Privacy policy
This document describes the personal data processed by the Notani app and by the sign-up form on the notani.eu website: which data, why, for how long, and what you are entitled to demand.
Version of 23 September 2026. — Version française
What this document covers
It covers the Notani app — the mobile application and the services that run it — and the sign-up form on the notani.eu/en/pilot page. The website notani.eu you are viewing is otherwise a separate institutional site, with no cookies and no trackers: it is described in the legal notice.
Notani is an animal traceability register. Its purpose is to keep a record of facts — an animal arrived somewhere, left again, was under a given person’s responsibility on a given date — and to make those facts reliable. Doing so means processing data about people. This document says which, without evasion.
Data controller
- Controller
- CLER TECH, société par actions simplifiée
- Registered office
- 47 rue Vivienne, 75002 Paris, France
- Trade register
- Paris 106 231 459
- Contact
- contact@notani.eu
CLER TECH alone determines the purposes and means of the processing described here. If, in future, a professional establishment uses Notani to keep the register of its own animals under a contract, this allocation may change to joint controllership; this document will then be updated.
The two ways your data reaches us
They are not alike, and your rights are not exercised the same way in each.
You use Notani. You created an account, you declare movements, you keep a register. The data you enter reaches us directly from you.
Someone declares a movement that concerns you. A keeper states that animals arrived at your premises or left them, and you receive a message inviting you to confirm or dispute it. You have no account and you agreed to nothing — your contact details were given to us by the person making the declaration. The section “If you received a message without having an account” below is written for you.
What we process, why, and on what legal basis
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Account and identity — email address, first and last name, phone number, language, country | Create and secure your access, identify you as the author of your declarations | Performance of a contract (art. 6(1)(b)) | Deleted when the account is closed. Your first and last name remain in the register under the retention obligation — see the “Register” row. |
| Secondary email addresses and their verification status | Attach invitations and confirmations received at an address other than the primary one | Performance of a contract | Deleted when the account is closed |
| Roles and scopes of intervention | Determine who may declare, view or validate for which establishment | Performance of a contract | Deleted when the account is closed. The record that a role existed remains in the register. |
| Register — animals, holding premises and their addresses, movements, holdings, validations | Keep the register and give it evidential value | Performance of a contract, and the legal obligation to retain the farm register | 5 years from the last entry written to the register |
| Contact details of a notified third party — name and email address provided by the declaring person | Inform you of a movement that concerns you and let you confirm or dispute it | Legitimate interests (art. 6(1)(f)) | 12 months after the last exchange, then erased. The movement itself belongs to the register. |
| Sign-up for the next phase (notani.eu website) — email address, language, version of the notice accepted, date, optional declared status | Notify you when the next phase opens, and help us prepare it | Consent (art. 6(1)(a)) | Until the next phase opens, twelve months at most |
| Audit log of sensitive actions | Security, detection of abnormal use, ability to establish who did what | Legitimate interests | 5 years — the log is immutable: it is never modified, it expires at term. |
| Technical connection logs | Operate the service and protect it against abuse | Legitimate interests | 12 months |
If you received a message without having an account
You received an email from Notani asking you to confirm an animal movement. You never signed up and you are wondering where your details came from. Here is the full answer.
A keeper declared a movement, giving your name and email address as the destination or the origin. We are writing to you so that this fact is not recorded behind your back.
We process those contact details on the basis of our legitimate interests (Article 6(1)(f) GDPR). We balanced that interest against your rights and concluded as follows: the message is transactional — it sells nothing and solicits nothing; it concerns a fact that relates to you directly and that you have an interest in knowing; and it gives you a means to act, including to dispute. Not telling you would mean letting a declaration about you be recorded with no opportunity to contradict it. This balancing test is documented and can be provided to you.
In accordance with Article 14 GDPR, this page constitutes the information owed to you about the origin of your data. You have the same rights as anyone else, and in particular a right to object: write to contact@notani.eu and we will stop sending you such requests and erase your contact details. This does not delete the declared movement, which belongs to the register kept by the declaring party.
Confirming or disputing creates no account and commits you to nothing else.
Who else sees this data
We do not sell, rent or transfer any data. We rely on a small number of technical providers, all bound by contract and acting solely on our instructions.
- Authentication — credentials and sessions. Hosted in Europe.
- Application hosting and database — the register itself. Hosted in Europe.
- Email delivery — notifications and confirmation requests. Hosted in Europe.
- Sign-up for the next phase — the form on the pilot page and its database. Vercel and Railway, processors — hosted in Europe.
Notani’s application infrastructure is hosted in Europe, and will remain so. This is not a preference: it is a rule we impose on ourselves.
The Notani team. To help you when you contact us, an authorised member of the Notani team may view the information of an animal registered on Notani: its stays with each keeper, the name of the establishment, the address of the premises and the email address of its manager. Each consultation is recorded in our audit log, retained for five years.
The two exceptions, stated plainly
Two processing operations fall outside that scope. We would rather name them than bury them in a general clause.
Address lookup and map display. When you type the address of a holding premises or display a map, your device queries Google’s mapping services directly (places.googleapis.com and maps.googleapis.com). The text you type and your device’s IP address are therefore transmitted to Google, a company established in the United States, on the basis of our legitimate interest in offering reliable address entry. These calls occur only when you search for an address or view a map.
The institutional website notani.eu is served from the infrastructure of Vercel Inc., in the United States. It contains a single form, on the pilot page, described in this document; beyond that, only technical connection logs are recorded by the host. The website and the app are two separate infrastructures.
What the app does not do
This list is verifiable and we hold ourselves to it.
- No advertising trackers, no advertising cookies, no ad network.
- No audience measurement or behavioural analytics tool.
- No crash-reporting tool transmitting data to a third party.
- No geolocation of your device — the app requests no location permission whatsoever. The addresses recorded are the ones you type yourself.
- No access to your contacts, camera, photos or microphone.
- No data sold, rented or transferred to third parties.
- No solely automated decision producing legal effects concerning you.
Security
Traffic between the app and our servers is encrypted in transit. On your device, the token that maintains your session is kept in the operating system’s secure store, not in an ordinary file. Single-use tokens sent by email are never stored in clear text on our side: we keep only a hash, which lets us verify them without being able to reconstruct them. Access to the register is limited by role and scope, and sensitive actions are logged.
Your rights
You have the right of access, rectification, erasure, restriction, objection and portability over data concerning you. Some rights have limits: data we are legally required to retain as part of the register cannot be erased before its term, and the audit log is immutable by design — which is precisely what gives it evidential value.
To request deletion of your account, a dedicated page sets out the procedure and what is retained: notani.eu/en/account-deletion.
To exercise your other rights, write to contact@notani.eu. We reply within one month. If our response does not satisfy you, you may lodge a complaint with the French data protection authority — cnil.fr — or with the supervisory authority of your country of residence.
Intended audience
Notani is intended for equine keepers and professional establishments in the sector. Creating an account presupposes the ability to declare movements under one’s own responsibility. We do not knowingly collect data concerning a child under the age of fifteen without the authorisation of the holder of parental responsibility; if you become aware that such an account exists, write to us and we will delete it.
Changes
This policy may change as the service evolves. Any substantial change — a new purpose, a new recipient, a longer retention period — will be signalled in the app before it takes effect. The version date appears at the top of this document.