1. Data controller
The controller of the personal data collected by Lectune (lectune.fr website and Android app) is SAS QR Développement, 254 rue Vendôme, 69003 Lyon, France (RCS Lyon 984 919 258).
For any question about your data or to exercise your rights: contact@qr-developpement.fr.
We only collect the data needed to run the service. Lectune shows no advertising, uses no advertising trackers or third-party audience measurement tools, and sells no data.
2. Data we process
| Category | Data | Source |
|---|---|---|
| Account | E-mail address; password (stored only in hashed form, bcrypt) or Google identifier; name provided by Google where applicable; language; sign-up and e-mail verification dates; referral code and any referrer; sign-in tokens (device name, date of last use). | You, or Google if you sign in with Google |
| Abuse prevention | Fingerprint (HMAC) of the sign-up IP address — the IP address is never stored in clear in our database; random device identifier generated by the website or the app; fingerprint (HMAC) of a referred person's e-mail address. | Your browser or device |
| Use of the service | Library (books and dates of listening or setting to music); unlocked books; compositions started; credit history (purchases, spending, returns, referrals). | Your use of the service |
| Purchases | Pack bought, amount, date, Stripe or Google Play transaction identifiers. No bank card data: it is entered directly with Stripe or Google. | You, Stripe, Google Play / RevenueCat |
| Book searches | Search terms, sent by our servers to Open Library without any data about you; they are not linked to your account but may appear in technical logs. | You |
| Technical logs | IP address, date and time, requested address, browser or app, response code. | Your browser or device |
We collect neither your location, nor your contacts, nor any sensitive data. Books and soundtracks contain no personal data: they are described from the books' public metadata.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, signing you in (including with Google), verifying your e-mail address, resetting your password | Performance of the contract (terms of use) |
| Composing and delivering soundtracks, keeping your library, enabling listening | Performance of the contract (terms of use) |
| Selling and crediting packs, handling credit returns and referrals | Performance of the contract (terms of sale, terms of use) |
| Sending you service e-mails (verification, password, account information) | Performance of the contract |
| Keeping accounting records and answering requests from the authorities | Legal obligation |
| Securing the service, preventing fraud and abuse of referrals and credits, keeping technical logs | Legitimate interest (security and fairness of the service) |
We do no profiling for commercial purposes and send no marketing: the e-mails you receive relate to the operation of your account.
4. Recipients and processors
Your data is accessible only to authorised staff of SAS QR Développement, for the administration of the service. We use the following providers, which process data only for the needs of the service:
| Provider | Role | Data concerned | Location |
|---|---|---|---|
| OVH SAS | Hosting of servers and data | All | European Union |
| Mailtrap (Railsware) | Sending service e-mails | E-mail address, e-mail content | United States |
| Stripe Payments Europe Ltd | Payments on the website | E-mail address, Lectune account identifier, payment data | Ireland (EU) |
| Google (Google Ireland Ltd) | Sign-in with Google (if you use it); Google Play billing in the app | Google identification data; purchase data | Ireland (EU) |
| RevenueCat, Inc. | Managing in-app purchases | Lectune account identifier, purchase receipts | United States |
| Internet Archive (Open Library) | Book search, covers | None from our servers; in the app, covers are loaded directly from covers.openlibrary.org, which then sees your IP address (the website serves them through its own server) | United States |
The artificial intelligence models that compose the soundtracks — Mistral AI (France) and Google's Gemini and Lyria APIs — only receive the books' public metadata (title, author, subjects, summary) and no personal data.
5. Transfers outside the European Union
Some providers are based in the United States (Mailtrap, RevenueCat, Internet Archive). These transfers are governed by the European Commission's standard contractual clauses and, where applicable, by the EU–US Data Privacy Framework. Stripe and Google may also transfer data outside the European Union under their own safeguards. You can obtain a copy of the applicable safeguards by writing to us.
6. Retention periods
| Data | Period |
|---|---|
| Account, library, book access, credit history | Until the account is deleted, which takes effect immediately at your request. An account inactive for more than three years may be deleted after prior notice. |
| Sign-in tokens | Until sign-out, password change (other devices) or account deletion; the website's session cookie expires after 60 days. |
| Verification and reset links | 24 hours (e-mail verification); 60 minutes (password) |
| Fingerprints (e-mail, IP) and device identifier linked to welcome credits and referrals | 3 years after the referred person's account is deleted, then automatic erasure |
| Technical logs | Automatic rotation; 12 months at most |
| Accounting records | 10 years (French Commercial Code); payment records are also kept by Stripe or Google |
| Backup copies | Erased no later than 30 days after the original data is deleted |
7. Security
We protect your data with appropriate measures, in particular:
- encrypted connections (HTTPS);
- passwords stored only in hashed form; IP and e-mail addresses used for abuse prevention kept as fingerprints;
- signed, temporary audio links;
- administration access restricted to authorised staff;
- hosting in the European Union.
8. Your rights
Under the GDPR and the French Data Protection Act, you have the following rights:
- access to your data and a copy of it;
- rectification of inaccurate data;
- erasure: you can delete your account yourself (see Delete my account);
- restriction of processing;
- objection to processing based on our legitimate interest;
- portability of the data you provided to us;
- instructions regarding your data after your death.
To exercise them, write to contact@qr-developpement.fr from your account's address. We reply within one month, which may be extended by two months for complex requests; proof of identity may be requested in case of reasonable doubt.
You may also lodge a complaint with the CNIL (French data protection authority): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — cnil.fr.
9. Minors
The service is intended for people aged at least 15. Below that age, signing up requires the consent of the holder(s) of parental authority, who may ask us to delete their child's account.
11. Android app
The Android app stores on your device:
- your sign-in token, in the system's secure storage;
- a random installation identifier (referral abuse prevention);
- your preferences;
- the audio files you choose to listen to offline.
It uses Internet access, background audio playback (foreground service) and lock-screen media controls. Purchases go through Google Play and RevenueCat; sign-in with Google through the device's Google services. This local data is erased by uninstalling the app or clearing its data.
12. Automated decisions
No decision producing legal effects or similarly significantly affecting you is based solely on automated processing. Automatic referral checks may refuse a reward; you can ask for a review by a person by writing to us.
13. Changes
This policy may change, in particular when a provider or feature is added. Substantial changes are notified to account holders by e-mail or within the service; the date of the last update appears at the top of this page.