Privacy Policy

Data we collect

Caregiver account: name and email provided through Clerk (email/password, Google, Microsoft, or Sign in with Apple).

User profile: first name entered by the caregiver.

Content: categories, pictograms, phrases, photos, and voice recordings added by the caregiver.

Activity: pictogram selection history, questions (?), orders (!), and yes/no answers for the caregiver usage feed.

Technical data: session tokens, operational logs, and, in production when monitoring is enabled, crash/performance diagnostics via Sentry (no advertising).

Billing (if you subscribe): email, customer/subscription identifiers, and subscription status. PicPaul does not store card numbers.

Text-to-speech: on some Android devices, the system TTS engine may send spoken phrases to a manufacturer network service.

Purposes

Provide caregiver authentication, the AAC communicator, catalog sync, vocabulary personalization, and support.

Manage professional subscriptions (groups, content and activity access) when you choose a paid plan.

Maintain security, reliability, and production incident diagnostics.

No ads are shown. No sale of personal data. No advertising tracking.

Legal bases (working labels)

Contract performance (GDPR Art. 6(1)(b)): caregiver account creation and management, providing the AAC service, catalog sync, and service-related support.

Legitimate interest (GDPR Art. 6(1)(f)): service security, abuse prevention, operational logs, and stability diagnostics (Sentry when enabled), where necessary and proportionate.

Legal obligation (GDPR Art. 6(1)(c)): retaining billing / accounting records when applicable law requires it.

Consent (GDPR Art. 6(1)(a)): only where required (e.g. optional on-device features such as the microphone). PicPaul does not enable third-party audience measurement without consent.

Processors and services

Clerk: caregiver authentication.

Convex: database, file storage, subscription entitlements, and hosting of public legal pages.

Stripe: subscription payments (card and invoicing). Payment data is processed by Stripe; PicPaul keeps only subscription and entitlement references.

ARASAAC: public pictogram search and images, under a Creative Commons BY-NC-SA license. PicPaul does not sell these images.

The pictographic symbols used are the property of the Government of Aragon and were created by Sergio Palao for ARASAAC (https://arasaac.org), which distributes them under a Creative Commons BY-NC-SA license.

Vercel: web portal hosting (pages, deployment) and, only after consent, Vercel Analytics audience measurement.

Sentry: crash and performance logging in production when configured.

System text-to-speech services (device-dependent).

On-device local storage

PicPaul keeps an offline cache of the catalog, media, and a pending activity event queue (selections, questions, orders, yes/no) so the communicator works without network.

When account deletion succeeds, this local cache is cleared. Uninstalling the app also removes remaining local data.

Subscriptions and payments

Paid plans are managed through the PicPaul web portal and Stripe Checkout / Customer Portal. Prices are VAT-inclusive EUR.

Family plan: free, unlimited pictograms (ARASAAC and personal photos). PicPaul does not charge for access to ARASAAC pictograms.

Professional plans: Ortho / logo (speech-language therapist practice — orthophoniste in France, logopède in Belgium) and Team. Institutions (IME, SESSAD, MDPH in France; PMS centres, AVIQ / PHARE in Belgium, etc.) may request a yearly quote / invoice via the portal.

Stripe processes payments. PicPaul stores subscription status for the account, without keeping card details.

Retention (by category)

Account and authentication (Clerk): while the caregiver account exists; after deletion, erasure is requested subject to processors’ technical timelines.

User profile, content (categories, pictograms, media), and activity: while the account exists; erased with account deletion.

Billing / subscription (Stripe references held by PicPaul): while the account exists, then retention of records required for applicable accounting/tax periods.

Operational logs and Sentry diagnostics (when enabled): short retention limited to security and diagnostics needs.

On-device local cache: until successful account deletion or app uninstall.

Deletion

You can delete the account and associated data from the app (Settings → Delete account), from the signed-in web portal (Access → Delete), or by email (see the account deletion page).

After deletion, Clerk, Convex, and related Stripe subscriptions are asked to erase or cancel the account and data, subject to any legal retention duties.

Your rights

Under the GDPR you may request: access, rectification, erasure, restriction, objection, and portability where applicable, and withdraw consent for consent-based processing.

How to exercise: from the app (settings / deletion), from the portal (Access), or by emailing the contact address below from the address linked to the account.

You may also lodge a complaint with the competent supervisory authority (e.g. the Belgian APD or the French CNIL).

Transfers outside the EEA

Some processors (including Clerk, Convex, Stripe, Vercel, Sentry) may process data from countries outside the European Economic Area, including the United States.

Where transfers outside the EEA occur, they rely on appropriate safeguards put in place by those providers (e.g. standard contractual clauses / recognized transfer frameworks), in addition to technical measures (HTTPS, access controls).

Audience measurement (Analytics)

Classification: Vercel Web Analytics–style audience measurement is non-essential processing (usage measurement), distinct from authentication, billing, and AAC operation. Legal basis: consent (GDPR Art. 6(1)(a)).

Current state: the web portal shows a consent banner. The Vercel Analytics script loads only after Accept. A refusal (or no choice) sends no audience measurement. You can change your choice via the “Audience measurement” footer link.

Data involved (if you accept): anonymized page views (URL without query parameters), referrer, aggregated country/device/browser. No advertising cookie and no advertising identifier.

Audience

PicPaul is for anyone who needs augmentative and alternative communication (AAC), including children and adults. The caregiver owns the account; the user uses the communicator, optionally under supervision.

The app does not provide a public social space or sharing between distinct accounts.

Caregiver-space access in v1 is unlocked with an in-app gear control on the client; it is not a server-side gate. Data remains scoped to the authenticated account.

Security

Traffic to our services uses HTTPS.

Clerk session tokens are stored in the device secure store when available.

Device permissions

Microphone: only to record optional pictogram phrases.

Photo library: only to choose optional category or pictogram images.

The camera is not used.