Privacy Policy — Atoseho
Effective date: 15 September 2026 Last updated: 15 September 2026
Working draft aligned to Loi n°2014-038 (not a lawyer opinion). Built around Madagascar’s personal data law (Loi n°2014-038) and public summaries of practice. Have a Madagascar lawyer review when you can — especially CMIL formalities, cross-border transfers to Lemon Squeezy/hosting, and cookie consent UX.
1. Data controller
Controller (responsable du traitement): Atoseho Email: [email protected] Postal / registered address: SAT 91 ter B Soamanandray Ivato Company / registration: Individual company (entreprise individuelle), registration no. 5011966824, registered in Ambositra
This Privacy Policy explains how we collect, use, and share personal data when you use atoseho.com (the “Service”).
Under Loi n°2014-038, a personal data item is any information relating to an identified or identifiable natural person (for example a WhatsApp number, photo of a person, or IP address).
2. What the Service does
Atoseho is a Madagascar discovery board. Listings may include public contact details (such as WhatsApp), photos, and logos. Optional Ranked placement is paid through Lemon Squeezy.
We do not currently run a classic user account system (no email/password profiles) for the baseline described here.
3. What we collect
3.1 WhatsApp numbers and listing contact details
If you submit a listing, you may provide a WhatsApp number and other contact fields. Those fields are shown publicly on the listing so visitors can contact you.
3.2 Photos and logos
Listing owners may upload photos and logos. They are stored and displayed with the listing. Avoid uploading images of other people without their permission.
3.3 Payment-related data
Ranked purchases are processed by Lemon Squeezy. Lemon Squeezy handles payment credentials under its own policy. We typically receive purchase confirmation, what was bought, and related billing metadata — not your full card number.
3.4 Usage and device data
When you visit the Service, we and our providers may collect:
- IP address and approximate location derived from it
- Browser, device, and OS information
- Pages viewed, referrers, and timestamps
- Cookies or similar technologies (see Section 8)
3.5 Messages you send us
If you email [email protected], we receive your email address and message content.
3.6 Sensitive data
We do not intentionally collect “sensitive” data as defined in Loi n°2014-038 (for example racial origin, biometrics, health, or sexual life). Please do not put such data in listings or emails to us.
4. Why we process data (purposes) and legal bases
Under Article 17 of Loi n°2014-038, processing needs consent or another listed basis. We rely on:
| Purpose | Examples of data | Main legal basis |
|---|---|---|
| Publish listings you submit | WhatsApp, photos, logos, listing text | Consent (you choose to publish) and/or contract / pre-contract steps you request |
| Provide Ranked placement and related billing records | Purchase metadata | Contract (purchase of Ranked) |
| Operate, secure, and debug the Service | Usage/device logs | Legitimate interest in a secure, working site, balanced against your rights |
| Analytics to understand traffic (if enabled) | Usage/device, cookies | Consent where required for non-essential cookies / terminal access (Art. 27), otherwise limited legitimate interest for strictly necessary technical measures |
| Answer your emails | Email content | Contract / pre-contract or legitimate interest in responding |
| Comply with law / defend rights | Relevant records | Legal obligation or legitimate interest in legal defense |
We process data fairly, for stated purposes, only as needed, keep it reasonably accurate, and do not keep it longer than needed (Art. 14 principles).
5. Who receives data
We may share data with:
- The public, for fields you publish on a listing (WhatsApp, photos, logos, public listing text)
- Lemon Squeezy, to process payments (processor / sous-traitant for payment)
- Hosting, security, and analytics providers that help run the Service (sous-traitants acting on our instructions)
- Authorities, when required by law or to protect rights and safety
- A successor, if Atoseho is transferred (with notice where required)
We do not sell personal data as a standalone product. Public listing fields are visible by design.
Sous-traitants should only process data on our instructions and with appropriate security (Art. 16).
6. Transfers outside Madagascar
Hosting, Lemon Squeezy, and some tools may process data outside Madagascar.
Under Article 20 of Loi n°2014-038, transfers abroad should go to a country with similar protection, or use another allowed path (for example your informed consent, or necessity for a contract you requested — such as paying for Ranked via Lemon Squeezy).
By publishing a listing or buying Ranked, you understand that the providers needed for that action may process related data outside Madagascar. We will use available contractual/security measures with providers where practical.
7. How long we keep data
| Data | Typical retention |
|---|---|
| Active listing content | While the listing is live |
| Removed listings | Reasonable period for backup, disputes, security, then delete or anonymize |
| Purchase / billing metadata | As needed for accounting and legal obligations |
| Usage logs | Limited period unless needed longer for security or legal reasons |
| Support emails | As long as needed to resolve the request, then routine deletion |
Exact periods may be refined as Atoseho grows; we will update this policy when they change.
8. Cookies and terminal access
Article 27 of Loi n°2014-038 requires clear information when we access or store information on your device, and a way to object — except for access that is strictly necessary to provide an online service you requested, or solely to enable electronic communication.
- Strictly necessary cookies/storage: may be used for basic site function and security.
- Analytics or non-essential cookies: we will inform you and, where required, obtain consent before setting them, and offer a way to refuse.
You can also control cookies in your browser. Blocking some cookies may affect the Service.
9. Security
We take reasonable technical and organizational measures to protect personal data against unauthorized access, loss, or alteration (Art. 15). No method is 100% secure.
10. Your rights (Loi n°2014-038)
Subject to the law’s conditions, you may:
- Object to processing for a legitimate reason; object to prospecting without needing a reason (Art. 22)
- Access your data and related information (Art. 23)
- Rectify, complete, lock, or erase inaccurate or unlawful data (Art. 25)
- Be informed about processing (this policy + collection notices) (Art. 27)
How to exercise: email [email protected] with enough detail to identify you and the listing/data concerned. Access requests should be free of charge except for manifestly abusive repeated requests (Art. 24).
Public listings: if your WhatsApp number was public, others may have copied it; we can remove it from Atoseho, but we cannot control third-party copies.
You may also contact the Commission Malagasy de l’Informatique et des Libertés (CMIL) when it is operational for complaints or guidance.
11. CMIL formalities (important operational note)
Loi n°2014-038 generally requires prior formalities with the CMIL for personal-data processing (declaration and/or other steps), and contemplates a data protection delegate and an internal register of processing.
Public commentary notes that implementing decrees / CMIL operations have historically been incomplete. That does not cancel the principles in the law (fairness, purpose, security, rights, transfers).
Practical stance for Atoseho: we aim to follow the law’s principles now; when CMIL filing channels are clearly available, we should complete required declarations (or appoint a delegate / keep a register as the law allows). This is an operator to-do, not something visitors must do.
12. Children
The Service is not directed at children. We do not knowingly collect children’s personal data. Contact us if you believe we have such data.
13. Third parties and WhatsApp
WhatsApp and other third-party tools have their own privacy policies. Once you leave Atoseho or open WhatsApp, those rules apply to that conversation.
14. Changes
We may update this Privacy Policy. We will post the new version on atoseho.com and update the date. Material changes will get extra notice where required.
15. Contact
Privacy questions and rights requests: [email protected]
End of Privacy Policy — revised working draft.