Enoben SARL, a company registered in France at 7 avenue de Blida, 57000 Metz, publishes the website callipeg.com (hereafter “the Site”) and develops the applications Callipeg, Callipeg Mini and Callipeg Studio (hereafter “our Applications”). Enoben is the data controller for everything described below. This policy explains what happens to your personal data when you visit our website, when you write to us, when you use our applications, and when an organization purchases volume licenses.
It does not cover what the app stores do with your data when you buy from them. Apple, Google, Microsoft, Huawei and Valve are each responsible for that, under their own privacy policies.
We display no advertising on the Site, and we build no profiles of visitors. Fonts and images come from the Site itself, so loading a page reveals your visit to nobody else. You can change your cookie choices at any time through the banner.
When you use the contact form or write to us, we receive what you choose to tell us: usually your name, email address, country and what you need help with. If you send us a log file from one of our applications, it carries technical information about the application and your device, including the folder paths of your projects. We read it only to diagnose the problem you report, and we delete it one year after you send it.
We use all of this to answer you, to handle beta-testing applications (including the Apple ID needed for a TestFlight invitation), to set up Apple School Manager access, and to discuss partnerships. The basis is our legitimate interest in replying, or pre-contractual steps if you are asking about buying. We keep it for 5 years from our last exchange.
Our Applications collect nothing. They run on your device, there is no account, and nothing you draw reaches us. If you bought from an app store, your purchase is between you and Apple, Google, Microsoft, Huawei or Valve. We never see your payment details.
The one exception is a volume-licensed Callipeg Studio, which contacts our license server. The next section explains what that involves.
The form collects your organisation's name, your name and email address, your billing address, your VAT number, an optional purchase-order reference, the seats and license type you want, and anything you write in the comments box. We use it to prepare the quote, issue the invoice and answer you. The basis is the steps taken at your request before a contract, then our legal obligation to keep accounting records.
The billing address field suggests addresses using Geoapify, a service operated by KEPTAGO LTD in Cyprus and processed entirely within the European Union. What you type there and your IP address reach them as you type, and they keep the request for no more than 24 hours, or up to two months if they suspect abuse. Typing the address by hand always works. If the quote leads to no purchase, we keep it for 3 years from our last contact.
Quotes, invoices and payment links are issued through Qonto (Olinda SAS, France), which is also our bank. We never see or store your card details. Invoices are kept for 10 years from the end of the financial year, as French law requires.
Our license manager holds your email address, the invoice number, the activation codes, the name of each terminal where a seat is active, and a log of activations and seat moves. The terminal name is the one your organisation already chose. So that one machine cannot take up two seats, the application also sends us an identifier computed from its hardware and hashed on the machine itself: we never receive the hardware fingerprint, and we do not know who is at the machine. Use a generic terminal name if you would rather it told us nothing.
It runs on a server we rent from OVHcloud in France. Seat moves are handled by us, and you can request one through the request form on your download page. We keep the record for the life of the license plus 3 years, and the logs for 1 year.
Where a longer period is set by French commercial, tax or social-security law, that law prevails.
Some data goes to the United States. Google Ireland Limited uses Google LLC there for analytics, advertising measurement and embedded video, under the European Commission's adequacy decision of 10 July 2023 for the EU–US Data Privacy Framework. Jetpack Stats sends your IP address and the page you viewed to Automattic Inc., under the European Commission's standard contractual clauses. Write to us for a copy.
The license manager's backups are kept by GitLab Inc. in the United States, under those same standard contractual clauses: they are encrypted on our server before they are sent, and GitLab cannot read them. Nothing else leaves the EU.
Access is limited to the people who need it: Enoben's management, and our accountants for accounting and payroll. Accounts are personal, with two-factor authentication where the service offers it, and everything is served over HTTPS and backed up. If a breach puts your rights at risk we will tell you and notify CNIL, as the law requires.
Under the GDPR you can ask us to:
Write to contact(@)enoben.com. We answer within one month.
We may need to check who you are before acting, so that we do not hand your data to someone else.
Some of these have limits. We cannot delete an invoice before the 10 years are up, because the law requires us to keep it.
If you are not satisfied with how we have handled your request, you can complain to the French supervisory authority:
Commission Nationale de l'Informatique et des Libertés (CNIL)If you live in another EU country, you can complain to your own national authority instead.
We update this page when we do changes, and say so when a change affects you materially: a new purpose, a new provider, a longer retention.
Last updated: 16/10/2026. Previous version: 15/04/2026.
