Privacy Policy — MANDRAGORA

1. Data Controller

The MANDRAGORA consortium, represented by its founding institutions (Mulhouse Zoo and Akongo), is the data controller for your personal data.

2. Data Collected

We collect the following data:

• Identification data: email address, display name (optional)
• Professional data: affiliated institution, role within the institution
• Contribution data: interactions created, votes, discussions, messages
• Technical data: connection logs, IP address (for security purposes)
• GDPR consent: date and version of the accepted Terms of Service
• Field data (mobile app): enclosures, inventoried plants, plant distributions, observed consumption, field signals and notes; this data stays private to your institution
• Photos: photos taken or chosen to identify a plant or document a signal; they are kept on the device until uploaded, then stored in your institution's private space

3. Purposes of Processing

• User account management and authentication
• Institutional attribution of contributions (scientific transparency)
• Confidence score calculation
• Notifications related to platform activity
• Content moderation
• Audit and traceability (action log)

4. Legal Basis

Processing is based on your consent (Article 6(1)(a) of the GDPR), obtained at the time of registration. For the audit log, the legal basis is the legitimate interest of the consortium in ensuring the traceability of scientific contributions.

5. Data Retention Period

• Account data: retained until account deletion
• Scientific contributions: anonymised but retained indefinitely for their scientific value
• Technical logs: 12 months
• Audit log: 5 years

6. Your Rights

Under the GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate data
• Right to erasure: delete your account (contributions are anonymised)
• Right to data portability: export your data in JSON format
• Right to object: object to the processing of your data

These rights can be exercised from your profile (export and deletion) or by writing to privacy@mandragora-app.com. Detailed deletion procedure: mandragora-app.com/en/account-deletion.

7. Sub-processors

• Firebase (Google Cloud): hosting, authentication, database
• Vercel: web application hosting
• Pl@ntNet: plant identification from the photos sent, without any data identifying the user
• Postmark: transactional e-mails (invitations, password reset)
• Sentry and Typesense: error monitoring of the web application and taxonomic search engine

These sub-processors comply with the GDPR and provide appropriate safeguards for data transfers outside the EU (standard contractual clauses).

8. Security

We implement appropriate technical and organisational measures to protect your data: encryption in transit (HTTPS), secure authentication, role-based access control, immutable audit log.

9. Cookies

MANDRAGORA uses a session cookie (AuthToken) strictly necessary for authentication. No tracking or advertising cookies are used.

10. Contact

For any question about the protection of your data: privacy@mandragora-app.com. For anything else: support@mandragora-app.com.