Privacy Policy – SOPlanning mobile app

Last updated: 03/09/2026

Data controller

SOADVANCE (SAS) — SIRET 837 899 087 00014
169 impasse des Baïsses sud, 13680 Lançon-de-Provence, France
DPO: dpo@soplanning.org

SOPlanning is delivered as a SaaS service: your organisation’s instance is hosted and administered by SOADVANCE. Your organisation remains the controller of the schedule data it records there; SOADVANCE acts as a processor within the meaning of Article 28 GDPR.

Data collected

The app collects and stores the following information locally on your device:

• the address of your SOPlanning instance;
• your login name;
• an authentication token issued by the server;
• your password, only if the “Remember me” option is enabled. It is stored encrypted in the system secure store (Android Keystore, iOS Keychain) and is transmitted only to your SOPlanning instance, to authenticate you;
• a local copy of your schedule data (tasks, projects, statuses, people), so that it remains available offline;
• your display and notification preferences.

The schedule data you view or create from the app (tasks, projects, resources, locations, comments) is stored on your SOPlanning instance, hosted by SOADVANCE.

Purpose of processing

This data is used exclusively to authenticate you with your SOPlanning instance and let you access your schedules and tasks.

Your schedule data and credentials are never disclosed to any third party for commercial, advertising or analytics purposes: they travel between your device and your organisation’s SOPlanning instance. Only technical crash reports are sent to Google, under the conditions described in the “Crash reports” section.

Data hosting and recipients

Business data (schedules, tasks, projects, users) is hosted on your organisation’s SOPlanning instance, operated by SOADVANCE on its own infrastructure. Our technical staff may access it solely for the purposes of operating, maintaining and supporting the solution, on your organisation’s instructions and only to the extent necessary.

The servers are hosted by OVH, in France. No data is transferred outside the European Union.

A copy of this data is also kept on your device for offline display. It is accessible only to the application itself and is not sent to any recipient other than your SOPlanning instance.

Retention period

The authentication token is valid for seven days. It is erased from the device on sign-out, together with the local copy of your schedule.

Your login name and password are kept only if you ticked “Remember me”, and solely to pre-fill the sign-in screen. Without that option they are never written to the device; if it is unticked, they are erased on sign-out.

All of this information is also erased when you uninstall the application or clear its data from your device settings.

On the server side, schedule data is retained for the whole term of the contract between your organisation and SOADVANCE, and then deleted within three months of its end.

Crash reports

The Android version of the application uses Firebase Crashlytics, a service provided by Google Ireland Limited, to detect and fix malfunctions. This service is active only in the version published on Google Play. The iOS version embeds no such tool: no crash report is sent from an iPhone or iPad.

When a crash occurs, the following is sent to Google: an application installation identifier, the device model, the operating system version, the state of the application at the time of the error, and the corresponding technical stack trace. These reports contain none of your credentials, your password, or your schedule data.

This processing relies on our legitimate interest in ensuring the correct operation and security of the application. Reports are retained by Google for ninety days and then deleted.

Google privacy policy: https://policies.google.com/privacy

Camera

The application accesses the camera only when you yourself start a login QR code scan. The image is used solely to decode the code: no photo is saved on the device or transmitted to anyone. The permission may be declined, in which case you can still sign in by entering your instance address and credentials manually.

Notifications

Task reminders are scheduled locally by the application, from data already present on your device. No notification is sent from an external server and no data is transmitted for this purpose.

Security

The app requires the HTTPS protocol for all communication with the server, in order to protect your credentials and data in transit. Credentials kept on the device are held in the operating system’s encrypted secure store.

Your rights (GDPR)

In accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws, you have the right to access, rectify, erase and port your data, as well as the right to object to and restrict its processing.

Because schedule data is processed by SOADVANCE on behalf of your organisation, please address your request to your organisation’s SOPlanning administrator first. You may also write to us at dpo@soplanning.org: we will forward your request to the relevant controller.

You may also lodge a complaint with your local data protection authority (in France, the CNIL — www.cnil.fr).

Updates

This policy may be updated. The version in force is accessible from the app’s login screen.