MyConcierge — Privacy Policy

1. Who we are

MyConcierge is operated by Youngtimers Payments SAS, a French simplified joint-stock company with a share capital of €1,000, registered with the Montpellier Trade and Companies Register under number 910 341 320, with its registered office at 623 Rue du Devois, 34160 Saint-Drézéry, France ("we", "us"). We are the controller of the personal data described in this policy. Contact for any privacy question or request: support-concierge@shatale.com.

2. What we collect

• Account data: your email address and a password. We store the password only as a one-way hash.
• Conversations: what you write to MyConcierge and its replies, the web pages and search results it looked at for your requests, and a log of the steps it took for you (which tool it used, the outcome, the time and the purchase it concerned; never card details).
• Memory: preferences you choose to let MyConcierge remember (for example, a favourite shop or a delivery note). You can see, edit and delete each item on the Memory page.
• Repeat purchases: when you save a completed purchase to repeat it, we keep the shop, the item, the size or variant you chose, which of your saved addresses to use, and the price you paid, which becomes the most a repeat can cost. You can see and delete each one on the Memory page.
• Purchases: what MyConcierge bought or tried to buy for you — the merchant, item, amount and status.
• Price watches: the items you asked MyConcierge to watch, your target price, the end date, any price it found, and whether you allowed it to buy by itself, with the moment you did.
• Bookings: if you book a flight, the passenger details you give are passed to the booking provider to issue the ticket; we do not keep them anywhere other than in the conversation itself.
• Calendar (optional): if you connect Google Calendar, a token that lets MyConcierge add events (a refresh token). We store it encrypted and you can disconnect at any time.
• Usage data: how much AI processing your requests used, so we can apply your monthly allowance.
• Technical data: a session cookie that keeps you signed in, and the data your device sends with every request (such as IP address) in our server logs.
• Push notification token: if you turn notifications on, the token your phone gives us so that we can send them.

We never ask for or store your own bank card. For a purchase you have approved, our payment provider issues a virtual card for that purchase; our servers use its details only for the moment needed to enter them on the merchant's checkout page, and do not store them.

3. Why we use it and our legal basis

• To provide the service you asked for — understanding your requests, searching stores, comparing offers, placing the purchases you approve, remembering your preferences, applying your allowance. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• To keep the service secure and prevent abuse — session management, fraud and misuse prevention, logs. Legal basis: our legitimate interest in a safe service (Art. 6(1)(f)).
• To meet legal obligations — keeping purchase records as required by French commercial and tax law. Legal basis: legal obligation (Art. 6(1)(c)).
• Google Calendar — only if you connect it. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw by disconnecting.

Account, conversation, usage and purchase data are needed to provide the service; without them MyConcierge cannot work. Memory and Calendar are optional; if you do not use them, only those features are unavailable.

MyConcierge prepares purchases automatically, but it buys only within the spending limits you set, and asks for your approval above them, so we take no decision with legal or similarly significant effects about you by automated means alone.

We do not sell your data, we do not use it for advertising, and we use no analytics or advertising trackers.

4. Who receives it

We share only what each recipient needs to do its job:

• AI model providers (Anthropic and OpenAI) process your conversations to generate MyConcierge's replies. They act as our processors and, under their business terms, do not use this data to train their models.
• Our payment provider, Shatale SASU (France), processes your purchases: it receives your email and purchase details so that you can approve each purchase in the Shatale app or website and so that the purchase can be paid. Shatale handles that part under its own privacy notice, which it shows you when you connect your payment card.
• Search and shopping services (such as web search, store and marketplace APIs, flight booking) receive the search terms and order details needed to find and buy what you asked for.
• Google, only if you connect your calendar.
• Our hosting provider, Railway Corporation (United States), which runs our servers and databases.
• Authorities, where the law requires it.

5. Transfers outside the EU

Some providers, including the AI model providers, are based in the United States. Where data leaves the European Economic Area, we rely on an adequacy decision, including the EU–US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of these safeguards at support-concierge@shatale.com.

6. How long we keep it

• Conversations: deleted automatically after 90 days without activity, or earlier when you delete your account.
• Log of the steps MyConcierge took: 90 days, or earlier when you delete your account.
• Memory: until you delete the item or your account.
• Repeat purchases: until you delete the item, use Forget everything, or delete your account.
• My billers: the websites you confirmed as the places where you pay your bills, until you use Forget everything or delete your account.
• Price watches: while a watch is active. Once you stop it, or it ends (the item is found, it expires or it runs out of attempts), it is deleted 30 days after you set it up, or earlier when you delete your account.
• Account data: until you delete your account.
• Purchase records: 10 years, as required by French commercial and tax law, even after you delete your account.
• Receipt emails linked to a purchase (sender and subject only): until you delete your account.
• Bookings: until you delete your account.
• Usage data (what the AI model cost for you, your monthly free model allowance and changes to it): until you delete your account.
• Sign-in sessions: until they expire, you sign out or you delete your account.
• Push notification token: while you are signed in on that device. It is deleted when you sign out, when you turn notifications off, or when you delete your account.
• Screenshots of a shop page, kept when a purchase gets stuck: 24 hours.
• Calendar token: until you disconnect it or delete your account.

7. Your rights

You can access, correct, delete or export your data, object to processing based on legitimate interest, restrict processing, and withdraw consent at any time. In the app you can:

• export all your data — account, Memory, repeat purchases, My billers, price watches, conversations, the log of the steps MyConcierge took, purchases, bookings, calendar connection, usage data and your current sign-ins (when each started and when it will end);
• view, edit and delete your Memory;
• delete your account in the app or at https://concierge.yt-pay.io/delete-account. This deletes your sessions, conversations, the log of the steps MyConcierge took, Memory, repeat purchases, My billers, price watches, bookings, calendar connection and usage data, and replaces your email and password with values that cannot be traced back to you. We keep only an internal account number and the purchase records the law requires.

Your export lists the devices you have notifications on and when each was added. It does not include the token itself, the same way it does not include card numbers. For anything else, contact us at support-concierge@shatale.com. You can also complain to the French data protection authority, the CNIL (www.cnil.fr).

8. Cookies

We use only the cookies strictly necessary to keep you signed in. They do not track you and do not need your consent.

9. Children

MyConcierge is for adults. You must be at least 18 years old to use it.

10. Changes

If we change this policy in a way that matters, we will tell you in the app before the change takes effect.