KEEP by Lovebox – Privacy Policy

Last updated: November 3, 2026

This Privacy Policy explains how LOVEBOX GROUP ("Lovebox", "we", "us") collects, uses and protects personal data when you use the KEEP by Lovebox mobile app for Android and iOS (the "App") and the KEEP connected keychain. LOVEBOX GROUP is a French simplified joint stock company (SAS), 60 rue François 1er, 75008 Paris, France. We are the data controller for the data described below.

Questions or requests: contact@lovebox.love.

1. Data we collect

• Account data: your email address, your name or nickname, and your password (stored only in hashed form), when you create an account.
• Messages and their content: the notes you write or draw in the App to send to a KEEP: text, drawings, emoji and stickers, and photos you choose to include, together with the date they were sent and whether they have been shown on the KEEP.
• KEEP and relationship data: the identifier of each KEEP you pair (read over NFC), its name, its screen type, and who can send notes to it.
• Photos and camera: if you allow camera access, or pick a photo from your library, to make a photo note or a sticker. Photos are processed on your phone (cropping, cutting out people or objects, conversion to the KEEP's greys). Only the result you choose to send, or to keep as a sticker, leaves your phone.
• Notifications: a push notification token, if you allow notifications, and your reminder preferences (for example, the time you chose for writing reminders).
• Usage data: events about how the App is used (for example, that a note or a group message was sent, and how many people it reached), linked to your account, to understand and improve the App.
• Technical data: app version, device model and operating system, and error and connection logs needed to make the App and the KEEP work. Detailed sync logs leave your phone only if you choose to share them with our support.

We do not collect your location, your contacts, or advertising identifiers, and we do not use your data for advertising.

2. How we use your data

• To provide the service: create and secure your account, deliver your notes to the KEEPs you send to, show them in the App, and write them to a KEEP over NFC when its owner taps it (legal basis: performance of our contract with you).
• To send the notifications you asked for, such as a new note or a writing reminder (legal basis: your consent, which you can withdraw in your phone's settings or in the App).
• To measure how the App is used and improve it, and to send you service emails (such as password reset) (legal basis: our legitimate interest in improving the service).
• To keep the App reliable and secure, fix bugs and answer support requests (legal basis: our legitimate interest in running a working, safe service).
• To comply with our legal obligations.

3. Sharing

We do not sell your personal data. A note is shown to the people who own or can see the KEEP it is sent to. We share data only with service providers that process it on our behalf and under our instructions:

• cloud hosting and storage of our servers, databases and images (Heroku, MongoDB Atlas, Redis Cloud, Amazon Web Services);
• Mixpanel, for product analytics;
• Brevo, for service emails;
• Google Firebase, for push notifications and app configuration;
• Shopify, if you buy a KEEP in our online store (covered by our store's privacy policy).

We may also disclose data when required by law or to protect the rights and safety of our users.

4. International transfers

Some providers process data outside the European Union, including in the United States. These transfers rely on safeguards recognised by the GDPR, such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

5. Retention

We keep your account data and your notes for as long as your account exists. When you delete your account, your account, the notes you sent and their images are deleted from our systems, and you are removed from every KEEP you were paired to. Copies in backups are removed as those backups expire. Technical logs are kept only as long as needed to run and secure the service.

6. Deleting your account and data

You can delete your account at any time in the App: open your profile menu and tap Delete account. You can also ask us by email at contact@lovebox.love; we will delete your account and its data within 30 days.

7. Security

Data is sent between the App and our servers over encrypted connections (HTTPS). Passwords are stored hashed. Access to our systems is limited to the people who need it to run the service.

8. Your rights

Under the GDPR and similar laws, you can ask to access, correct, delete or export your data, object to or restrict its processing, and withdraw your consent at any time. Write to contact@lovebox.love. You can also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or the authority where you live.

9. Children

The App is not directed to children under 13 (under 15 in France), and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.

10. Changes

We may update this policy. We will post the new version on this page with its date, and tell you in the App or by email if the changes are significant.

11. Contact

LOVEBOX GROUP, 60 rue François 1er, 75008 Paris, France. Email: contact@lovebox.love.