Privacy policy

Last updated: 21 July 2026

In summary

• Your data is hosted in Europe.
• We never sell, rent or exchange your data.
• No third-party advertising or advertising targeted from your data, no profiling, no analytics tracker — the marketing site sets no cookies, and our fonts are self-hosted (no request to a third party to display the page).
• The GPS metadata of your photos is removed on upload.
• You can export or delete your data at any time.

1. Data controller

Digital Consult SRL, a limited liability company incorporated under Belgian law, CBE 0808.334.949, VAT BE 0808.334.949, with its registered office at Résidence le Festinoy 2b, 7011 Ghlin (Belgium), publisher of AquaTender, is the controller of the data processing described below.

Contact for any question or request relating to your data: contact@aquatender.fish.

We have not appointed a data protection officer: our processing operations fall under none of the cases listed in Article 37 GDPR (neither large-scale systematic monitoring, nor large-scale processing of sensitive data). For any question relating to your data, the address above is the point of contact.

2. Data processed, purposes and legal bases

2.1 Account

Data: e-mail address, password (stored as a cryptographic hash, never in clear text), preferences (language, metric/imperial units, time zone), creation date.
Purpose: create and manage your account, authenticate you, provide you with the Service.
Legal basis: performance of the contract (art. 6.1.b GDPR).

2.2 Content you create

Data: aquariums (name, type, volume, dimensions), parameter measurements and their history, livestock, equipment, reminders and maintenance log, photos, notes.
Purpose: provide the tracking, charting, planning and reminder features.
Legal basis: performance of the contract.

2.3 Subscription

Data: plan, status, dates, transaction identifier from the platform (Apple/Google) or from the payment provider. We neither receive nor store your bank card details.
Purpose: manage your subscription and your access rights; issue invoices.
Legal basis: performance of the contract; legal obligation (accounting) for supporting documents.

2.4 Contact form

Data: name, e-mail address, message, language, and the IP address of the submission.
Purpose: handle your request and reply to you; the IP address is used solely to prevent and trace abuse (spam).
Legal basis: legitimate interest in responding to enquiries and protecting the service against abuse (art. 6.1.f).

2.5 Technical data

Data: server logs (IP address, date, requested resource, user agent, response code), CDN network protection data.
Purpose: security, abuse prevention, incident diagnosis, availability.
Legal basis: legitimate interest in securing and maintaining the Service.

2.6 Notifications

Data: if you enable push reminders, the technical address (“endpoint”) provided by your browser, your device's public encryption keys and a device label allowing you to identify it.
Purpose: deliver maintenance reminders to you.
Legal basis: performance of the contract; where applicable, your consent at operating system or browser level, which you may withdraw at any time.

We use the open Web Push standard (RFC 8030, VAPID authentication) without adding a notification intermediary such as OneSignal. Delivery necessarily goes through the push service of your browser's vendor (Mozilla, Google, Apple or Microsoft, depending on the browser you use), which you effectively choose by choosing your browser. Its content is end-to-end encrypted (RFC 8291): that service delivers the message without being able to read it. A subscription that no longer responds is automatically deleted.

2.7 What we do not do

We carry out no advertising profiling, no automated decision-making producing legal effects concerning you, and we do not use your content for advertising purposes.

3. Photos and metadata

When you upload a photo, it is resized and its EXIF metadata is stripped, including the GPS coordinates: the location of your home is therefore neither retained nor disclosed. The original files are not kept beyond processing.

4. Sharing feature

If you generate a shareable card, the image concerned becomes accessible through an unguessable public link, so that forums can display it. This publication results from a deliberate action on your part. Once a link has been circulated, it may be copied or kept by third parties beyond our control. Your other photos and data remain private.

5. Retention periods

• Account and content: for as long as your account is active.
• Inactivity: an account that remains inactive is kept for 1 year, then deleted, after e-mail reminders allowing you to keep it.
• Trash: deleted items remain recoverable for 30 days, then are purged.
• Account deletion: deletion of the data within 30 days, excluding encrypted technical backups which expire by themselves within 90 days.
• Contact messages: 12 months after the request has been handled.
• Technical logs: 6 months.
• Accounting records: kept for 7 years, legal obligation (Article III.86 of the Belgian Code of Economic Law).

6. Recipients and processors

Your data is accessible only to those persons strictly necessary for operating the Service. We use the following processors, bound by a contract compliant with Article 28 of the GDPR:

OVHcloud — France

Hosting of the servers and of the database, in a data centre located in France (European Union).

Cloudflare, Inc. (United States)

Content delivery network, protection against attacks and TLS termination. In that capacity, Cloudflare processes the connection data (including the IP address) passing through to the site.

Mailjet SAS (Sinch group) — France

Delivery of transactional e-mails and of contact form messages. Registered office: 43 rue de Dunkerque, 75010 Paris. The data is hosted in the European Union (data centres in Frankfurt, Germany, and Saint-Ghislain, Belgium). Some of Mailjet's sub-processors, used for its technical support, are established in the United States (see section 7).

Apple Inc. / Google LLC

Only if you subscribe through the App Store or Google Play: management of the purchase and of the subscription, in accordance with their own policies.

We may have to disclose data where the law so requires (order from a competent authority).

7. Transfers outside the European Union

Your data is stored in Europe. Some technical providers nevertheless process data in the United States, or rely on sub-processors there:

• Cloudflare, Inc. — a US company, processes the connection data passing through to the site;
• Mailjet — hosts e-mails in the European Union, but relies on providers established in the United States for its technical support;
• Apple / Google — where applicable, if you subscribe through the App Store or Google Play.

These transfers are framed by the appropriate safeguards provided for in Chapter V of the GDPR, first among them the standard contractual clauses of the European Commission (decision 2021/914). Some of these providers are further certified under the EU–US Data Privacy Framework, a mechanism that comes in addition to the standard contractual clauses rather than replacing them.

8. Cookies and trackers

Marketing site (aquatender.fish): no cookies, no trackers, no audience measurement, no third-party fonts. No consent banner is therefore necessary.

Application (aquatender.app): only strictly necessary technical trackers for its operation (maintaining your authentication session, preferences). They are exempt from consent. No advertising or analytics cookie is set.

In our current configuration, Cloudflare sets no cookie: the features liable to set one (bot detection) are not enabled. Should this change, we would update this page; it would then be a cookie strictly necessary for security, exempt from consent.

9. Your rights

In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, objection (for processing based on our legitimate interest) and portability of your data. You may also give directions as to what happens to your data after your death.

To exercise these rights: contact@aquatender.fish. We reply within one month, extendable by two months in the case of a complex request. We may request an item enabling us to verify your identity where reasonable doubt exists.

You may lodge a complaint with the competent supervisory authority — in Belgium, the Data Protection Authority (Rue de la Presse 35, 1000 Brussels — autoriteprotectiondonnees.be) — or with the authority of your country of residence.

10. Security

We implement appropriate technical and organisational measures: encryption of communications (HTTPS/TLS), storage of passwords as hashes, partitioning of data per user, access restrictions, rate limiting and anti-abuse protections, backups.

No system is infallible. In the event of a data breach likely to result in a high risk to your rights, we will inform you and notify the competent authority under the conditions laid down in Articles 33 and 34 of the GDPR.

11. Minors

The Service is not intended for persons under 16 years of age without the authorisation and supervision of a holder of parental authority. We do not knowingly collect data from children below the applicable age of digital consent. If you believe that a minor has provided us with data, write to us: we will delete it.

12. Changes

We may amend this policy. In the event of a substantial change, you will be informed by e-mail or in the application before it takes effect. The date of the last update appears at the top of this page.