support@thesmartai.tech.

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

Encryption of data in transit (TLS 1.3) and at rest (AES-256).
Strict access control — each user accesses only their own data (Row Level Security).
Systematic aggregation and anonymization of geolocation data before long-term storage.
Automatic expiration of individual report data at 72h, without manual intervention.
Strict partitioning between LCEN author logs (judicial access only) and current application data.
Regular security review and logging of data access.

10. Modifications to this Policy

We may update this policy to reflect legal, technical or service developments. In case of substantial modification, we will inform you by notification in the application at least 15 days before the entry into force. The date of last update appears at the top of the document.

The current version is always accessible in the application (Profile > Privacy) and on thesmartai.tech.

11. Contact and DPO

For any questions regarding the processing of your personal data:

Email: support@thesmartai.tech
Website: thesmartai.tech
Data Controller: The Smart AI, France
DSA Single Point of Contact (illicit content notification, communication from authorities): support@thesmartai.tech

An external Data Protection Officer (DPO) is being designated given PinStreet’s processing profile (geolocation, behavioral data). Their contact details will be published in this section as soon as they are appointed.

© 2026 The Smart AI — PinStreet. All rights reserved. Document established in accordance with the GDPR (EU) 2016/679, French Law No. 78-17 of January 6, 1978 as amended, and Regulation (EU) 2022/2065 (DSA). Unofficial English translation of the original French document. The French version prevails legally.