Colors ClubsPrivacy Policy
Last updated: 24 September 2026
English translation, provided for convenience. The French version (Politique de confidentialité) is the only binding text. In the event of any discrepancy, the French version prevails.
This policy describes how NEXA G GROUP (“we”) collects and processes your personal data in connection with the Colors Clubs Services, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable law.
1. Controller
NEXA G GROUP (SARL with share capital of €1,000, Nanterre Trade Register 990 672 818, registered office: 32 rue de Paris, 92100 Boulogne-Billancourt, France), reachable at [email protected]. See our legal notice.
2. Data collected
- Identity & account: last name, first name, email, phone, language, country, role(s), profile photo.
- Verification (KYC) for professionals and managers: identity document, driving licence, professional card, vehicle documents, company information (registration number, certificate of incorporation, licence), IBAN.
- Location: real-time position while in use (search, ride tracking, driver going online). For professionals using the Colors Pro and Colors Pro Lite applications, and only when they declare themselves online, position continues to be recorded even when the app is closed: this is what makes it possible to send them nearby rides and to show the customer the vehicle approaching. Recording stops as soon as they go offline, and the professional may refuse or revoke it at any time in their phone settings — they then no longer receive rides while offline. No position is recorded in the background in the passenger applications or in Colors Manager.
- Addresses: pick-up and drop-off addresses and saved addresses (home, work…).
- Microphone: in Colors Clubs, Colors Clubs Signature and Colors Source, voice entry of an address uses the microphone, only when you tap the microphone button. Recognition is performed by your phone's dictation service (Apple or Google); we keep no recording.
- Transactions: rides, amounts, payment methods (handled by our providers — we do not store card numbers), Merhcure, purchases, Colors Arts.
- Content: messages, reviews, reports, exchanges with support, any photos (proof of delivery, condition reports).
- Technical: device identifiers, notification tokens, advertising identifier (see article 9), logs, connection data.
3. Purposes & legal bases
| Purpose | Legal basis |
|---|---|
| Providing the Services (matching, rides, payments, Merhcure) | Performance of the contract |
| Verification of professionals' and managers' documents, including by automated analysis (article 7) | Legal obligation (rules governing transport and the activities carried out) and legitimate interest (customer safety) |
| Location for dispatch and tracking | Performance of the contract |
| Security, fraud prevention, recovery of sums due | Legitimate interest |
| Service notifications (push, email, message) | Performance of the contract |
| Invoicing, accounting, keeping evidence | Legal obligation |
| Support (including AI-assisted replies) | Performance of the contract / legitimate interest |
| Marketing communications | Consent |
| Improvement & statistics | Legitimate interest |
| Personalised advertising and advertising identifier (optional viewing) | Consent |
4. Recipients and processors
Your data is accessible, strictly as necessary, to: our authorised teams; the club and professional involved in a ride (contact and trip data needed for the service); a professional's referring club, for the validation of their documents; and the processors below, who act on our instructions. We do not sell your data.
| Provider | Role | Data concerned | Country |
|---|---|---|---|
| Supabase | Database, authentication, file storage | All account and Services data | United States (company); cloud hosting |
| Hostinger | Application server hosting | Data passing through the API | EU (Cyprus; server in France) |
| Cloudflare | Website hosting, content delivery, protection | IP address, browsing data | United States; global network |
| Stripe | Card payments, payouts, Connect accounts | Identity, email, amounts, payment data, IBAN | Ireland; United States |
| RevenueCat | In-app purchases and subscriptions (App Store, Google Play) | Account identifier, purchase history | United States |
| NOWPayments | Cryptocurrency payments | Amount, order reference | Outside the EU |
| Regional payment providers (mobile money: Wave, M-Pesa…) | Local payments | Phone number, amount, reference | Country of payment |
| OpenAI | Automated document verification (article 7); reading vehicle registration documents and company certificates; support replies | Photos of documents (identity document, driving licence, VTC card, company certificate, vehicle registration), first and last name; messages sent to support | United States |
| Google (Gemini) | Analysis of custom part requests (Craft) | Description and photo of the part | United States |
| Mapbox | Maps, address search, route calculation | Addresses entered, positions | United States |
| OSRM (public server) | Snapping a point to the nearest road | Coordinates of a place | EU (Germany) |
| Google Firebase Cloud Messaging | Notifications on Android | Notification token, notification content | United States |
| Apple Push Notification service | Notifications on iOS | Notification token, notification content | United States |
| Expo (EAS) | Notification delivery | Notification token, notification content | United States |
| Google AdMob | Advertising (article 9) | Advertising identifier, device technical data | Ireland; United States |
| Resend (via Amazon SES) | Sending emails | Email address, message content | United States (sent from Ireland) |
| BubbleWhats | Service WhatsApp messages (orders posted on a customer's behalf) | Phone number, message content | Outside the EU |
| Aviapages | Aircraft search and flight estimates (Air flow) | Airports, dates, number of passengers — no name | Outside the EU |
| openiban.com | Checking an IBAN entered | IBAN | EU (Germany) |
| Google, Apple | Sign-in with a Google or Apple account; voice dictation | Account identifier and email; dictated voice (processed by the phone) | United States |
5. Transfers outside the EU
Several of the providers above are established, or process data, outside the European Union, notably in the United States. These transfers rely on the standard contractual clauses adopted by the European Commission, incorporated in each provider's data processing terms, and, where the provider is certified, on the EU–US Data Privacy Framework. You can obtain the up-to-date list of applicable safeguards by writing to [email protected].
6. Retention periods
| Data | Period |
|---|---|
| Account, profile, preferences, saved addresses | While the account is open; deletion processed 14 days after the request (see Delete my account) |
| Verification documents (KYC) | During the relationship, then 5 years after it ends |
| Invoices, accounting records, payment history and professionals' earnings | 10 years (accounting and tax obligations) |
| Rides and associated trips | Duration of the relationship, then 5 years as evidence; beyond that, kept without any link to your identity |
| Real-time position | Only the latest position is kept; it is replaced at each reading |
| Messages, reviews, reports, exchanges with support | Duration of the relationship, then 1 year |
| Proof of acceptance of the Terms | Duration of the relationship, then 5 years |
| Technical connection logs | 1 year |
| Advertising data | Kept by Google under its own rules; we keep none |
7. Automated document verification
Documents submitted by professionals and managers (identity document, driving licence, professional card, company certificate, vehicle documents) are first analysed by an artificial intelligence system (OpenAI), which in particular compares the name on the document with the name on the account and reads the expiry date. Depending on the confidence level of that analysis, the document is accepted, held for review by a person, or refused.
A refusal may temporarily prevent you from carrying out an activity. You may dispute any refusal and ask for it to be reviewed by a person (your referring club or the Colors team), express your point of view and submit a new document, from the application or at [email protected]. Documents are sent to OpenAI through a temporary link; under its terms applicable to the API, OpenAI does not use them to train its models.
8. Your rights
You have the rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent, as well as the right not to be subject to a decision based solely on automated processing (article 7). To exercise them: [email protected]. We reply within one month. You may lodge a complaint with the CNIL (or with the supervisory authority of your country).
Deleting your account. Deletion is requested directly from the application — My account → Settings → Delete my account — with no justification and no charge. A 14-day withdrawal period then begins: you are signed out immediately, but the request can be cancelled during that period by signing back in. The full procedure, together with what is erased and what the law requires us to keep, is set out on the Delete my account page.
9. Advertising
The Colors Clubs, Colors Pro and Colors Manager applications may display advertising supplied by Google AdMob. Viewing is optional: it is offered in exchange for Merhcure or in-game benefits, and nothing in the Services depends on it.
On that occasion, Google may read your device's advertising identifier and technical data (device type, system, approximate geographic area) to select and measure ads. We do not pass on to Google your name, your email, your number or your precise location.
Your consent. In the European Economic Area, the United Kingdom and Switzerland, the application will ask for your consent, through Google's consent message, before any personalised advertising; without that consent, only non-personalised ads will be offered to you, and you can change your choice at any time. On iOS, the advertising identifier is only accessible with your permission under Apple's App Tracking Transparency: if the application asks for it, refusing entails no loss of service. On Android, you can delete or reset your advertising identifier in the device's Google settings. The Colors Clubs Signature and Colors Pro Lite applications display no advertising.
10. Security
We implement appropriate technical and organisational measures: encryption in transit, access control (Row Level Security), separation of payment data (handled by the PSPs), and payment operations through secure server-side calls.
11. Minors
The Services are not intended for people below the required legal age. We do not knowingly collect data from unauthorised minors.
12. Cookies
The website uses cookies and trackers described in our Cookie Policy.