Old-6 Privacy Policy
This policy explains what personal data Old-6 processes across its website, app, and store services, why we use it, how long we keep it, and how you can manage it.
1. Who we are and how to contact us
Old-6 is provided by DANDELION TECHNOLOGIE, a French simplified joint-stock company (SAS), registered under number 981 076 466 R.C.S. Paris, at 8 bis rue Abel, 75012 Paris, France.
For personal data matters and privacy requests, contact Cheng XU: xucheng@dandelion-intl.com. You may also write to the address above, marking your letter “Personal data”. For technical questions or help using the app, contact Haotian XUE: haotian.xue@dandelion-intl.com.
This policy applies to the Old-6 website, app and related services. The website primarily sells intelligent agents to businesses and professionals and handles purchasing requirements; it has no social features. The app serves consumers, among other users, and offers private messaging, business listings, subscriptions to business pages, reservations, coupons and points.
2. Data sources, categories and required information
Depending on the service you use, personal data comes from you, the relevant business or merchant, a third-party sign-in service, or organisations actually providing technical services.
| Situation | Data processed |
|---|---|
| Registration and sign-in | Registration email, phone number, password-verification and other authentication data, or account data provided through Google or Apple sign-in |
| Profile | Nickname, avatar, date of birth and gender that you choose to provide |
| Business sales and support | Contact details, purchasing requirements, correspondence and documents you voluntarily submit |
| Orders and payments | Order content, billing information, transactions and payment or refund records |
| In-app private messages | Sender and recipient identifiers, message content and related material voluntarily sent |
| Business listings and subscriptions | Company or shop information supplied by the merchant, public contact information and users’ subscription relationships |
| Reservations | Reservation name, contact phone number and optional contact email |
| Coupons and points | Recipient phone number or email, coupon content, sending time and records, and coupon or points transactions generated by your use of the relevant features |
| AI features | Text, images and business content submitted for intelligent reception, translation, menu-image processing and similar features, together with the corresponding results |
| Service operation and recommendations | Service logs and usage signals such as browsing and clicks; optional tracking and personalisation depend on the corresponding choices |
Direct email registration requires an email address and password. You may instead register and sign in with a phone number, Google account or Apple account. Nickname, avatar, date of birth and gender are optional. Third-party sign-in authenticates your account; it does not mean that third-party social content or messages are integrated, or that permission to read contacts or other resources has been granted.
A reservation name and phone number are required. You may use a nickname; your real name is not required. A contact email is optional. A reservation cannot be completed without the necessary reservation information, but omitting the reservation email does not prevent it. An account registered by phone without a linked account email can still make reservations, but currently cannot receive email notifications. Receiving those notifications requires linking an email to the account.
Only submit information about others where you have an applicable lawful basis. Providing a profile or ordering a service is not blanket authorisation to process health data or other special categories. Such processing is subject to the applicable conditions in Articles 9 and 10 of the GDPR.
3. Purposes, lawful bases and responsibilities
Each purpose and lawful basis applies separately. Accepting this policy is not authorisation for every processing activity.
| Purpose | Lawful basis and scope |
|---|---|
| Providing a quote at an individual’s request, creating their account and providing services they actively use | Necessary to enter into or perform a contract with that individual: GDPR Article 6(1)(b) |
| Providing private messaging, reservations and coupon or points services actively used by consumers | Processing objectively necessary for the relevant service: Article 6(1)(b); the merchant’s own processing follows its actual contractual relationships and responsibilities |
| Managing contacts at corporate clients and professional business relationships | Legitimate interests in providing and managing professional services: Article 6(1)(f); a corporate client’s contract is not automatically a contract with its contact person |
| Necessary security, abuse prevention, handling reports and protecting lawful rights | Legitimate interests within what is necessary and taking individuals’ rights into account: Article 6(1)(f); processing required by law relies on Article 6(1)(c) |
| Invoicing and necessary accounting records | Legal obligations: Article 6(1)(c) and applicable accounting rules |
| SMS or email marketing, terminal tracking and optional personalisation where consent is legally required | Valid consent for the specific purpose: Article 6(1)(a) and Article 7; limited marketing exceptions apply only where their conditions are met |
| Processing business data on a business client’s instructions | The client determines the purpose and lawful basis; in our role as processor, we follow documented instructions and the processing agreement: GDPR Article 28 |
We act as controller when we determine the purposes and means for our own account management, platform operation, professional client relationships and order management. Merchants are responsible for reservation and marketing purposes they determine themselves. Where we process business data solely on a business’s instructions, we act as processor for that part of the service. Roles depend on actual processing; the platform’s storage of a database does not automatically determine the legal role for every category of data. Processor arrangements do not remove either party’s applicable information, rights-cooperation or security obligations.
4. Merchant visibility and reservation notifications
Profile nicknames and avatars may be displayed to users. A merchant’s subscriber list shows only nicknames and user IDs, not account phone numbers or email addresses.
Reservation data is held centrally in the Old-6 database. The relevant shop can view the reservation name, phone number and optional email entered in your reservation form. It cannot view other shops’ reservations; bulk export is currently unavailable. The phone number is used to confirm, change or cancel the reservation. Reservation and change emails are generally sent to the app account’s registration or linked email. The optional reservation email is supplementary contact information; it does not automatically replace the account email, become linked to the account or authorise marketing.
When issuing a coupon, the merchant enters the recipient’s phone number or email itself. The platform does not display or automatically provide users’ account contact details to the merchant in that operation. The supplied details may belong to a person who is not registered with Old-6. For data obtained indirectly, you have the right to information about its source, purposes and recipients, and to exercise applicable rights. Information is provided under GDPR Article 14 within a reasonable period after obtaining the data, generally no later than one month. Where it is used to contact you or disclosed earlier to another recipient, information must be provided no later than the first corresponding communication or disclosure. Any legal exception must meet its conditions.
5. Coupons, marketing consent and stopping messages
Coupon SMS messages are sent through the Old-6 platform’s Twilio number, and emails through the platform’s email service. The platform keeps recipient details supplied by the merchant, coupon content, sending times and sending records. Those records do not necessarily prove delivery.
Sending promotional SMS or email to consumers generally requires prior consent for the relevant merchant, purpose and channel. Merchants must verify the source and authorisation of the contact details they supply. Registration, subscribing to a business page, making a reservation or providing contact details does not automatically give this consent. Manually sending to one person is also subject to marketing rules.
The existing-customer exception for similar products or services under Article L.34-5 of the French Postal and Electronic Communications Code requires the same provider, lawfully collected contact details and the relevant sale or service relationship, together with a simple opportunity to object when details are collected and with every marketing message. Creating an account or leaving reservation details does not establish the exception.
You may turn off the corresponding membership coupon-email choice, use the unsubscribe facility in marketing emails, or reply STOP to the platform’s marketing SMS messages. You may also contact xucheng@dandelion-intl.com, identifying the merchant and receiving channel, to withdraw consent or object to marketing. Stopping marketing does not require closing your account, ending your membership or cancelling a reservation.
Withdrawing consent does not affect the lawfulness of earlier processing. Objections to direct marketing and related profiling are handled under GDPR Article 21. Necessary opt-out records are used only to prevent further sends and provide the corresponding evidence, not for marketing. Necessary reservation confirmations, changes and cancellations are handled separately from promotional messages.
6. Private messages, AI and personalised recommendations
In-app private messages and related records are stored. Authorised personnel may access relevant content to the extent necessary to handle reports, abuse or security issues. This policy does not combine private messaging with authorisation for model training.
When you actively use AI features such as intelligent reception, translation or menu-image processing, necessary conversations, text, images and business data may be sent to OpenAI and orchestrated through n8n workflows. Using the service does not automatically authorise the platform to train its own models using business personal data processed on clients’ instructions. AI computation, workflows and logs are separate processing stages. A provider not using data for training does not mean that no content is retained. AI results can be inaccurate and should be checked in light of their intended use.
Personalised recommendations may use signals such as browsing and clicks to change content ordering. The recommendation setting in the app’s privacy settings controls the use of personal preferences on the ideas home page. Turning off ordering does not automatically delete earlier records or stop necessary security logs. Purposes requiring consent need a valid corresponding choice; a general service contract does not cover optional advertising profiling. Applicable objection or erasure requests can be made through our privacy contact.
7. Cookies and terminal access
Cookies, terminal identifiers and device access are processed according to their purposes. Reading or writing terminal information solely for communication, or strictly necessary for a service you expressly request, may qualify for the exceptions in Article 82 of the French Data Protection Act. Other terminal operations legally requiring consent must take place after a valid choice.
You may accept, reject or adjust optional purposes in the corresponding cookie-choice interface and withdraw consent. Acceptance and rejection must be equally simple. An operating-system permission does not automatically constitute consent to every later use. Statistics, advertising and recommendations are assessed separately; the absence of third-party cookies does not automatically remove consent requirements.
8. Recipients, providers and international transfers
Data is processed to the necessary extent by authorised personnel, the relevant merchants and technical providers actually used, including database storage, hosting, authentication, communications, payments and AI services. Services used or involved include Neon, Vercel, Google/Gmail, Apple, Stripe, OpenAI, n8n and Twilio; authentication and related technical processing also involve Clerk. Providers process data in their processor role under applicable agreements and assume the corresponding responsibilities for any purposes for which they act independently as controllers.
The Neon database configuration points to Germany. This does not mean that all technical processing is limited to Germany or the European Economic Area. Providers’ processing, support or remote access may involve locations outside the EEA.
International transfers are governed by GDPR Articles 44–49. They require an actually applicable legal arrangement, such as an adequacy decision within its scope (Article 45), or appropriate safeguards (Article 46) and necessary supplementary measures. Article 49 derogations apply only where their conditions are met. Accepting this policy is not blanket consent to international transfers. You may use our privacy contact to obtain information about specific recipients and actual transfer arrangements, and a copy of safeguards that may lawfully be provided.
Disclosure to authorised public bodies is limited to applicable legal requirements and what is necessary.
9. Retention, account closure and erasure
Retention is governed by GDPR Article 5(1)(e). Depending on the purpose, it distinguishes ordinary use, necessary restricted archiving and legally required retention. The following periods or criteria do not mean that all categories are immediately deleted when an account closes.
| Data category | Period or criterion |
|---|---|
| Account and profile | While the account service continues; after closure, only relevant data necessary for ongoing services, legal obligations or protecting lawful rights is retained |
| In-app private messages | 12 months after the last message; where necessary for a report, legal obligation or dispute, relevant data is retained with restricted access for the necessary period |
| Reservations | 18 months after the reservation ends; legally necessary dispute material or records are handled within their applicable scope |
| Coupons not purchased with points | 12 months after expiry; this period is not applied uniformly to coupons purchased with points or all statutory accounting records |
| Points and transactions relating to coupons purchased with points | While fulfilment, redemption, refunds or necessary reconciliation remain outstanding; once completed, only records necessary for legal obligations or protecting lawful rights are retained |
| Accounting documents and supporting records | 10 years under Article L.123-22 of the French Commercial Code; limited to data needed for accounting, not a basis for retaining all private messages or profiles |
| Support and purchasing contacts | For necessary handling and follow-up; afterwards, where contractual, dispute or legal evidence is needed, limited to the relevant purpose and necessary period |
| Marketing choices and opt-out data | During authorisation and the necessary evidence period; opt-out records are retained to the extent necessary to prevent renewed marketing, with restricted use |
| Security and operation logs | For necessary troubleshooting, security investigation and evidence; technical storage capability does not justify indefinite retention |
| AI business data and workflow records | For providing the feature, following business instructions or necessary security processing; on exit from a processor service, return or erasure follows the applicable order and processing agreement |
For professional clients’ business data, the 90-day period to request retrieval and necessary ordinary retention up to 180 days follow the applicable terms of sale. The 180 days are not added to the 90 days. This arrangement does not apply uniformly to all app data or remove individuals’ statutory rights.
You may request account deletion through Settings → Account and data → Account deletion. Closure involves processing the sign-in account and corresponding data, but related reservations, transactions, coupons, legally retained records, backups and provider copies are not necessarily all erased immediately. Retention must be limited to the relevant purposes, fields and necessary periods; other data is erased or effectively anonymised under applicable rules. Backups and provider copies remain within the scope of erasure cooperation and do not justify indefinite retention. A nickname or code does not automatically anonymise data.
10. Your rights and handling requests
Under GDPR Articles 15–22, subject to their applicable conditions, you may request access and a copy, rectification, erasure, restriction, objection and portability. Consent to consent-based processing may be withdrawn at any time under Article 7. You may object to direct marketing. Where a significant solely automated decision falls under Article 22, processing must comply with that Article and provide its applicable safeguards.
Submit your request through the app’s privacy-request interface or to xucheng@dandelion-intl.com. Additional information necessary to verify identity is requested only where there are reasonable doubts; a full identity document is not required from every applicant.
Under GDPR Article 12, requests receive a response without undue delay, normally within one month of receipt. Where complexity or the number of requests legally justifies an extension, it may be extended by up to two further months, with reasons given in the first month. If no action is taken, the reasons and available remedies are explained. For data we process on another controller’s instructions, we cooperate with or forward the request to that controller according to actual responsibilities, without removing our own obligations.
Under Article 85 of the French Data Protection Act, you may also give instructions about retaining, erasing or disclosing your data after your death. General acceptance of this policy does not replace such instructions.
You may complain to the competent data protection authority under GDPR Article 77. In France, that authority is the CNIL: www.cnil.fr.
11. Minors, security and policy updates
The app does not impose a blanket minimum age of 18. For consent-based processing in online services offered to minors in France, GDPR Article 8 and Article 45 of the French Data Protection Act allow individuals aged 15 or older to consent independently to that processing. Below 15, joint consent from the minor and the holder of parental responsibility is required. This is not a general age-of-majority rule for every feature and does not replace applicable protections.
Security measures must be appropriate to processing risks under GDPR Articles 25 and 32, restrict unnecessary access, and follow the notification requirements of Articles 33 and 34. This policy does not promise absolute security or unconfirmed technical certifications.
Important policy changes are communicated as appropriate to their nature. New purposes legally requiring consent need a new valid choice; continued use or a policy update does not retrospectively expand earlier authorisations.
12. Applicable legislation
This policy primarily relies on the following provisions, applied according to the processing and applicable conditions:
- General Data Protection Regulation (GDPR, Regulation (EU) 2016/679): Articles 5, 6, 7 and 8 (principles, lawful bases and consent); 12–14 (information); 15–22 (individual rights); 25, 28 and 32–34 (protection, processors and security); 44–49 (international transfers); 77 (complaints). Official provisions
- French Data Protection Act (Loi Informatique et Libertés, Law no. 78-17 of 6 January 1978): Articles 45 (minors’ consent), 82 (terminal reading and writing) and 85 (instructions after death). Official presentation of the provisions
- French Postal and Electronic Communications Code: Article L.34-5 (electronic marketing consent, limited exceptions, sender identification and stopping messages). Official provision
- French Commercial Code: Article L.123-22 (retention of accounting documents and supporting records). Official provision
References to legislation explain the corresponding rights and processing rules. They do not replace information about specific purposes or authorise every use of data.