Privacy & cookies

1. Who is responsible

The data controller is DEVFI, SASU, a simplified single-shareholder company under French law, 60 rue François Ier, 75008 Paris, France, registered in Paris under number 987 710 027(“EarlyWave”, “we”). For anything about your personal data, write to contact@earlywave.ai. This policy covers earlywave.ai, the EarlyWave web application and the EarlyWave applications for Android and iOS (together, “the Service”).

2. What we collect

Account. Your email address, your name if your sign-in provider gives it, the sign-in method (Google account or email code), your language and preferences, the date you joined.
What you add. The feeds and sources you follow, the topics and routines you create, your questions and the conversation that answers them, notes, highlights and saved items, the pages you send to EarlyWave.
Your newsletter address. Emails received on your @earlywave.email address are stored and read for you like any other source. Do not use it for private correspondence.
Plan and payments. Your plan, your usage meter and boosts, invoices, and the payment status Stripe (web) or Apple and Google (apps) report to us. We never see or store card numbers.
How you use the Service. Pages and screens opened, actions taken (an article read, a question asked, a source added), the answers’ own logs (which sources were read, which models ran), errors, and technical data: IP address, browser or device model and OS version, app version, approximate country. On the web this comes from our own first-party measurement and from Google Analytics (see section 5).
Support. What you send us when you contact us, including through the team form.

3. Why, and on what basis

To run the Service you asked for: account, sources, answers, routines, newsletter address, plan and payments — performance of the contract.
To understand and improve it: which features are used, where they fail, how fast they are — our legitimate interest, and your consent for the analytics cookies described in section 5.
To keep it safe and fair: abuse and fraud prevention, rate and fair-use limits, security logs — legitimate interest.
To write to you: service emails about your plan, routines and changes to these documents — contract; product news only if you opted in — consent, withdrawable in every email.
To meet our obligations: invoices, accounting, requests from authorities — legal obligation.

We do not sell personal data and we do not show advertising.

4. AI processing

Summaries, translations, trends and answers are produced by artificial-intelligence models. To do so, the relevant text (an article, a question, the sources selected for an answer, the emails on your newsletter address) is sent to model providers acting as our processors, today OpenAI, Anthropic and Google, and to web-search providers when an answer needs the web. They process it under their business terms, which exclude using our data to train their models, and delete it after the request or after a short abuse-monitoring period. The models you can pick are listed in the app. Automated processing here produces information for you to read; it makes no decision with legal or similar effect about you.

5. Cookies and analytics

Necessary cookies and storage keep you signed in, remember your preferences (language, layout, a folded film) and protect the forms. They need no consent.
Analytics. We use Google Analytics and our own first-party measurement to understand how the Service is used and to improve it: pages and screens, actions, performance, approximate location, device. IP addresses are truncated where the tool allows it. By creating an account you accept these analytics cookies and this measurement. You can withdraw at any time: block cookies in your browser, use Google’s opt-out add-on (tools.google.com/dlpage/gaoptout), or write to us and we will stop measuring your account.
We do not use advertising cookies or cross-site tracking.

Only the processors we need to run the Service, bound by contract to our instructions:

OVHcloud (OVH SAS) — hosting and databases, France (European Union);
Stripe — payments and invoices on the web;
Apple and Google — subscriptions bought in the apps, app distribution;
Google — sign-in with a Google account, and Google Analytics;
Resend — sending our emails;
OpenAI, Anthropic, Google and the web-search providers named in the app — the AI processing of section 4.

We may also disclose data when the law requires it, to protect our rights or users, or as part of a company transaction, in which case this policy continues to apply. Team accounts: the members of your team see what you share with the team.

7. Where data is kept

Your data is stored on servers in France, in the European Union, at OVHcloud (OVH SAS). Some processors above are in the United States; when data leaves the European Union we rely on the European Commission’s standard contractual clauses or on the EU-US Data Privacy Framework for certified providers.

We may move all or part of our infrastructure to another location in the European Union, or to a cloud provider in the United States or elsewhere, when the Service requires it. If we do, we keep the safeguards above, update this policy before the move, and tell account holders by email or in the app.

8. How long we keep it

Account and content: for as long as your account exists, then deleted or anonymised within 30 days of deletion, except what follows.
Invoices and payment records: 10 years, as French accounting law requires.
Technical and security logs: up to 12 months.
Analytics: up to 14 months in Google Analytics; aggregated statistics with no personal data may be kept longer.
Support requests: 3 years after the last exchange.

9. Your rights

You can access your data, correct it, have it deleted, restrict or object to its processing, receive a copy in a portable format, and withdraw a consent at any time without affecting what was done before.

Delete your account from Settings in the EarlyWave app, or write to us from the address of the account. Deletion revokes your plan, removes your sources, conversations, notes and newsletter emails, and anonymises the account; the records of section 8 that the law requires us to keep survive it.
Everything else: write to contact@earlywave.ai. We answer within one month, extendable by two months for complex requests, and may ask you to confirm your identity.
You may lodge a complaint with the French supervisory authority, the CNIL (cnil.fr), or with the authority of your country of residence.

10. The mobile apps

The EarlyWave apps for Android and iOS collect the same data as the web app, plus the device model, OS version and app version we need for support and crash diagnosis, and the notification token if you turn notifications on. Subscriptions bought in the apps are billed by Apple or Google, who process your payment data under their own privacy policies; we receive only the status of the subscription. You can delete your account from the app’s Settings; you can cancel a subscription in your App Store or Google Play account. The apps do not access your contacts, photos or location.

11. Security

Data is encrypted in transit, stored in the European Union, backed up, and reachable only by the people and services that need it, under access controls and logging. Payments are handled by certified providers. No system is perfectly secure; if a breach affects your data, we tell you and the authorities as the law requires.

12. Children

The Service is not meant for children under 16. We do not knowingly collect their data; if you believe a child gave us data, write to us and we will delete it.

13. Changes and contact

We update this policy when the Service or the law changes; the date at the top is the current version. Material changes are announced by email or in the app before they apply. Questions and requests: contact@earlywave.ai, or by post to DEVFI, 60 rue François Ier, 75008 Paris, France. Related pages: Legal notice, Terms of service.