Privacy Policy

This policy explains how PUYXEL processes personal data required for the website, the Huntrexia application, hunter accounts and hunting society workspaces.

Who is responsible for the data?

PUYXEL is the controller for the Huntrexia account, authentication, security, support, personal area and billing. For member lists, roles, events, attendance, documents and harvest records managed in a hunting society workspace, that society determines the purposes and acts as controller; PUYXEL then acts as technical processor. A harvest shared from the personal area creates a copy limited to the information required by the society; private notes, routes and memories are not shared by default.

Data processed

Depending on the features used: identity and contact details, date of birth, language, account and authentication data, memberships and roles, permits and documents, events and attendance, harvests, outings, species, dates and times, one-off GPS positions or routes, altitude, photographs, written or voice notes, dog information, notification preferences, support messages, consent records, payment and billing data, technical logs, IP address, device and security data.

Purposes and legal bases

Data is used to create and secure accounts, provide requested functions, manage societies and members, record hunting activities, synchronise offline actions, send useful notifications, process subscriptions, provide support, prevent abuse and comply with legal duties. The main legal bases are contract performance, legitimate interests in security and improvement, legal obligations and, where required, separate consent for marketing, optional trackers or optional uses.

Geolocation, photographs and microphone

A GPS point is collected only after an explicit action. Continuous tracking requires the user to start an outing voluntarily, grant the operating-system permission and see a visible indicator; it may continue with the screen off only when authorised. Routes are private by default. Photographs and audio recordings are collected only at the user's request. Device permissions can be withdrawn at any time, although the related features may stop working.

Minor users

Minors may be recorded as members. Where required by law or by the function, especially for an independent account, consent-based processing or intrusive use such as continuous tracking, Huntrexia requests validation from the legal representative and applies protective defaults. Information intended for minors is presented in suitable language.

Recipients and providers

Data is accessible only to authorised PUYXEL staff, the user, authorised society managers and essential providers depending on enabled features: OVHcloud for hosting, Brevo for transactional email or SMS when enabled, Google Firebase for push notifications, Google and Meta for social sign-in, self-hosted ALTCHA for anti-bot protection, IGN/Geoplatform and OpenStreetMap/Nominatim for addresses, and the payment provider shown at checkout. OpenAI may be used by administrators to generate editorial content; user personal data must not be intentionally submitted to it.

Transfers outside the European Economic Area

Some international providers may process data outside the European Economic Area. In that case, PUYXEL relies on an adequacy decision, standard contractual clauses or another GDPR safeguard and limits the data sent to what is strictly necessary.

Retention periods

Active accounts are kept while the service is used. An inactive account may be deleted after two years following notice. Security logs are kept for up to twelve months; notifications for twelve months; temporary exports for seven days; backups for up to ninety days; support requests for three years after closure; contracts for five years after expiry and invoices for ten years. Private hunting data remains available until deleted by the user or the account. Data entrusted by a society follows its duties and the periods stated in the processing agreement.

Security

Huntrexia implements role- and society-based access controls, encrypted communications, security logging, backups, rate limiting, protected downloads and incident procedures. As no system can guarantee zero risk, users must protect their credentials and report suspected access without delay.

Your rights

You may request access, correction, erasure, restriction, objection and, where applicable, portability. You may withdraw consent without affecting earlier processing. The application provides a data export and account deletion request. Contact: hello@puyxel.com. Proof of identity may be requested only where there is reasonable doubt. You may also complain to the CNIL or your competent authority.

Policy changes

This policy may change to reflect features, providers or applicable rules. Material changes are announced in the service and, where a new permission is required, it is requested before the relevant processing begins.