Version 2.0 — Last updated: 25 July 2026
What changed in this version
- We now state that your email address may be used to send you occasional satisfaction surveys or review requests, which you can opt out of at any time in one click or from the app settings.
- We publish the full list of our processors and detail any transfers of data outside the European Union.
- We specify the legal basis for each processing activity and the exact retention periods, including for inactive accounts.
- We clarify what account pairing involves and what happens when the link is broken.
- We add your right to lodge a complaint with the French data protection authority (CNIL) and the rules governing your data after your death.
None of these changes broadens how we use your health data: it is never sold, never used for advertising, and never shared with anyone other than the partner you have explicitly chosen.
1. Data controller
The Wenly app and the wenly.fr website are published by Mathis Laversin, sole trader (entrepreneur individuel) trading as Agence Fluid, France.
SIREN: 101 325 017
SIRET: 101 325 017 00016
EU VAT number: FR 52 101325017
Email: contact@wenly.fr
Publisher's website: https://www.agence-fluid.fr/
We undertake to respond to any request regarding your data within one month at most.
2. Scope
This policy applies to the Wenly mobile app (iOS and Android) and to the wenly.fr website.
Wenly is not a medical device. The app is a tracking and information tool provided for guidance only. It cannot be used to make a diagnosis, does not replace advice from a healthcare professional, and is in no way a method of contraception.
3. Minimum age
Wenly is intended for people aged 15 and over. We do not collect your date of birth: compliance with this requirement rests on the declaration you make when signing up.
If we learn that an account has been created by someone below this age, we delete it along with the associated data. If you are a parent or guardian and believe a minor has provided us with data, write to contact@wenly.fr and we will delete it without delay.
4. Data we process
4.1 Data you provide
- Account: email address, Apple or Google identifier depending on your sign-in method, hashed password (required).
- Profile: username (required), profile picture (optional).
- Health: period dates, cycle length, symptoms, needs, contraception method (optional, but necessary for cycle tracking to work).
- Intimate life: moods, libido levels, personal notes (optional).
- Couple: shared notes, Bucket List, pairing code (optional).
- Support: the content of your emails and attachments when you write to us.
We do not collect your date of birth, your age, or your legal name.
When you sign in with Apple or Google, we only receive your identifier and your email address. If you use Apple's "Hide My Email" feature, we only receive a relay address and never know your real one.
4.2 Data collected automatically
- Technical: device model, OS version, app version, language, time zone, installation identifier.
- Usage: screens viewed, features used, interaction events, crash reports.
- Subscription: subscription status, anonymous transaction identifier, renewal date.
- Notifications: your device's push notification token.
We use no advertising trackers, no advertising identifiers (IDFA / AAID) and no social media SDKs. The app does not track you across other apps or websites.
4.3 Data we do not collect
We do not collect your location, your contacts, any photos other than the one you choose as your profile picture, or data from Apple Health or Google Fit.
The wenly.fr website uses no analytics tools and no advertising cookies.
5. Purposes and legal bases
- Creating and managing your account, authentication: performance of a contract (Art. 6(1)(b)) — lifetime of the account.
- Cycle tracking, predictions, analysis and monthly recaps: explicit consent (Art. 9(2)(a)) — lifetime of the account, revocable.
- Sharing your logs with your paired partner: explicit consent (Art. 9(2)(a)) — until the link is broken.
- Managing your Premium subscription: performance of a contract (Art. 6(1)(b)) — subscription term + 10 years (accounting obligation).
- Securing the service, preventing fraud and abuse: legitimate interest (Art. 6(1)(f)) — 12 months for technical logs.
- Improving the app through usage statistics: legitimate interest (Art. 6(1)(f)) — 14 months.
- Sending service-related notifications: performance of a contract — lifetime of the account.
- Sending occasional satisfaction surveys or review requests: legitimate interest (Art. 6(1)(f)), with a permanent right to object — until you object.
- Informing you of commercial offers on our products: consent — until consent is withdrawn.
- Responding to support requests: legitimate interest — 3 years after the last exchange.
- Complying with our legal obligations: legal obligation (Art. 6(1)(c)) — as required by law.
About emails
We distinguish three types of email:
1. Service emails: account confirmation, password reset, notice of changes to our terms, security alerts, reminders before an inactive account is deleted. These are essential to the operation of the service and cannot be disabled while your account is active.
2. Satisfaction surveys and review requests, sent occasionally and containing no promotional content. You can opt out at any time, in one click from any such email or from Settings > Notifications in the app.
3. Marketing emails (promotions, offers on the Premium subscription). These are only sent to people who have given their consent, which is off by default.
6. Your health data
Period dates, symptoms, needs, contraception methods, moods and libido levels are special category personal data under Article 9 GDPR.
We process them solely on the basis of your explicit consent, obtained through a dedicated, non pre-ticked checkbox, separate from your acceptance of the terms and conditions.
You can withdraw this consent at any time from Settings > Privacy. Withdrawal stops cycle tracking and deletes the health data associated with your account, without affecting the lawfulness of processing carried out beforehand.
This data is never used for advertising, never sold, never passed to insurers, employers or data brokers, and is not accessible to any advertising network. It is never sent to any analytics tool: the events we collect to improve the product never contain the content of your logs.
French health data hosting (HDS): Wenly is a wellbeing app in which you enter your own information. It does not form part of a prevention, diagnosis or care pathway on behalf of a healthcare professional or institution. The HDS certification required by Article L1111-8 of the French Public Health Code therefore does not apply.
7. Account pairing
Pairing lets you share your tracking with a person of your choice, using a code you send them.
What your partner sees once the link is established:
- your cycle calendar and its predictions;
- the symptoms, needs, moods and libido levels you have logged;
- the notes you have explicitly marked as shared;
- the shared Bucket List;
- your username and profile picture;
- the Premium status, which is shared between both linked accounts: if either partner subscribes, the other gets the Premium features, so each partner knows the couple is subscribed.
What your partner never sees: your email address, your credentials, your unshared notes, your billing details.
Breaking the link: either partner can break the link at any time, unilaterally and without the other's agreement, from Settings > My couple. The break is immediate and complete: your former partner instantly loses access to all of your data, including data from the period during which you were linked. No copy is kept on their account. Content created together (shared notes, Bucket List) stops being accessible on both sides. Shared Premium access also ends for the non-subscribing partner.
Please note that no technical measure can prevent a partner from taking a screenshot or memorising information before the link is broken. Only share your pairing code with someone you trust.
8. Recipients and processors
Your data is only accessible to the publisher and to the technical providers strictly necessary to operate the service. Each is bound by a data processing agreement compliant with Article 28 GDPR.
- Supabase Inc. — database, authentication, storage, transactional emails: all account and tracking data — Paris, France (eu-west-3 region).
- PostHog — usage analytics: interaction events, technical data — European Union (PostHog EU Cloud).
- Framer B.V. — hosting of wenly.fr: website connection data — European Union (Amsterdam, Netherlands).
- Apple Inc. / Apple Distribution International Ltd. — distribution, payment, push notifications (APNs): transaction identifier, notification token — Ireland and United States.
- Google LLC / Google Ireland Ltd. — distribution, payment, push notifications (FCM): transaction identifier, notification token — Ireland and United States.
- RevenueCat, Inc. — subscription management: pseudonymised user identifier, subscription status — United States.
- Expo (650 Industries, Inc.) — push notification delivery, app updates: notification token, technical data — United States.
All of your health and couple data is hosted in France, on Supabase infrastructure located in the Paris region. Providers based in the United States receive no health data.
Your data may also be disclosed to administrative or judicial authorities where we are legally required to do so.
9. Transfers outside the European Union
Our main providers (Supabase, PostHog, Framer) host your data within the European Union.
Some ancillary providers — Apple, Google, RevenueCat, Expo — are established in the United States and may process technical or billing data there. These transfers are covered by the Standard Contractual Clauses adopted by the European Commission and, where applicable, by those providers' certification under the EU–US Data Privacy Framework. A copy of the applicable safeguards is available on request at contact@wenly.fr.
10. Retention periods
Your data is retained for as long as your account is active.
Inactive accounts: if you do not log in for 2 years, your account and all associated data are deleted. We send you a reminder email 2 months before that deadline so you have the opportunity to log back in and keep your account.
Account deletion: you can delete your account at any time from Settings > My account > Delete my account, directly in the app. Deletion is immediate and irreversible. Your data is erased from our systems within 30 days at most. We keep no delayed backups beyond that period: after it, restoring your data is technically impossible.
Exceptions: billing data is retained for 10 years under our accounting and tax obligations, and data strictly necessary to establish, exercise or defend legal claims is retained until the applicable limitation periods expire.
11. Security
We implement technical and organisational measures appropriate to the sensitivity of the data processed:
- encryption of data in transit (TLS) and at rest;
- per-user data isolation using Row Level Security policies, ensuring a user can only access their own data and that of the partner they have explicitly linked;
- no plaintext password storage;
- restricted access to production systems, protected by multi-factor authentication;
- logging of administrative access.
In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you as soon as possible and notify the CNIL within 72 hours.
12. No automated decision-making
The cycle predictions and analyses shown in the app are based on a statistical calculation from the data you enter. They are provided for guidance only and produce no legal effect and no decision significantly affecting you within the meaning of Article 22 GDPR.
13. Your rights
You have the following rights:
- Right of access: to confirm whether your data is processed and obtain a copy;
- Right to rectification: to correct inaccurate or incomplete data;
- Right to erasure ("right to be forgotten");
- Right to restriction of processing;
- Right to data portability: to receive your data in a structured, machine-readable format;
- Right to object, in particular to processing based on our legitimate interest and, at any time and without giving a reason, to receiving satisfaction surveys;
- Right to withdraw your consent at any time, in particular for the processing of your health data;
- Right to give instructions regarding your data after your death, under Article 85 of the French Data Protection Act. Such instructions may be sent to contact@wenly.fr.
To exercise these rights: contact@wenly.fr. We may ask for proof of identity where we have reasonable doubt as to the identity of the requester. We respond within one month, extendable by two months for complex requests.
Complaints: if you believe the processing of your data infringes the GDPR, you have the right to lodge a complaint with the French data protection authority:
CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr
If you reside in another EU or EEA country, you may also lodge a complaint with your local supervisory authority.
14. Related documents
Terms of Use: https://wenly.fr/en/terms-of-use
Terms of Sale: https://wenly.fr/en/terms-of-sale
Legal information: https://wenly.fr/en/legal-informations
15. Changes to this policy
We may update this policy. Where a change is substantial, we will inform you by email and through an in-app message at least 15 days before it takes effect. The last-updated date and version number appear at the top of this document.
16. Contact
Email: contact@wenly.fr
This document is a translation of the French original. In the event of any discrepancy, the French version available at https://wenly.fr/politique-de-confidentialite shall prevail.
