Your data. Your choice.

Who uses your data?

BAMBOOST, a French single-member limited liability company with share capital of €1,000, at 424 chemin de la Pécheraie, 26600 Mercurol-Veaunes, France, 991 130 758 RCS Romans, is the data controller. For data questions and rights: contact@abyss.coach.

The website and app

abyss.coach presents ABYSS. app.abyss.coach contains your practice space. Their sign-ins are separate: a WordPress sign-in does not give access to your practice account. The presentation pages do not use your Journal to personalise advertising.

Without an account

Your profile, programme, sessions, comfortable reference (RC), optional assessments and settings are stored locally in this browser or PWA. They are not sent to account backup until you allow it. Visiting a website still sends technical connection information, including an IP address, to the host. Clearing browser data or losing your device can remove your local copy: keep a private export if you want to retain it.

With an account

Your email and a secure password hash are used for account access and recovery. Your password is not stored in plain text. This account management is based on the service you request (GDPR Article 6(1)(b)). An account is optional.

Your permission for online backup

Backup may include your profile and motivation, programme, sessions and dates, RC and its validations, reported difficulty and feelings, before/after calm when provided, counters and settings. These details may reveal information about your health. Storing them on Infomaniak servers so that you can access them across devices relies on your explicit consent (GDPR Articles 6(1)(a) and, where the information is health data, 9(2)(a)). The checkbox is unchecked. Refusal does not prevent local use. Calm assessments remain optional and separate from difficulty feedback; they never increase retention durations on their own. ABYSS provides no diagnosis or treatment.

Changing your mind

In your account area, you can export cloud data and withdraw consent. Confirmation explains that withdrawal erases the active cloud copy of your journey and feelings while retaining your account and copies already on your devices. Synchronisation is then suspended. To remove your account and email as well, use account deletion. Offline devices may keep local copies that need separate erasure. Withdrawal does not affect lawful processing before it. An existing historical backup does not mean permission for new synchronisations: a choice is requested.

Security and evidence of your choice

Strictly necessary session cookies secure access. They are limited to the app domain and marked Secure, HttpOnly and SameSite. Sessions expire after 30 minutes of inactivity or at most 7 days after creation. Pseudonymised technical identifiers limit access attempts. Recovery links expire after 30 minutes. Security relies on the legitimate interest of protecting the service (GDPR Article 6(1)(f)). The accepted text version, its hash, language, consent or withdrawal and server timestamp are recorded as evidence of your choice. This feature requests no advertising consent.

Retention

The local copy remains in your browser until you or the system erase it. The account and, if allowed, active cloud journey are retained to provide the service you maintain, until withdrawal or deletion under the choices above. Consent records are linked to the account and deleted with it. Recovery tokens become unusable on expiry or use; technical rate-limit records expire and are subject to technical cleanup. There is currently no guaranteed automatic deletion after 24 months without signing in. Technical backups and logs follow the cycles below; erasing the active copy does not immediately erase every historical backup.

Hosting, backups and logs

Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (GE), Switzerland, provides Web hosting and the database. Hosting data is stored in its Swiss data centres; Switzerland benefits from an EU adequacy decision. Access is limited to BAMBOOST and authorised operators needed to run the service. Practice data is not intended for sale or transmission to advertising networks. Recovery copies are reserved for incident restoration and must not restart synchronisation after withdrawal. Automatic backups rotate under the host’s rules (its seven most recent daily backups and, for certain WordPress backups, points at 15 and 30 days). Manual ABYSS deployment backups are kept for recovery and reassessed after 30 days. Host-managed access/error logs remain until automatic rotation; Infomaniak states at least 7 days. Details relevant to a specific request are available from contact@abyss.coach. A restoration must reapply erasure or withdrawal requests before returning to service.

Contact, calendar and notifications

If you write to contact@abyss.coach, your message is used to answer and follow up your request; do not include unnecessary medical information. Useful correspondence is kept for handling and follow-up, then removed when no longer needed, subject to a legal duty or documented dispute. Current reminders use a calendar file that you choose to import into your calendar, which applies its own settings. This edition sends no push notifications. Installing the PWA does not give permission for backup or notifications.

Your rights

You can request access, correction, erasure, restriction and, depending on the legal basis, objection or portability. You can withdraw consent as easily as giving it. The account area offers exports and deletion, or you can write to contact@abyss.coach. Proportionate identity verification may be needed, without routinely requesting an identity document. Requests are answered within the applicable period, normally one month. You can complain to the French CNIL: https://www.cnil.fr/fr/plaintes. Exports may contain sensitive information: keep them private.

Updates

Version 2026-10-17.1. Changes to the purpose or scope of consent will be explained and, where necessary, require new permission. This policy describes processing and available choices; it is not a compliance certification or medical validation of practice protocols.