This Privacy Policy explains what personal data BPA SOLUTIONS collects through the Introscape iOS app (including its widget and Apple Watch app), the Safety Share tracking page and the introscape.app website, why we use it, who receives it, how long we keep it, and how you can exercise your rights.
Last updated: October 8, 2026
Effective date: October 8, 2026
At a glance
- ✓We never sell your personal data, and there are no ads in the app.
- ✓Introscape has no user accounts: we identify you with a random app user ID, not your name or email.
- ✓Your location is collected only while a Safety Share is active, and each share is deleted 30 days after it ends.
- ✓Custom audio, your caller list and your settings stay on your iPhone. A fake call never goes over the phone network: no number is dialed and nothing appears on your phone bill.
- ✓Product analytics run on servers we operate in Germany, without storing IP addresses.
- ✓Your advertising identifier (IDFA) is used only if you allow tracking in the iOS prompt.
Who Is Responsible for Your Data
The data controller for Introscape is:
Information We Collect
Data you enter
- •Safety Share: the first name you want your contact to see, and your trusted contact's name and mobile phone number. You pick the contact with the iOS contact picker; we never access the rest of your address book.
- •AI scripts: the scenario you describe, the language and the voice you choose.
- •Scheduled calls: the caller name and number you choose for a fake call, and when it should ring. This data is pseudonymized (linked only to a random device identifier) and deleted once the call has rung.
- •Support: your email address and message if you contact us.
Safety Share location data (only while a share is active)
- •Precise location (latitude, longitude, accuracy, altitude, speed), sent about every 30 seconds
- •Battery level and charging state
- •Time of each update, share start and end time, duration, and the language of the SMS
Data collected automatically
- •A random app user ID created by RevenueCat (shown as your Support ID in Settings)
- •Device and app information: device model, iOS version, app version, language and time zone
- •Push notification tokens, so we can deliver notifications and scheduled calls
- •How you use the app: screens viewed, features used, calls scheduled or triggered, paywall views and purchases
- •Your approximate country, derived from your IP address when analytics events reach our servers (the IP address itself is not stored)
- •Your advertising identifier (IDFA), only if you allow tracking in the iOS App Tracking Transparency prompt
- •Crash reports and diagnostics from Apple, only if you chose to share analytics with app developers in iOS Settings
Purchases
- •Product, price, currency, storefront country, transaction identifiers and subscription status, received from Apple through RevenueCat. Apple processes payments; we never see your card or Apple Account details.
- •Your credit balance, Safety Share usage and referral codes and rewards
- •Whether you installed the app from an Apple Search Ads campaign (campaign and keyword), provided by Apple's AdServices framework
Data that stays on your device
- •Custom audio, your caller list, settings, Siri Shortcuts and AI-generated call audio are stored on your iPhone. We don't keep copies on our servers. When you schedule a call, only that call's caller name and number are sent to our server so it can ring your phone at the right time.
People who open a Safety Share link
- •Our server uses the visitor's IP address for a few minutes to prevent abuse (rate limiting). The map provider (Mapbox) receives it to load map tiles. The page uses no cookies.
How We Use Your Data and Why
Provide the app
Fake and scheduled calls, AI scripts and voices, widgets, purchases, credits and referral rewards.
Data: App user ID, device information, push tokens, scheduled-call details, AI scenario text, purchase data
Legal basis: Performance of our contract with you (Art. 6(1)(b) GDPR)
Safety Share
Send the SMS to your trusted contact and show them your live location during the share.
Data: First name, trusted contact's name and phone number, precise location, battery level
Legal basis: Performance of our contract with you (Art. 6(1)(b) GDPR). Access to your device's location relies on your consent through the iOS permission, which you can withdraw at any time in iOS Settings.
Notifications
Scheduled-call alerts, reminders and occasional news about the app.
Data: Push token, language, time zone (so we don't send notifications at night)
Legal basis: Your consent through the iOS notification permission (Art. 6(1)(a) GDPR)
Product analytics and improvement
Understand how the app is used so we can fix bugs and improve features.
Data: App user ID, device information, in-app events, approximate country
Legal basis: Our legitimate interest in improving the app (Art. 6(1)(f) GDPR). You can object at any time.
Advertising measurement
Measure which of our ad campaigns (TikTok, Apple Search Ads) lead to installs and purchases.
Data: SDK identifier, device information, in-app and purchase events, hashed app user ID; IDFA only with your permission
Legal basis: Your consent for access to your advertising identifier (iOS tracking prompt, Art. 6(1)(a) GDPR); otherwise our legitimate interest in measuring our advertising (Art. 6(1)(f) GDPR). You can object at any time.
Security and abuse prevention
Rate limiting, preventing SMS abuse and fraud, keeping our services running.
Data: IP address (kept briefly), app user ID, request logs
Legal basis: Our legitimate interest in protecting our users and services (Art. 6(1)(f) GDPR)
Support
Answer your questions and requests.
Data: Email address, message content, Support ID
Legal basis: Performance of our contract with you, or our legitimate interest in answering you (Art. 6(1)(b) and (f) GDPR)
Legal obligations
Keep accounting records and respond to lawful requests from authorities.
Data: Purchase records, and any data a lawful request covers
Legal basis: Compliance with our legal obligations (Art. 6(1)(c) GDPR)
Analytics and Advertising Measurement
Product analytics (self-hosted)
- •We use a PostHog-compatible analytics service that we host ourselves on servers in Germany (hosting provider: Hetzner Online GmbH). Analytics data isn't shared with PostHog Inc. or any other third party.
- •Events are linked to your random app user ID, never to your name, email or phone number.
- •Our server derives your approximate country from your IP address and then discards the IP address. It isn't stored.
- •The analytics SDK supports screen recordings of app sessions ("session replay"). This feature is turned off. If we turn it on, text you type and images will be masked, and we'll update this policy first.
Advertising measurement (TikTok) and App Tracking Transparency
- •We advertise Introscape on TikTok and use the TikTok Business SDK to measure which ads lead to installs and purchases. We don't show ads in the app.
- •The SDK sends TikTok device and app information (such as device model, iOS version, language, time zone and IP address), an identifier generated by the SDK, a hashed version of your app user ID, and in-app events such as app install, app launch, onboarding completed, paywall viewed, call scheduled or triggered, and purchases. If the SDK itself crashes, it may also send TikTok a technical crash report.
- •Your advertising identifier (IDFA) is accessed only if you tap "Allow" in the iOS App Tracking Transparency prompt. You can change this at any time in Settings > Privacy & Security > Tracking.
- •From app version 2.3.4, the app declares TikTok's measurement domain to Apple as a tracking domain, so on supported iOS versions the app can't connect to it unless you allow tracking.
- •When you start a trial or make a purchase, our server also sends TikTok the event (type, product, price and currency) with a hashed version of your app user ID, so purchases can be attributed to ad campaigns.
- •Apple's SKAdNetwork and AdServices frameworks give us aggregated attribution data (for example, which campaign led to an install) without identifying you.
- •TikTok may act as a joint or independent controller for some of this processing. See TikTok's privacy policy for how it uses this data.
Who Receives Your Data
We share personal data only with the recipients below, and only what each one needs. Service providers process it on our behalf under contracts that require them to protect it.
⚠️ We NEVER sell your data to third parties
International Data Transfers
Some of these providers are located in, or access data from, countries outside the European Economic Area, mainly the United States.
When that happens, we rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework for certified providers, or on the European Commission's Standard Contractual Clauses, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
Data on the analytics servers we operate stays in Germany.
How Long We Keep Your Data
Safety Share data
Share record (your first name, your contact's name and phone number), location points and battery level: deleted automatically 30 days after the share's scheduled end. The tracking link stops showing your location as soon as the share ends.
Safety Share SMS
Message records at Twilio are kept only as long as needed to deliver, bill and secure the service.
Push tokens and device settings
As long as the app is installed. Tokens that Apple reports as invalid are deleted after 90 days.
Scheduled calls
Until the call is delivered. Cancellation records are deleted after 7 days.
Product analytics
25 months after the event, then deleted.
AI script requests
Not stored on our servers once your script or audio is returned; we keep only a usage counter (voice used and script length). Our AI providers keep request data only as long as their API data policies allow.
Purchases, credits and referrals
As long as you use the app, then as long as needed to meet legal obligations and handle disputes.
Abuse prevention
IP addresses used for rate limiting: less than 24 hours. Server logs: up to 7 days.
Support emails
24 months after your last message.
Data on your device
Until you delete it or uninstall the app.
Your Privacy Rights
Under the GDPR and other applicable privacy laws, you have the following rights:
🔍 Right of access
Get a copy of the personal data we hold about you.
✏️ Right to rectification
Have inaccurate or incomplete data corrected.
🗑️ Right to erasure
Have your personal data deleted ("right to be forgotten").
⏸️ Right to restriction
Ask us to limit how we use your data.
📦 Right to data portability
Receive the data you gave us in a structured, machine-readable format.
🚫 Right to object
Object to processing based on our legitimate interests, including analytics and advertising measurement.
↩️ Right to withdraw consent
Withdraw consent at any time (location, notifications, tracking), without affecting earlier processing.
⚖️ Right to complain
Lodge a complaint with the CNIL or the data protection authority where you live or work.
How to Exercise Your Rights
Email us at [email protected]. Because Introscape has no accounts, please include your Support ID (Settings in the app) or, for Safety Share data, the trusted contact's phone number and the approximate date. We reply within one month; for complex requests this can be extended by two more months, and we'll tell you if so.
Controls You Can Use Right Away
- • Stop a Safety Share at any time from the in-app banner. Turn Safety Share off or remove your trusted contact in its settings.
- • Location: Settings > Introscape > Location (Never, While Using the App, or Always).
- • Tracking: Settings > Privacy & Security > Tracking.
- • Notifications: Settings > Notifications > Introscape.
- • Deleting the app removes all data stored on your iPhone.
California Privacy Rights (CCPA)
If you are a California resident, you also have these rights:
Right to know and access
Know which categories of personal information we collect, use and disclose (described in this policy), and get a copy.
Right to delete and correct
Ask us to delete or correct your personal information, with certain legal exceptions.
Right to opt out of sale or sharing
We don't sell personal information. Sending app events and identifiers to TikTok for ad measurement may count as "sharing" for cross-context behavioral advertising under California law. You can opt out by not allowing tracking in iOS and by emailing [email protected].
Sensitive personal information
We use precise geolocation only to provide Safety Share, which you request.
Right to non-discrimination
We won't treat you differently for exercising your privacy rights.
Children's Privacy
Introscape is not directed at children. You must be at least 13 years old to use the app. If you are under the age at which you can consent to data processing on your own in your country (for example 15 in France, or 16 in some EU countries), please use Introscape with a parent's or guardian's permission. We don't knowingly collect personal data from children under 13; if we learn that we have, we'll delete it. Parents can contact us at [email protected].
Age rating: 4+ on the App Store (content rating). Minimum age to use Introscape: 13.
Cookies and Similar Technologies
In the app
The app doesn't use browser cookies. It stores your settings on your device and uses the identifiers described above: your random app user ID, push tokens, and your advertising identifier only with your permission.
On introscape.app
Our website doesn't set advertising or tracking cookies. We count visits with Plausible Analytics, self-hosted on our own servers in Germany; it works without cookies and doesn't store IP addresses or build profiles. We also collect anonymous page-speed measurements.
Safety Share tracking page
No cookies. Like the rest of the website, it uses cookieless visit statistics. The map is loaded from Mapbox.
Security Measures
We use technical and organizational measures to protect your data, including:
- ✓Encrypted connections (HTTPS/TLS) for all data in transit
- ✓Rate limiting and abuse protection on our backend
- ✓Random identifiers instead of names or email addresses
- ✓Tracking pages show only your first name, location and battery level, never your contact's details
- ✓Automatic deletion of Safety Share data 30 days after each share
- ✓Analytics on servers we operate, without IP addresses
- ✓Payments handled by Apple: we never see card details
- ✓Access to production systems limited to the people who need it
Contact and Complaints
📧 Privacy Contact
We have not appointed a Data Protection Officer because we are not required to. Privacy requests are handled directly by the company's management.
⚖️ Supervisory Authority
You can also contact the data protection authority where you live or work.
Changes to This Policy
We may update this policy when the app, our providers or the law change. We'll update the "Last updated" date above and, for significant changes, tell you in the app before they take effect.
Current version: 2.0 - Last updated: October 8, 2026
Questions about this Privacy Policy?
Contact Us