Privacy
policy
Who we are
INCANTIX SARLU is a company under Ivorian law (RCCM CI-ABJ-03-2026-B13-05684, IDU CI-2026-0060363 N), headquartered at Abidjan, Treichville, Avenue 21, Rue 39B, Lot 590, Section DL, Côte d'Ivoire.
Incantix designs, develops and operates a portfolio of digital solutions.
For the purposes of this policy, Incantix acts as the data controller of personal data collected through all of these services.
Applicable legal framework
This policy is drafted in compliance with:
- —Law No. 2013-450 of 19 June 2013 on the protection of personal data in the Republic of Côte d'Ivoire and its implementing decrees.
- —The Telecommunications/ICT Regulatory Authority of Côte d'Ivoire (ARTCI), competent supervisory authority.
- —The fundamental principles of the General Data Protection Regulation (GDPR — EU 2016/679), applied as a best-practice reference for users in the European Economic Area.
- —The revised Bangui Agreement of OAPI regarding intellectual property linked to processing.
Data collected and purposes
3.1 — Data common to all services
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Identification | Last name, first name, email address | Creation and management of the user account | Performance of the contract |
| Authentication | Password hash, JWT tokens | Securing access | Legitimate interest |
| Technical | IP address, connection logs, device type | Security, fraud detection, debugging | Legitimate interest |
| Communication | History of exchanges with support | Handling requests | Performance of the contract |
3.2 — PrintXpress · printpolaroids.ci
PrintXpress does not require account creation. The data collected is limited to what is strictly necessary to fulfill the order.
| Category | Data | Purpose | Retention |
|---|---|---|---|
| Order | Uploaded files, format options, quantity | Production and delivery of the order | Order duration + 1 year (accounting obligations) |
| Delivery | Postal address, phone number | Physical shipment of the product | Order duration + 1 year |
| Payment | CinetPay / mobile money transaction reference | Proof of payment, refunds | 5 years (OHADA tax obligations) |
Image files uploaded for printing are deleted from our servers within 30 days after order completion.
3.3 — Photo Boutik · Mobile application
| Category | Data | Purpose | Retention |
|---|---|---|---|
| Account | Email, first name | Account management and personalization | Account duration + 3 years |
| AI creations | Images generated by the user | Display in the personal gallery | Until deleted by the user |
| Credits | History of credit purchases and consumption | Billing, support | 5 years (tax obligations) |
| Payment | Stripe / CinetPay transaction reference | Billing | 5 years |
Images generated via AI models remain the exclusive property of the user. They are not used to train our models nor shared with third parties.
3.4 — Vique · vique.net
| Profile | Data | Purpose | Retention |
|---|---|---|---|
| Buyer | Email, order history, address | Order and customer service management | Account duration + 3 years |
| Seller | Email, RCCM/NIF, bank details, profile photo, store description | Verification, commission payments, public display | Account duration + 5 years |
| Common | Ratings and reviews | Improving trust on the platform | Account duration |
Seller identity information (ID, RCCM) collected during store verification is stored securely and is never publicly displayed.
3.5 — Connect2Card · connect2card.com
| Category | Data | Purpose | Retention |
|---|---|---|---|
| NFC card profile | Name, title, phone, email, social networks, photo | Display on the digital business card shared via NFC | Account duration |
| Statistics | Number of shares, anonymous NFC scans | User analytics dashboard | 12 rolling months |
NFC profile information is by nature intended to be shared. The user is solely responsible for what they choose to include.
3.6 — INR+ · Medical mobile application
INR+ processes health data, a particularly sensitive category under Law No. 2013-450. Reinforced security measures apply (see section 06).
| Category | Data | Purpose | Retention |
|---|---|---|---|
| Identity | First name, date of birth, sex | Clinical personalization and dosage calculations | Account duration |
| Medical | INR values, prescribed anticoagulant (VKA/DOAC), dose, therapeutic target | Treatment monitoring, recommendation algorithm (Rosendaal TTR) | Account duration + 5 years (medical archiving) |
| Follow-up | Measurement history, appointments, biological results | Follow-up charts, sharing with physician | Account duration + 5 years |
| Practitioner | Name of referring physician (optional) | Coordination of care | Account duration |
INR+ is a follow-up support tool and is not a certified medical device. Any therapeutic decision is the exclusive responsibility of the treating physician. Incantix shall not be held liable for medical decisions made solely on the basis of the application's recommendations.
As part of the partnership with the Cardiology Institute of Abidjan (ICA), aggregated and anonymized data may be shared for clinical research purposes, exclusively with the user's explicit consent.
3.7 — ImmoAfrik
| Profile | Data | Purpose | Retention |
|---|---|---|---|
| Individual | Email, saved searches, favorites | Personalization, real estate alerts | Account duration |
| Agent / Developer | Email, photo, agency name, license number, listings | Public display of listings, premium subscription | Account duration + 3 years |
| Listings | Property photos, descriptions, prices, location | Publication and indexing | Duration of active listing |
Retention periods
| Data type | Duration |
|---|---|
| Active account data | Account duration |
| Deleted account data | 30 days (then permanent deletion) |
| Connection and security logs | 12 months |
| Transaction data and invoices | 5 years (OHADA / tax obligations) |
| INR+ medical data | 5 years after last access |
| PrintXpress print files | 30 days post-order |
| Customer support data | 3 years after ticket closure |
Data security
Incantix implements the following technical and organizational measures:
- →Encryption in transit — TLS 1.3 on all client-server communications.
- →Encryption at rest — sensitive data (INR+ medical data, tokens) is encrypted in the database using AES-256-GCM.
- →Mobile secure storage — authentication tokens are stored in iOS Keychain / Android Keystore.
- →Least-privilege access — each service only accesses the data strictly necessary for its operation.
- →Isolated infrastructure — each product is deployed in an isolated Docker environment, behind a secure reverse proxy (Traefik) with automatic SSL certificates.
- →Encrypted backups — database backups are encrypted and kept in redundant geographic zones.
- →Secure CI/CD — deployments go through GitHub Actions with encrypted secrets; no API key is present in the source code.
In the event of a data breach likely to result in a risk to the rights and freedoms of users, Incantix is committed to notifying ARTCI and the users concerned as soon as possible in accordance with the law.
User rights
In accordance with Law No. 2013-450 and the GDPR, every user has the following rights:
| Right | Description | How to exercise |
|---|---|---|
| Access | Obtain a copy of all your personal data | Email privacy@incantix.net |
| Rectification | Correct inaccurate or incomplete data | From account settings or by email |
| Deletion | Request the erasure of your data | Email privacy@incantix.net |
| Portability | Receive your data in a structured format (JSON/CSV) | Email privacy@incantix.net |
| Objection | Object to processing based on legitimate interest | Email privacy@incantix.net |
| Restriction | Request the suspension of processing during a review | Email privacy@incantix.net |
Incantix is committed to responding to any request within a maximum of 30 days. For complex requests, this period may be extended by an additional 30 days with prior notice.
Our services are not intended for persons under 16. If you become aware that a minor has shared data with us without parental consent, contact us immediately at privacy@incantix.net.
International data transfers
Some data is processed by providers located outside Côte d'Ivoire (notably AWS and Stripe in the United States). These transfers are governed by appropriate safeguards: standard contractual clauses, ISO 27001 and PCI-DSS certifications. Incantix ensures that the level of data protection remains equivalent to that guaranteed by Ivorian law.
Changes to this policy
Incantix reserves the right to modify this policy at any time to reflect the evolution of its services or of the applicable legal framework.
- —Substantial changes will be notified by email to users with an active account.
- —The “Last update” date in the header will always be refreshed.
- —Continued use of the services after notification constitutes acceptance of the new policy.
Contact & complaints
- DPO (Data Protection Officer)
- privacy@incantix.net
- Product support
- support@incantix.net
- Postal address
- INCANTIX SARLU — DPO, Abidjan, Treichville, Avenue 21, Rue 39B, Lot 590, Section DL, Côte d'Ivoire
If you believe your rights are not being respected, you may file a complaint with ARTCI (the Telecommunications/ICT Regulatory Authority of Côte d'Ivoire):
www.artci.ci