Last updated: 9 September 2026.
Your data does not leave your phone unless you decide to send it. ClicInSitu works without any user account and without any publisher server: photos, voice memos, files, entered data and settings are stored locally on your device, and transmitted only to the recipients you have configured yourself (your email addresses, your outgoing mail server, your automation address). The publisher collects no personal data through the application: no advertising, no trackers, no usage statistics, no third-party SDKs.
The ClicInSitu application is published by MVT CONSEIL, a SARL (French limited liability company) registered with the Paris Trade and Companies Register (RCS) under no. 514 535 152, Bureau 326, 59 rue de Ponthieu, 75008 Paris, France. Data protection contact: privacy@clicinsitu.fr.
All the data below is created by you and stored only on your device:
— Photos taken with the camera or imported from the gallery, together with their metadata (date, GPS position if you enable it);
— Audio recordings (voice memos);
— Files imported from the file picker;
— Data entered in the fields of your templates (text, long text, numeric values, amounts, lists, multiple choices, ratings, date, time, Yes/No, telephone, scanned codes, email addresses);
— Settings: recipients, email templates, sending configuration (credentials and secrets — SMTP password, tokens — are stored encrypted on the device);
— where applicable, a log of sent items kept locally.
The application creates no account, synchronises nothing to any publisher cloud and sends no data to MVT Conseil.
Only when you trigger a send, and only to the configured recipients:
— sending by email: through your phone’s email application, or through the outgoing mail server (SMTP) you have set up, or through a Google (Gmail) or Microsoft (Microsoft 365 / Outlook) account that you connect by secure authorisation (OAuth — see section 4 bis) — the transmission is then governed by your email provider, and the connection is established directly between the application and your provider, without passing through the publisher;
— sending to an automation address (webhook): to the server that you (or your organisation) have designated, over HTTPS; when offline, the send is kept on the device and delivered once the connection is restored;
— sharing through another application of your choice (Android share function).
Once delivered to the recipient, the content falls under the responsibility of that recipient (your organisation, your customer, your own system).
If you choose to send your emails from your own Google (Gmail) or Microsoft (Microsoft 365 / Outlook) account, you connect that account through a secure authorisation (OAuth) granted directly with Google or Microsoft: your password is never disclosed to the application or to the publisher.
For Google, the application requests only the sending permission (“gmail.send” scope): it can send, when you trigger it, a message from your Gmail address; it can neither read, browse nor delete the contents of your mailbox. In practical terms:
— access: the authorisation token issued by your provider is stored encrypted on your device; the connection is established directly between the application and the provider’s servers (Google or Microsoft), without passing through the publisher;
— use: this token is used exclusively to send the messages you trigger, to the recipients you have configured;
— storage: no data from your account is stored anywhere other than on your device; the publisher holds no copy of it;
— sharing: no data from your account is transmitted to third parties; your messages go from your account to your recipients, like an email you would send yourself.
You can revoke this authorisation at any time: by disconnecting the account in the application’s settings, or from the security settings of your Google account (myaccount.google.com/permissions) or Microsoft account (account.microsoft.com). Revocation makes the token immediately unusable.
For more information on how these providers process your data, see the privacy policy of Google (policies.google.com/privacy) or of Microsoft (privacy.microsoft.com/fr-fr/privacystatement).
The use of information received from Google APIs is further subject to Google’s user data policy. Compliance statement (official wording, in English): “The use of information received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements” (developers.google.com/terms/api-services-user-data-policy). In English: the use of information received from Google Workspace APIs complies with Google’s API Services User Data Policy, including its Limited Use requirements. In particular, this information is never sold, is never used for advertising purposes or for assessing creditworthiness, is not read by humans (except at your request, under a legal obligation or for security reasons), and is never used to train artificial intelligence models. Google and Microsoft, as United States companies, also adhere to the EU-US Data Privacy Framework, recognised as adequate by the European Commission, which governs the transfer of the corresponding data to the United States.
For the data you process with the application (content, recipients, sends, including through a connected Google or Microsoft account), you — or your organisation — are the data controller; MVT Conseil, which has access neither to any of this data nor to the authorisation tokens, which remain stored encrypted on your device, is neither a controller nor a processor.
MVT Conseil does, however, process data as a controller outside the application when you contact it (support, complaints: email address, content of the exchange — on the basis of its legitimate interest in following up the business relationship, retained for 3 years from your last active contact in connection with the request, after which the data is deleted or anonymised in the absence of any further exchange) or when you are a direct customer (sales management and invoicing, on the basis of the performance of the contract and, for accounting obligations, of a legal obligation — statutory retention periods).
| Permission | Why | Required? |
|---|---|---|
| Camera | Take photos from within the application | Yes for capture; importing from the gallery remains possible |
| Microphone | Record voice memos | No — only if you use audio |
| Location | Write the GPS position into the photos’ metadata | No — can be enabled per use case |
| Network | Send your content to the recipients you have configured | Yes for sending |
| Storage / media | Import files from the phone’s storage and photos from the gallery; save content | Depending on use |
The application requests no permission to read contacts, SMS messages or call history.
The authorisation to send through your Google or Microsoft account (OAuth) is separate from the Android permissions above and is covered in section 4 bis.
You control retention: the retention period for photos and content in the application is configurable, and you can delete any content or template at any time. Uninstalling the application deletes the data it stores on the device. As MVT Conseil holds no copy, there is no retention on the publisher’s side.
For data stored on your device, you exercise your rights directly (viewing, deletion, JSON export of settings). For content already sent, contact the recipient of the send (for example your organisation), which is the controller for it. For data held by MVT Conseil as a controller (contacts, direct customers), you have the rights of access, rectification, erasure, restriction, objection and portability, to be exercised by writing to privacy@clicinsitu.fr. You may lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
Configuration secrets (SMTP credentials, automation tokens) are stored encrypted on the device; sends to automation addresses use HTTPS with a device-specific token and an integrity signature (HMAC). The security of the device itself (screen lock, Android encryption, updates) is the responsibility of the user or their organisation. To report a vulnerability: security@clicinsitu.fr.
The application is a productivity tool intended for a professional, adult audience; it is not aimed at children and contains no mechanism for collecting data about them.
Any change to this policy will be published at the same address with a new update date; in the event of a substantial change (for example the addition of a network flow), notice will also be given in the application’s release notes.
See also: Legal notice Terms of use