Privacy Policy — LifeHandler

Last updated: 2026-06-14.

🇫🇷 Lire en français : /privacy

LifeHandler ("the Service") is a personal assistant that helps you organize and complete French administrative procedures. This Privacy Policy describes how your personal data is collected, used, protected, and what rights you have over it.

It complies with the General Data Protection Regulation (GDPR, EU 2016/679) and the French amended Data Protection Act.

1. Data controller

• Legal name: NIANG ELYAS
• Trade name: LifeHandler
• Legal form: Sole proprietorship (Entrepreneur Individuel) — micro-entreprise
• Registration (SIREN): 105 916 589
• Registered address: 15 boulevard Voltaire, 92600 Asnières-sur-Seine, France
• Privacy contact / DPO: privacy@lifehandler.fr

For any question regarding the processing of your data or to exercise your rights, write to this address.

2. Data we collect

LifeHandler only collects data that you provide yourself. No data is inferred without your knowledge, and we do not use any third-party tracking or analytics tool.

2.1 Data required to operate your account

• Email address
• Password (stored hashed — bcrypt — by Supabase, never in clear)
• Unique user identifier (UUID)

2.2 Data you enter in the app

Depending on your usage, you may register in LifeHandler:

• Identity: name, first name, date of birth, nationality, sex…
• Housing: address, type, rent, lease dates…
• Professional activity: employer, contract, salary, work address…
• Vehicles: brand, model, registration plate, insurance…
• Bank accounts: bank name, IBAN, card type…
• Documents: ID documents, contracts, bank statements, etc. uploaded into the vault
• Quests and tasks: ongoing procedures and steps
• Conversations with the AI assistant

2.3 Cookies & trackers

No cookie is installed by LifeHandler. The Service uses the localStorage of your browser to store your login session — this is technically necessary for the Service to function ("strictly necessary" category in CNIL terms), so exempt from prior consent.

No third-party analytics tool (Google Analytics, Posthog, Mixpanel…) is integrated.

3. Purposes and legal basis

4. Zero-knowledge encryption

LifeHandler cannot read your sensitive data. When you create your account, your master password is transformed on your device (web or mobile) into a 256-bit AES encryption key via the Argon2id algorithm. This key never leaves your device.

On iOS, your master key is stored in the Apple Keychain via expo-secure-store (Secure Enclave hardware secure zone when available). On the web, it stays exclusively in memory of your browser tab, never persisted to disk.

3-tier sensitivity model

Not all data is equal. LifeHandler classifies it in three levels that govern its display in the app AND what the AI agent can do with it:

• Tier 1 — Non-sensitive: marital status, employment status (full-time/part-time/student), housing type, tax household, tax bracket. Directly visible in the app. The agent can request their value with your explicit consent if a procedure needs it.
• Tier 2 — Sensitive: email, postal address, phone, full name, date of birth. Masked by default in the app (lock icon, eye to reveal). The agent is not allowed to request these values; only you may choose to share them spontaneously.
• Tier 3 — Ultra-sensitive: national ID number (NIR), ID card, passport, driving license, IBAN/BIC, tax number, stored passwords, payment card data. Masked by default. Never transmittable to the agent, even with your consent (software lock in src/lib/sensitive-keys.ts, ABSOLUTE_BLOCKED). To reveal them in the app, strong authentication (FaceID / TouchID or re-entry of the master password) is required.

What is encrypted at-rest in our databases (and therefore invisible to us)

• Vault values (collections.data, vault_data.value): name, first name, NIR, IBAN, address, ID numbers, dates of birth, administrative identifiers, etc. — JSONB encrypted AES-256-GCM with your master key.
• Content of uploaded documents (PDF, photos): bytes encrypted AES-256-GCM in Supabase object storage before upload.
• Task notes (tasks.notes): Clarifier content (semi-structured Q&A you filled during a procedure).
• AI agent conversations (agent_messages.content): everything you type to the agent and every agent response that re-cites your data.
• Integrated browser history (browser_history.url): all administrative sites visited via the LifeHandler browser.
• Wrapped master key (user_keys): your master key encrypted with a key derived from Argon2id of your password AND your recovery phrase.

What remains in plaintext (structural metadata)

To allow the AI agent to reason efficiently about your procedures without excessive cost, certain category metadata remain visible server-side:

• Entity types and subtypes (collections.type, collections.subtype): e.g. profile/identity, asset/real_estate, document/lease. This is a closed taxonomy that we publish; seeing that an account has type asset/vehicle reveals nothing about the car itself.
• Quest and task titles (until v1.1): e.g. "Renew my ID card". In-progress work: we commit to encrypting these in v1.1 (summer 2026).

How the AI agent can still help you

The agent does not read your data directly from our databases. When you start a conversation, the client (web or mobile) decrypts locally the necessary data with your master key (which never leaves your device), then sends it transiently in the body of the request to our server, which forwards it to Anthropic's Claude API. At the end of the session, the plaintext disappears server-side; on Anthropic's side, we have requested Zero Data Retention (ZDR) activation which makes this ingestion ephemeral with no persistence (cf. §7).

Important consequence

If you lose your master password AND your recovery phrase, your encrypted data is unrecoverable. This is the price of the zero-knowledge guarantee.

5. Retention period

Your data is kept as long as your account exists.

You can delete your account at any time from the app (Settings → Delete my account). Deletion is immediate and irreversible: all your records, uploaded documents, conversation history and access are purged. No decryptable backup copy is kept by LifeHandler.

6. Data recipients (subprocessors)

Your data is processed by the following subprocessors, each governed by Standard Contractual Clauses (SCC) or a DPA:

The detailed content of what each subprocessor sees is documented in the mcp-server/RGPD.md file.

7. Transfers outside EU

The use of Anthropic (USA) constitutes a transfer outside the EU. Anthropic makes Standard Contractual Clauses (SCC) compliant with EU decision 2021/914 available, as well as a Data Processing Addendum on request. Per Anthropic API Terms (Section 7), no client data is used to train their models.

The use of Vercel (USA) covers only web page delivery; no personal data is durably stored there. Vercel also adheres to the EU-US Data Privacy Framework.

The main subprocessors (Supabase Ireland, Scaleway Paris) remain within the EU perimeter.

8. Security

Technical and organizational measures deployed:

• Zero-knowledge AES-256-GCM encryption client-side (§4)
• TLS 1.2+ mandatory for all transfers
• Systematic verification of the Supabase JWT on every API call
• Authentication of the MCP server via systematic Supabase JWT verification (supabase.auth.getUser()) — no raw Bearer userId accepted
• Hardcoded list of hyper-sensitive fields (NIR, IBAN, BIC, ID cards, passports, payment cards, passwords…) never transmittable to the agent, even with user consent (runtime gate in src/lib/sensitive-keys.ts)
• Supabase service-role never exposed client-side
• Hardened "No PII in logs" policy: all server and client logs go through a safeLog wrapper that scrubs PII patterns (NIR, IBAN, cards, email, FR phones) before any output. ESLint rule no-console enforced in CI to prevent reintroduction of raw console.* in server code.
• The master password is never transmitted to or stored on the server
• Automatic database backup by Supabase (backups also encrypted)

9. Analytics and usage measurement

LifeHandler uses no third-party cookie, no third-party tracker (Google Analytics, Posthog, Mixpanel, Hotjar, etc. are explicitly absent).

If we deploy a measurement system to improve the product, it will be:

• Opt-in — you can use the app entirely without accepting
• Metadata-only — event type ("you created a quest", "you used the browser on an admin site"), duration, platform, app version. Never the value of a field, the content of a conversation, nor the exact URL visited.
• Hosted in EU or on our own infrastructure
• Revocable at any time from Settings
• Detailed in an update of this policy before activation

10. Your rights

In accordance with articles 15 to 22 of the GDPR, you have on your personal data the right of:

• Access (Art. 15) — all your data is visible in the app (dashboard, vault).
• Rectification (Art. 16) — you can edit all your data directly in the app.
• Erasure / oblivion (Art. 17) — delete your account from Settings → Delete my account.
• Portability (Art. 20) — export all your data in JSON format via POST /api/account/export. Also available from the UI in Settings → Export my data.
• Objection (Art. 21) — disable the AI assistant in settings or stop using at any time.
• Restriction (Art. 18) — contact us to suspend processing of your data without deleting it.

To exercise these rights, write to privacy@lifehandler.fr with the subject "GDPR rights". Response within 30 days maximum (in practice within 7 days).

11. Complaint to the CNIL

If you believe this Service does not respect your rights, you may file a complaint with the French Data Protection Authority (CNIL):

• Website: cnil.fr/plaintes
• Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
• Phone: +33 (0)1 53 73 22 22

12. Data breach notification

In case of a security incident affecting your personal data, LifeHandler commits to:

1. Notify the CNIL within 72 hours of becoming aware, if a risk to your rights and freedoms is identified (GDPR Art. 33).
2. Inform you without undue delay if the risk is high (GDPR Art. 34). The communication will specify the nature of the breach, possible consequences, measures taken, and actions you can take to reduce your exposure.
3. Document each incident in an internal register (cause, data concerned, users affected, corrective measures) in accordance with Art. 33(5).
4. Publish a public post-mortem on lifehandler.fr/incidents/ once the incident is resolved, for any breach that triggered a user notification.

The full procedure (detection, containment, assessment, notification) is described in our internal incident run-book, available on request at privacy@lifehandler.fr.

To report an incident or a vulnerability you have identified, write to security@lifehandler.fr. You will receive an acknowledgement within 72h. The responsible disclosure procedure is documented in SECURITY.md.

13. Modification of this policy

This policy may evolve to reflect technical or regulatory changes. Any substantial modification will be notified to you by email before it takes effect. The version in force is always the most recent one published at this URL.

History of modifications visible in the public repository: github.com/CillitBANG2001/weblifehandler — PRIVACY.en.md.