Privacy policy
This policy explains what data PokeScania processes and why.
Last updated: 8 August 2026 · Version 1.0
Controller
Despierres Titouan, a sole proprietor. SIRET: 895 005 759 00025. APE code: 6201Z. Address: 6 impasse de Kergras, 56250 Trédion, France. Phone: +33 7 81 51 49 58. Email: [email protected].
Data, purposes and retention
The scanner processes the submitted image to provide the requested identification. The normalised image is retained in the technical cache, with CACHED status and a configured one-hour expiry. Physical deletion is scheduled and retryable; a failure can delay removal of the object and no absolute duration is guaranteed.
If you explicitly and voluntarily choose to contribute, the same technical record is promoted to PENDING with a configured 90-day expiry. This period applies to the normalised image and technical row. It is not linked to your account or collection. An authorised administrator can accept or reject the contribution. On acceptance, the image and its key are deleted from S3; no user embedding is created and only the technical row moves to ACCEPTED. Dashboard rejection or deletion of an already ACCEPTED contribution is a no-op, and expiry purge may mark the technical row DELETED. When a contribution still under review is rejected, the image is deleted and the technical record moves to terminal DELETED status. Physical deletion is retryable; retention of terminal technical metadata is not defined here.
We do not promise total anonymity. Technical logs needed for security include the method, user-agent and full request target (path and query); the application does not log the remote IP address. Their retention depends on the applicable operational policy and is not defined on this page. This release has no self-service deletion token; contact support at the address below with the information you have.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Scanner and catalogue | Normalised scan image and technical parameters; the normalised image is cached | Contract or pre-contractual steps | CACHED status, configured expiry: 1 hour; physical deletion is scheduled and retryable |
| Optional contribution | The same technical record: normalised image, selected card ID, status and technical ID; no account or collection link | Explicit consent | The 90-day period applies to the normalised image and PENDING technical row; after acceptance the image and key are deleted and only the ACCEPTED technical row remains, with no user embedding; there is no self-service removal |
| Account and collection | Name, email, preferences, saved cards | Contract | While the account exists, then deletion or anonymisation |
| Contact form | Name, email address, subject and message content | Legitimate interest in replying to requests | According to Formspree retention and the time needed to handle the request |
| Audience measurement after opt-in | Consent state and Analytics data | Consent | According to provider configuration; Analytics cookies can last up to two years |
| Security | Necessary technical logs: method, user-agent and the full request target (path and query); the application does not log the remote IP address | Legitimate interest | According to the applicable operational policy; no period is defined here |
Confirmed providers
The providers used by the code are OVH SAS (hosting), Amazon S3 (AWS) (normalised scan image object storage), Keycloak (authentication), Google Analytics (audience measurement after opt-in), and Formspree (contact form message delivery). The Google Analytics tag loads only after your explicit analytics consent. It is not loaded and no analytics script, ping or data is sent to Google before opt-in. Audience measurement begins only after opt-in. No other provider, backup region, encryption mechanism or transfer is asserted here.
Your rights
You may exercise access, correction, erasure, restriction, objection and portability rights where applicable by contacting [email protected]. You may also complain to the French CNIL (cnil.fr).