Privacy policy

This policy describes how OneFlash processes the personal data of people who use its self-service power bank rental services, whichever route they use: the website https://oneflash.fr and its subdomains; the mobile app (iOS and Android) and the WebApp https://oneflash.web.app; and the Stations and payment terminals installed in partner venues. Capitalised terms (Station, Payment Terminal, Deposit, Card Pre-authorisation, Personal Account, etc.) have the meaning given in OneFlash's General Terms and Conditions of Sale and Use (T&Cs).

Data controller: ONEFLASH, a simplified joint-stock company (SAS) with share capital of €8,985.40, registered with the Bobigny Trade and Companies Register under no. 853 831 246, registered office: 7 place de l'Hôtel de Ville, 93600 Aulnay-sous-Bois, France, VAT no. FR06853831246 (hereinafter “OneFlash”, “we”).

Last updated: 5 October 2026.

1. What data do we collect?
We only collect the data needed for the route you use (Art. 5 GDPR). We do not collect a password or an email address at sign-up, and never the full number or security code of your bank card.
Rental via the App: mobile phone number (identifier); one-time password (OTP) sent by SMS at each login; payment method entered in the Stripe interface, of which OneFlash only receives the last four digits and a technical identifier; rental history and satisfaction rating; notification preferences; device location, only if you allow it.
Rental via payment terminal: no direct identifying data (no name, email or phone number). OneFlash only receives the technical transaction identifier and the last four digits of the payment method; the card is processed by Stripe.
Any rental: Station and Payment Terminal logs (power bank rented, pick-up and return Stations, timestamps, duration, Card Pre-authorisation amount, amounts charged, incidents reported).
Partner venue loyalty programme (some venues, App only): sign-up or login to the programme takes place in the venue's interface, displayed within the App. The data you enter at sign-up passes through our servers to validate your membership; we only keep your member email address, linked to your Personal Account.
Customer service (email, phone, WhatsApp): contact details used to reach us, content of exchanges and attachments, identifying elements of a rental via payment terminal (date, time, location, last four digits).
Website and App: IP address, technical logs, device model and operating system, language, pages or screens viewed, cookies and trackers according to your choices (section 6).
B2B prospecting and applications: first name, last name, email, phone, company, job title, content of the form or application, sales notes.


2. For what purposes and on what legal bases?
Create and manage your Personal Account, authenticate you by SMS code: performance of a contract. Carry out the rental (unlocking, time counting, return, payment, Card Pre-authorisation, charging of the Deposit if the maximum rental period is exceeded): performance of a contract. Provide receipts, history and rental-related notifications: performance of a contract. Handle your customer service requests, complaints and, where applicable, mediation: performance of a contract; legitimate interest for requests outside the contract. Prevent fraud, secure the Services, keep proof of transactions (articles 13 and 19 of the T&Cs): legitimate interest. Show nearby Stations: consent (geolocation). Send you notifications about offers from venues where Stations are installed: consent. Validate your membership of a partner venue's loyalty programme and recognise you on later rentals, to apply the benefit reserved for its members (on behalf of the venue): performance of a contract. Produce anonymised usage statistics, some of which are shared in aggregate form with partner venues: legitimate interest. Measure Website and App audience in an exempt configuration (CNIL): legitimate interest, no consent required. Non-exempt analytics, personalisation, advertising: consent. B2B commercial prospecting: legitimate interest, with the right to object at any time. Process applications: pre-contractual measures. Comply with our accounting and tax obligations and respond to authorities: legal obligation. You may withdraw your consent at any time (section 7), without affecting processing carried out before withdrawal.


3. Recipients

Your data is only accessible to authorised OneFlash staff (operations, technical, support, sales and administrative teams), each within the scope of their role. We do not sell any personal data.
‍
Processors, acting on our instructions: Google Cloud (Firestore, Firebase) for hosting databases and application services, data in Switzerland (Zurich); Google (Firebase Authentication) for authentication, including sending the login code by SMS, data in the United States; Stripe for payment in the App and on Payment Terminals and for the Card Pre-authorisation, data in the European Union; Twilio for reminder SMS when a power bank has not been returned, data in the United States; PostHog for WebApp audience measurement, data in the European Union; Segment for mobile app audience measurement, data in the United States; Sentry for diagnosing technical errors, data in the European Union (Germany); WhatsApp (Meta) for customer support by messaging, data in the European Union; HubSpot for customer relationship management and B2B prospecting, data in the European Union. Stripe also acts as an independent data controller for its own obligations (fraud and money laundering prevention). An up-to-date list of our processors can be obtained at bonjour@oneflash.fr.
Partner venues: venues where Stations are installed receive aggregated, anonymised statistics on the use of their Stations, as well as the data you enter yourself in their interface when you join their loyalty programme or answer their satisfaction survey. The venue, identified on these screens, is the data controller for this data. To give you the benefit reserved for its members (for example free use), OneFlash acts as its processor: the data entered at sign-up passes through our servers, and we only keep your member email address, linked to your Personal Account, to recognise you on later rentals. We do not pass on any data from your OneFlash account (phone number, payment method, rental history) to the venue. No data is passed to partner venues in the case of a rental via payment terminal. Authorities: we may disclose data where required by law or to defend our rights (administrative or judicial authorities).


4. Hosting and transfers outside the European Union

Our databases (Google Cloud Firestore) and application servers are hosted by Google Cloud in Zurich (Switzerland). Switzerland is not a member of the European Union, but it benefits from a European Commission adequacy decision (Decision 2000/518/EC): its law is recognised as ensuring a level of protection equivalent to that of the GDPR, and your data may be hosted there without additional safeguards (Article 45 GDPR). Two providers process your phone number in the United States: Google's authentication service, which sends the login code by SMS, and Twilio, for reminder SMS when a power bank has not been returned. Segment, which measures mobile app audience, also processes its data in the United States. In addition, Google, Stripe, Meta, PostHog, Sentry and HubSpot belong to groups established in the United States, which may result in access from that country. These transfers are governed by the EU-US Data Privacy Framework for certified entities, failing which the European Commission's standard contractual clauses (Decision 2021/914), supplemented where necessary by additional measures, or a European Commission adequacy decision. A copy of the applicable safeguards can be obtained at bonjour@oneflash.fr.


5. Retention periods

Personal Account (phone number, preferences): for the life of the account, then 3 years after it is closed. The account is closed automatically after 365 consecutive days without use. Transaction and rental data, satisfaction rating (App and payment terminal): 13 months from the debit date (15 months for deferred-debit cards), for handling complaints and preventing fraud. Accounting records and the transaction data they contain: 10 years in archive (Article L.123-22 of the French Commercial Code). Member email address for a partner loyalty programme: for the life of the account, and at the latest until the end of our contract with the venue. Customer service exchanges: 3 years after the request is closed. B2B prospects: 3 years after the last contact. Applications: 2 years after the last contact. Technical logs: 12 months. Cookies and trackers: 13 months maximum; your choice (acceptance or refusal) is kept for 6 months. At the end of these periods, data is deleted or anonymised. Anonymised statistics can no longer identify you and may be kept indefinitely.


6. Cookies and trackers

On the Website, a consent banner lets you accept or refuse non-essential trackers. In the App, non-essential trackers are only activated with your agreement, including your device's advertising identifier (IDFA on iOS, GAID on Android). Essential: operation, security, language, session. No consent required. Exempt audience measurement: traffic statistics in a configuration compliant with CNIL recommendations. No consent required. Non-exempt audience measurement and performance: analytics and improvement tests. With consent.

Advertising: personalisation and retargeting. With consent. You can change your choices at any time via the “Cookie settings” link on the Website or in your device settings. Refusing non-essential trackers does not prevent access to the Website or rentals.


7. Your rights

Under Articles 15 to 22 of the GDPR and French Law no. 78-17 of 6 January 1978 as amended, you have the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw your consent at any time, and the right to set directives on what happens to your data after your death. How to exercise them: by email to bonjour@oneflash.fr, or by post to OneFlash, Personal Data, 7 place de l'Hôtel de Ville, 93600 Aulnay-sous-Bois, France. You can also close your account at any time from your Personal Account. Proving your identity: for a rental via the App, the phone number linked to your account; for a rental via payment terminal, the transaction details (date, time, location, last four digits of the payment method and, where applicable, bank statement), since we hold no other data about you. We reply within one month, extendable by two months for a complex request; in that case, we will tell you and give the reasons within the first month. You can lodge a complaint with the CNIL (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France).


8. Security

We apply technical and organisational measures appropriate to the risks: encryption of exchanges (TLS) between the App, the Website and our servers; passwordless authentication, by one-time code sent by SMS; no full bank card data held by OneFlash, payments being processed by Stripe, which is PCI-DSS certified; access to data limited to authorised staff; hosting with a cloud provider in Switzerland, a country recognised as adequate by the European Commission. As no system is infallible, we cannot guarantee absolute security. In the event of a data breach presenting a high risk to your rights, we will inform you in accordance with Article 34 of the GDPR.


9. Minors

The Services are reserved for people aged 16 or over. Minors aged 16 or 17 declare that they use the Services with the authorisation of their legal representative. If you find that a person under 16 has sent us data, write to us at bonjour@oneflash.fr so that we can delete it.


10. Automated decisions

Charging the Deposit when the power bank is not returned before the end of the maximum rental period is triggered automatically, based on the Station logs. This processing is necessary for the performance of the contract (Article 22.2.a GDPR). You can contest it with customer service and have your situation reviewed by a OneFlash staff member. Advertising personalisation only relies on profiling with your consent (section 6). No other decision producing legal effects or significantly affecting you is taken in a fully automated way.


11. Mandatory and optional data

For a rental via the App, the phone number and a payment method are mandatory: without them, the account cannot be created or the rental carried out. For a rental via payment terminal, only a payment method is needed. Geolocation, promotional notifications and sign-up to a partner venue's loyalty programme are optional: refusing them does not prevent the rental.
‍

12. Changes to this policy

We may amend this policy to reflect legal or technical changes or changes to our Services. The date of the last update appears at the top of the document. In the event of a substantial change, we will inform you by appropriate means (notification in the App, banner on the Website).


13. Contact

OneFlash has not appointed a data protection officer. For any question about your data, write to bonjour@oneflash.fr or to the postal address given in section 7.