Privacy policy

Last updated: 15 August 2026. ALENOIR is the sole data controller. Our Legend is the service name and Jolatefri its publishing label; they are not separate data controllers.

To exercise access, correction, erasure, restriction, objection or portability rights, write to hello@whatsrap.fr.

Who this policy concerns

This policy covers visitors and account holders, as well as group members whose names, messages, memories or images appear in content submitted by a user. Some data therefore relates to people who do not themselves use Our Legend.

Data, purposes and retention

• Account: email address and name, used to authenticate the user and restore their groups and creations; kept until the account is deleted.
• Raw WhatsApp export: temporarily held in private browser storage, then transmitted over an encrypted connection for the requested analysis; it is not stored in the account and browser copies are deleted as soon as the structured dossier is saved.
• Group dossier and members: personalities, relationships, phrases and memories structured from the export; kept until the group or account is deleted.
• Optional reference photos: up to four images per member, together with the uploader’s rights-confirmation date; they serve as private avatars. Only photos subsequently selected and confirmed for a poster are sent to Microsoft Azure for that generation. References are kept until removed or until the member, group or account is deleted.
• Creations: songs, lyrics, covers, audio files, speeches, posters, quizzes and editorial collections (awards, dictionary, bingo, characters, timeline, newspaper, predictions and quote cards), plus the settings required to generate them; kept until the creation, group or account is deleted.
• Shared quiz participation: chosen contestant name, random identifier stored in the browser and best score, used to display the leaderboard and replace the best attempt from the same browser; kept until the quiz, group or account is deleted. The name and score are visible to anyone who has the quiz’s unlisted link.
• Payment: processed by Stripe; the operator does not receive full card details. Records subject to a statutory duty are kept for the period required by law.
• Technical measurement: pseudonymous session and request identifiers, locale, funnel stage, volumes, duration, estimated cost and sanitized error codes, without conversation content in Convex telemetry.

Legal bases

For the account holder, processing required for the account, requested analysis and creations is based on delivering the service. Data about other group members is received indirectly; processing it to produce a private creation based on shared history relies on legitimate interests, subject to those individuals’ rights and freedoms, including their right to object. The user must inform the people concerned before importing and provide them with this policy. Security, abuse prevention and technical measurement rely on the legitimate interest of operating and protecting the service. Billing records subject to retention are processed to meet a legal obligation. Photos are optional: the uploader must confirm they hold the necessary permissions, inform the people shown and remove a photo on request.

Recipients and providers

To the extent required for the requested service, data is processed by Convex (database, authentication and files), Microsoft Azure (text or image analysis and generation), ElevenLabs (music generation), Stripe (payments), and Vercel (hosting and technical audience measurement). ElevenLabs receives musical instructions and lyrics, but neither the raw WhatsApp export nor reference photos. For a poster, Microsoft Azure receives the compact dossier needed for visual direction and only the photos specifically selected by the user after confirmation.

Some providers may process data outside the European Economic Area depending on the service and configuration used. Such processing must then be covered by the safeguards required under applicable law and the agreements entered into with those providers.

Artificial intelligence and training

The operator does not use conversations, dossiers, photos or creations to train its own model. Provider retention and use commitments depend on the applicable contracts and account settings; this policy therefore does not promise zero retention by every provider.

Shared links

A song, speech, poster, quiz or editorial collection may be made available through an unlisted link. Anyone who has that link can view or play the creation: it is not password-protected access. For a quiz, the chosen contestant name and best score also appear on that link. Deleting the creation or group disables the link and removes its leaderboard from Our Legend, but cannot erase copies already downloaded or forwarded.

Content controls and individual rights

The account holder can remove a photo or delete a creation, group or account from the service. Anyone mentioned in a dossier or shown in a photo can also request access, correction or deletion of their personal data by contacting us. Proof of identity may be requested only where needed to prevent disclosure to someone else.

Complaint

You may contact the French data protection authority (CNIL) if, after contacting us, you believe your rights have not been respected.