Privacy Policy

Version: 1.0

These Terms of Use were most recently updated on February 11th, 2026.

Definitions

Capitalized terms used in this Privacy Policy have the meaning given to them in the Terms of Use of the Shortcat application, or as defined below:

Personal Data: means any information relating to an identified or identifiable natural person (the “Data Subject”). A natural person is considered identifiable where they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

Processing: means any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Controller: means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing.

Processor: means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller.

Flagcat: means Flagcat SAS, a société par actions simplifiée incorporated under the laws of France, having its registered office at 140 Avenue Marguerite Renaudin, 92140 Clamart, France, registered under number 977 626 811 RCS Nanterre.

Flagcat is the Controller for the Personal Data processed in connection with the use of the Shortcat application.

Purpose

The Shortcat mobile application (the “Application”) is operated by Flagcat.

This Privacy Policy explains the purposes for which your Personal Data may be collected and processed when you use the Application, such as providing the service, improving functionalities, ensuring security, and complying with legal obligations. Detailed information on each purpose is provided in Section 3 below.

This Privacy Policy may be updated in order to remain compliant with applicable law. The version applicable to you is the version available in the Application at the time you use the Service.

Personal Data Processed, Purposes and Retention Periods

Personal Data is collected for specified, explicit and legitimate purposes.

Flagcat ensures that Personal Data is processed in an adequate, relevant and limited manner, to what is necessary for the purposes for which it is processed:

Processing	Categories of Personal Data	Purposes	Legal Basis	Retention Period
Access to the Service via Device Identifier	Device-based technical identifier (Device Identifier), app technical data necessary for operation	Provide access to the Service without requiring account creation; ensure continuity of access on the same device; security and fraud prevention	Performance of the contract (Art. 6(1)(b) GDPR); Legitimate interest for security (Art. 6(1)(f) GDPR)	For the duration of use on the device; deleted/rotated according to technical constraints and as necessary
User Account management (if an account is created)	Username, email address, password (stored in hashed form), account identifier	Create and manage the account; authenticate users; enable access across devices; manage security	Performance of the contract (Art. 6(1)(b))	Until account deletion, then deletion or anonymization unless legal obligations require longer retention
Purchases (Virtual Currency) and Subscriptions via Stores	Store account technical identifiers (where applicable), purchase confirmation/status, transaction identifiers provided by the Store, subscription status, Virtual Currency balance (wallet)	Enable access to paid features; credit Virtual Currency; manage subscription entitlement; prevent fraud; customer support	Performance of the contract (Art. 6(1)(b)); Legitimate interest for fraud prevention (Art. 6(1)(f))	Contractual relationship duration; transaction references retained as required for accounting and dispute handling (up to 5 years where applicable)
Customer support	Email address, content of messages, information you choose to provide, technical logs strictly necessary to investigate	Respond to requests; handle incidents and complaints; improve support	Legitimate interest to respond (Art. 6(1)(f)) and/or performance of the contract (Art. 6(1)(b))	For the time necessary to process the request; then archived for a limited period for evidence/dispute management
Promotional communications	Email address, communication preferences (opt-in/opt-out)	Send newsletters/offers and other promotional messages, in accordance with your expressed preferences	Consent (Art. 6(1)(a))	Until you unsubscribe/withdraw consent
Security and integrity of the Service	Technical logs (e.g., security events), device/app technical information strictly necessary	Detect and prevent fraud, abuse, or security incidents; ensure integrity of the Service	Legitimate interest (Art. 6(1)(f))	For a limited period proportionate to the purpose, then deleted or anonymized

Important clarification on payments: Payments are processed by the Stores. Flagcat does not receive your full payment card details. Flagcat only receives the technical information necessary to confirm purchase/subscription status and grant access (e.g., transaction/status identifiers).

Recipients of Personal Data

Personal Data may be communicated, strictly on a need-to-know basis and only for the purposes listed above, to:

• Flagcat’s authorized staff, whose access is documented and limited to their respective missions;
• Flagcat’s service providers and Processors (e.g., hosting/infrastructure, technical maintenance), who are contractually bound to confidentiality and security obligations;
• the Stores (Apple / Google) for in-app purchases and subscriptions (under their own terms and policies), with clear identification of the data shared;
• public authorities where required by law, with communication limited to the strictly necessary information.

Where Personal Data is processed by Processors, Flagcat ensures that such Processors provide appropriate guarantees and process Personal Data only on documented instructions from Flagcat.

All accesses to Personal Data are subject to traceability measures and the categories of recipients are clearly identified in the privacy policy.

Where service providers are located outside the European Union, transfers are carried out in compliance with GDPR safeguards, including:

• European Commission adequacy decisions, or
• Standard Contractual Clauses under Article 46 GDPR.

Your Rights

In accordance with applicable data protection regulations, you have the following rights:

5.1 Right of access, rectification and erasure. You may request access to your Personal Data, have it corrected, or request deletion.

5.2 Right to data portability. You may request the portability of your Personal Data, where applicable under GDPR conditions.

5.3 Right to restriction and objection. You may request restriction of Processing or object to Processing based on legitimate interest, unless Flagcat demonstrates compelling legitimate grounds.

5.4 Exercising your rights. You may exercise your rights by contacting: operations@flagcat.studio. In case of reasonable doubt, Flagcat may request proof of identity. Flagcat will respond within the time limits required by applicable law.

If you consider, after contacting Flagcat, that your rights are not respected, you may lodge a complaint with the competent supervisory authority. In France, the competent authority is the CNIL (Commission Nationale de l’Informatique et des Libertés).

Cookies and Trackers

The Application may use technical identifiers and similar technologies necessary for the operation and security of the Service.

6.1 What is a “cookie” / tracker? A cookie or tracker is a small piece of information stored on your device, or an equivalent technology used in mobile environments, which may be used to ensure proper functioning, security, or (where applicable) measurement of usage.

6.2 What trackers are used? Shortcat is designed to be “data-light”. The following categories of trackers may be used:

Strictly necessary trackers

These are required for the Application to function properly and securely (e.g., session integrity, security, basic technical operations). These trackers do not require consent where permitted by applicable law.

Analytics / audience measurement trackers

If the Application uses analytics tools, they will be implemented in compliance with applicable consent requirements. You will be informed and able to manage your preferences where required.

6.3 How to manage trackers? Depending on the type of tracker, you may manage permissions and tracking preferences via your device settings.

For non-essential trackers, you will be asked for your consent before any information is stored or read on your device. You may withdraw your consent at any time using the same settings.

7. Questions and Contact

For all questions regarding this Privacy Policy, you may contact Flagcat at: operations@flagcat.studio.