01Who is responsible
The data controller is Karukera Labs — Karukera Labs, nom commercial de Teddy Barbin, entrepreneur individuel (EI) — Port Blanc, 97190 Le Gosier, Guadeloupe, registration number SIREN 824 591 713 — SIRET 824 591 713 00014.
For any question or request about your data: [email protected].
This document is issued under articles 12 to 14 of the General Data Protection Regulation.
02What this document covers
It describes the processing carried out by the Ralay application and by the servers that run it.
It does not cover what third-party services you access elsewhere do, nor what an employer does with information you give them yourself in a conversation.
It forms an integral part of the terms of use.
03What you give us
Nothing is collected without your knowledge: everything below was entered by you.
- To sign in: mobile phone number, email address, password. The password is never kept in clear text, only as a cryptographic hash.
- To verify your age: your date of birth. It is used solely to establish that you are 18 or over — Ralay connects people for work, and is not equipped to handle the rules around minors at work. It is shown to no one, never passed to another user, and the app itself only receives the answer: adult or not.
- To be found: first name, last name, city, working radius, declared trades, available days.
- Optional: a profile photo.
- To post: business name and address, optional registration number, listing content.
- To talk: the messages you send.
- For safety: the text of the reports you write.
04What your use produces
Some data arises from use itself, without you having to enter it.
- The coordinates of the city you declared, derived from its name.
- The history of offers received, accepted or declined, and the time of the reply.
- Assignments declared as completed, and the resulting attendance rate.
- The device’s notification token, and the log of what was sent.
- Subscription status and its identifier at Apple or Google.
- On a crash: device type, application version and the call stack.
05What Ralay does not collect
This list matters as much as the previous one, and it can be checked in the code.
- No banking data: it is handled by Apple or Google, never by Ralay.
- No GPS position, no movement tracking, no home address.
- No contacts from your address book.
- No advertising identifier, no third-party tracker for targeting.
- No sensitive data within the meaning of article 9 GDPR: no origin, opinion, belief, health or sex life. No field asks for them.
- No profiling intended to assess your personality or employability.
06Location, and what it is not
Ralay does not access your phone’s position and does not track it. It uses the coordinates of the city you declared, and a radius you set yourself.
That city-and-radius pair is what decides whether a listing reaches you. The distance shown to an employer is computed from those same values: it reveals neither your address nor where you are at that moment.
The location metadata your phone stores inside a photo is removed on the device, before sending, by re-encoding the image. A photo taken at home therefore does not transmit your home address.
07Why, and on what basis
Each processing operation has a purpose and a legal basis, within the meaning of article 6 GDPR.
- Running the matching service, including geographic targeting and conversations: performance of our contract.
- Sending an SMS code to verify a number: performance of our contract.
- Managing subscriptions: performance of our contract.
- Keeping accounts and retaining records: legal obligation.
- Sending offer notifications: your consent, requested when it becomes useful, and withdrawable at any time.
- Handling reports, preventing abuse and fraud: our legitimate interest in keeping the service safe.
- Understanding and fixing crashes: our legitimate interest in a service that works.
08Who else has access
No one but the people concerned and, solely for the needs of the service, the providers named in the next section.
No data is sold, rented, exchanged, or shared for advertising. No data broker is involved.
Inside the company, access is limited to those who need it, and access to production data is logged.
Data may be disclosed to a judicial or administrative authority upon lawful request. We comply only within the limits of the request.
09Our processors
They are named, and each is bound by a contract compliant with article 28 GDPR.
- Supabase, Inc. — infrastructure Amazon Web Services: hosting of the database, authentication and processing. Region Union européenne — France (Paris), AWS eu-west-3.
- Twilio: delivery of verification SMS. Receives the number and the code, nothing else.
- Expo (exp.host): delivery of notifications. Receives the device token and the notification text, which never contains contact details.
- Apple and Google: subscription purchase and billing.
- RevenueCat: tracking of subscription status. Receives an account identifier, never banking data.
- Sentry: crash reports, redacted before sending.
10What other users see
An employer broadcasting a listing sees, among the people who accepted: first name, last-name initial, your photo if you added one, declared trades, city, approximate distance, and the history of assignments completed through Ralay.
Full name, phone number and email address are never shown to another user. They travel only if you write them yourself in a conversation.
A conversation only opens after your explicit agreement. Declining is invisible, consumes nothing, and has no effect on later offers.
A worker, for their part, sees the name and city of the business — not a photo of its owner.
11Notifications
Permission is requested once, right after your first declared available day, not at launch.
A notification’s text never contains contact details: it states a trade, a date and a city.
Declining has no other consequence: you remain reachable by other means, and you can change your mind in your phone settings at any time.
12Messages
Messages are kept to allow the conversation and, following a report, to investigate the dispute.
They are read by no one other than the two parties, except following a report or a lawful request. They are used neither for statistics nor to train a model.
Deleting your account deletes the messages you sent.
13For how long
Data is kept for the life of the account, then erased.
- Account, profile, photo, trades, business: until the account is deleted.
- Availability: it expires on its own once the day has passed.
- Listings, applications, conversations and messages: until the account is deleted.
- Reports: kept after the reported person’s account is deleted, no longer identifying them — otherwise deleting an account would become a way to erase the reports received.
- Notification log and crash reports: ninety days.
- Accounting records tied to subscriptions: ten years, as required by article L123-22 of the French Commercial Code.
- An account with no sign-in for three years is deleted, after a warning sent one month beforehand.
14Your rights
You have the following rights, under articles 15 to 22 GDPR.
- Access: obtain a copy of the data concerning you.
- Rectification: correct what is inaccurate.
- Erasure: have your data deleted.
- Restriction: freeze a processing operation while a challenge is pending.
- Objection: object to processing based on our legitimate interest.
- Portability: receive your data in a machine-readable format.
- Withdrawal of consent: at any time, for notifications, without retroactive effect.
- Post-mortem instructions: decide what happens to your data after your death, under article 85 of the French Data Protection Act.
15How to exercise them
Two of them are exercised without writing to us, directly in the application, and that is deliberate: a right that requires a request is a right people do not exercise.
Rectification: the “Me” screen reopens everything you entered.
Erasure: the delete-account button at the bottom of that same screen immediately and permanently erases the account and everything attached to it. No request, no delay, no keeping anything “just in case”.
For the other rights, write to [email protected]. A reply is owed within one month, extendable by two months if the request is complex, in which case you are informed. Exercising these rights is free.
16Transfers outside the European Union
Some providers are established outside the European Union, notably in the United States.
Those transfers rely on the European Commission’s standard contractual clauses, or on the EU–US Data Privacy Framework for organisations certified under it.
A copy of the safeguards in place can be requested at the contact address.
17Security
Traffic to the servers is encrypted end to end in transit.
Access to data is partitioned at the database level itself: a query can only read what its author is entitled to see, regardless of what the application asks for. It is therefore the database that protects the data, not the application — and an application flaw does not open other people’s data.
Passwords are never stored in clear text. Photos sit in a private space, reachable only through signed addresses that expire.
Regular backups are taken and kept encrypted.
18No automated decisions
No decision producing legal effects or significantly affecting you is taken automatically, within the meaning of article 22 GDPR.
Targeting a listing is a filter — trade, area, availability — not an assessment: it ranks no one by merit and rejects no one on a judgement.
Suspending or closing an account is always decided by a person.
19Minors
Ralay is for adults only. Creating an account requires declaring that you are at least 18.
No account is knowingly opened for a minor. If such an account is reported to us, it is deleted and the data erased.
20Cookies and trackers
The mobile application uses no advertising cookie, no third-party analytics tracker, and no advertising identifier.
It keeps locally, on the device, only what it needs to work: the session token and your display preferences. These never leave the device and are cleared on sign-out.
No consent is therefore requested on this point, since there is nothing to consent to.
21In case of a data breach
A breach likely to result in a risk to your rights is notified to the CNIL within seventy-two hours, under article 33 GDPR.
Where the risk is high, the people concerned are informed directly and as soon as possible, with the nature of the breach, its likely consequences and the measures taken.
22Complaints
If our reply does not satisfy you, you may refer the matter to the French data protection authority.
CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07. A complaint can also be filed on its website.
23Changes
This policy may change. Any substantial change is announced in the application at least thirty days before it takes effect.
The version number and update date appear at the top of this document.
The French version prevails.