Privacy Policy

Article 1 - Preamble

This Privacy Policy describes how GEMSTER collects, uses, stores and protects your personal data when you use the Gemster platform (the “Platform”), available at gemster.io, which allows you to track, organize and discover cultural works (movies, TV shows, video games, manga, comics and books).

It supplements the Terms of Use (https://gemster.io/cgu/) and the Legal Notice (https://gemster.io/mentions-legales/). By creating an account, you acknowledge that you have read this Policy.

Gemster undertakes to process your data in accordance with Regulation (EU) 2016/679 of April 27, 2016 (“GDPR”) and French law no. 78-17 of January 6, 1978 as amended (“French Data Protection Act”).

Article 2 - Data controller

The data controller is:

GEMSTER, Société par actions simplifiée (SAS)
SIREN: 102 386 059 - SIRET: 102 386 059 00012
Intra-community VAT: FR26102386059
Registered office: 68 Rue du Président Doumer, 33500 Libourne, France
Email: hello@gemster.io

Article 3 - Data collected

3.1 Account data

When you create and manage your account, we collect:

• Required data: email address, password (stored only in hashed form), username;
• Optional data: first name, last name, date of birth, profile picture;
• Settings: language, country, display theme, display and sorting preferences, profile visibility, types of media consumed.

3.2 Login through a third-party service

If you choose to sign up or log in through Google or Apple (“social login”), we receive from the relevant provider your technical identifier with that provider, your email address and, where applicable, your profile picture. We never access your password for those services. This authentication is operated through Firebase Authentication (Google).

3.3 Cultural activity data

The purpose of the Platform is to help you track your cultural life. For this reason, we collect the data you enter:

• works added to your library (movies, TV shows, video games, manga, comics, books) and followed works;
• your ratings, opinions and reviews;
• your progress (episodes watched, volumes read, game progress, play time, viewing or discovery dates);
• your custom lists;
• your saved searches;
• your answers during onboarding (types of media consumed, selected works);
• your recommendation preferences and exclusions.

This data powers your history, cultural statistics and our personalized recommendation algorithm (see Article 5).

3.4 Social data

As part of the Platform's social features, we process:

• your friends list, friend requests and nicknames you assign to friends;
• the “close contacts” you create to share works with people who do not yet have an account: nickname and, if you provide it, the person's email address;
• the invitations you send to those people by email.

When you provide data about a third party (nickname or email address of a close contact), you undertake to have informed that person and obtained their agreement. The invited person may request deletion of this data at any time by writing to hello@gemster.io.

3.5 Importing your history from third-party services

You may, on your own initiative, import your cultural history from third-party services:

• Letterboxd: through your username (reading your public feed) or through an exported CSV file that you upload;
• MyAnimeList: through your username (reading your public lists);
• Steam: through your Steam identifier (SteamID64 or custom URL), sent to Valve's official API to retrieve your games list and play time;
• Netflix: through the CSV file of your viewing history that you upload.

Uploaded CSV files are processed in memory during the import and are not retained: only recognized works and their progress are added to your library. Third-party account identifiers are used solely to perform the import you requested.

3.6 Notifications

If you enable push notifications, we store your device's technical token (Firebase Cloud Messaging token) in order to send them. You can disable notifications at any time in your account or device settings.

3.7 Subscription and payment

If you subscribe to a paid plan, we process your subscription plan, status and dates, as well as transaction history (amount, currency, date, status, transaction identifier assigned by the payment provider).

Payments are handled by specialized providers (Stripe, Apple, Google). Your banking data (card number, etc.) is collected and processed exclusively by these providers and never passes through our servers.

3.8 Technical and usage data

When you use the Platform, we collect:

• internal usage events (for example: adding a work, interacting with a recommendation) associated with your account, for statistics, service improvement and production of the aggregated and anonymized statistics described in Article 4;
• technical operating data and error logs (through Sentry, hosted in the European Union);
• aggregated and anonymized audience measurement data, without cookies (see Article 7 - Cookies and trackers);
• the date of your last visit.

3.9 Contractual acceptances

We keep the version of the Terms of Use and this Policy that you accepted, as well as the date of acceptance, for evidence purposes.

Article 4 - Purposes and legal bases

Gemster does not sell your personal data and does not use it for targeted advertising on behalf of third parties. Gemster may, however, produce and market aggregated and anonymized statistics on cultural consumption trends (for example: audience shares for a genre or franchise, consumption bridges between works or media). These statistics are calculated on sufficiently large user cohorts and contain no data that could identify you, directly or indirectly.

Article 5 - Personalized recommendations

Our recommendation algorithm analyzes your library, ratings and preferences in order to suggest works you may like. This personalization is inherent to the service and does not produce any legal effect concerning you or any automated decision within the meaning of Article 22 of the GDPR. You can exclude works from your recommendations at any time.

Article 6 - Recipients and processors

Your data is accessible only to authorized Gemster personnel and to its technical providers (processors within the meaning of the GDPR), strictly to the extent necessary for their duties:

In addition, when you use the import feature (Article 3.5), the account identifier you provide is sent to the relevant third-party service (Valve/Steam in particular) to retrieve your data. These services operate under their own privacy policies.

Your data may also be disclosed to competent authorities where required by law.

Article 7 - Cookies and trackers

The Platform uses no advertising cookies or third-party trackers.

• Strictly necessary trackers for the service to operate: your browser's local storage to maintain your authenticated session and preferences. They are exempt from consent;
• Cookie-free audience measurement: we use Umami, hosted in the European Union, to produce aggregated traffic statistics (pages viewed, referrer, device type). This tool neither stores nor reads any information on your device and does not collect any data that could identify you. It is therefore not subject to prior consent; this processing is based on our legitimate interest in measuring use of the Platform.

No consent banner is required because no tracker subject to consent is used. If we were to deploy such trackers, your consent would be collected beforehand.

Article 8 - Retention periods

Data retained after deletion of your account. To ensure service continuity for other users, your username and profile picture may remain visible to users with whom you had interacted: recommendations you had sent them, and mentions as a "close contact" for your former friends. These elements are no longer attached to any account, do not allow you to be identified beyond that username or contacted again, and you can request their full anonymization at any time by writing to hello@gemster.io. Billing data is also retained for 10 years in accordance with our accounting obligations (Article L123-22 of the French Commercial Code), including after account deletion.

Article 9 - Transfers outside the European Union

Your data is mainly hosted in France (OVH). Some providers listed in Article 6 (Google/Firebase, Postmark) may process data in the United States. These transfers are governed by appropriate safeguards within the meaning of the GDPR: European Commission adequacy decision (EU-U.S. Data Privacy Framework) and/or standard contractual clauses. You may obtain a copy of these safeguards by writing to hello@gemster.io.

Article 10 - Security

Gemster implements appropriate technical and organizational measures to protect your data, including: encrypted communications (HTTPS/TLS), password hashing (your password is never stored in clear text), authentication through time-limited tokens, access partitioning and error monitoring.

In the event of a data breach likely to result in a high risk to your rights and freedoms, you will be informed in accordance with Article 34 of the GDPR.

Article 11 - Minors

The Platform is accessible from the age of 13. In accordance with the Terms of Use, users under 16 must obtain prior authorization from their legal representative, who consents to the processing of their data described in this Policy. If you hold parental authority and believe that a minor is using the Platform without authorization, contact us at hello@gemster.io: the account and associated data will be deleted.

Article 12 - Your rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights over your data:

• Right of access: obtain a copy of the data concerning you;
• Right to rectification: correct inaccurate or incomplete data;
• Right to erasure: request deletion of your data, including through account deletion from your settings;
• Right to portability: receive the data you provided to us in a structured, machine-readable format;
• Right to object: object to processing based on our legitimate interest;
• Right to restriction of processing in the cases provided for by Article 18 of the GDPR;
• Right to withdraw your consent at any time for processing based on it (notifications), without affecting the lawfulness of prior processing;
• Right to define instructions regarding the fate of your data after your death.

You can exercise these rights directly from your account settings or by writing to hello@gemster.io. We will respond within one month, extendable by two months in the case of a complex request. Proof of identity may be requested if there is reasonable doubt about the requester's identity.

If you believe that your rights are not being respected, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL): 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 - www.cnil.fr.

Article 13 - Changes to this Policy

Gemster may update this Policy, particularly in the event of changes to features or regulations. Each version is identified by a number and date. In the event of a substantial change, you will be informed on the Platform and acceptance of the new version may be requested at your next login. The current version is permanently available on this page.

Article 14 - Contact

For any question about this Policy or the processing of your personal data:

GEMSTER - 68 Rue du Président Doumer, 33500 Libourne, France
Email: hello@gemster.io