Privacy Policy

The data controller is François Duprat, Single-member simplified joint-stock company (SASU) under French law, trading as Mobile FIRST, 93 boulevard Voltaire, 75011 Paris, France (SIREN 943537662).

Contact for any question about your data: support@webmobilefirst.com or our contact form.

To simulate a device, the Extension must be able to run on any tab. It therefore technically has access to the pages you open. We commit that:

• the content of simulated pages (texts, forms, passwords, website cookies, your clients' data) is never read, stored or sent to our servers;
• the history of the addresses you visit is not collected;
• screenshots are generated and saved locally, on your computer;
• videos are recorded locally, and are only uploaded to our servers when you expressly ask to share them by link or to convert them (MP4, GIF);
• the camera and microphone are only turned on at your request, to include your image or voice in a video, and their stream stays local.

The Extension settings (favorite devices, display preferences) are kept in your browser's storage.

Purpose	Data	Legal basis	Retention
Create and manage your account, sign in from the Site and the Extension	Name, email address, password (stored as an irreversible hash) or sign-in provider identifier, language, preferences	Performance of the contract	For the life of the account, then deleted after 3 years of inactivity or on request
Manage the subscription, free trial, payments and invoicing	Plan, dates, status, Stripe customer ID, invoices, country, billing address, company name and VAT number where applicable. Card data is collected and stored by Stripe only	Performance of the contract; legal obligation for invoices	Duration of the subscription; accounting records 10 years (French Commercial Code, Art. L. 123-22)
Prevent the same payment method from getting the free trial more than once	Technical card fingerprint provided by Stripe (which cannot be used to recover the card number), Stripe customer ID, date	Legitimate interest (fraud prevention)	3 years from the trial
Enforce the maximum number of devices signed in to one account and prevent account sharing	Device identifier computed from technical browser characteristics (browser, OS, language, time zone, screen resolution), device name, sign-in dates, history of forced sign-outs	Performance of the contract; legitimate interest (fraud prevention)	As long as the device is linked to the account; sign-out history 12 months
Manage teams	Email address of invited members, role, invitation status	Performance of the contract (with the Team plan holder)	As long as the member belongs to the team
Share a video by link and convert it	Video file you choose to upload, link key, date, view count	Performance of the contract (your request)	Until you ask for deletion or close your account
Real-device simulation in the cloud	Address of the loaded page, interactions and display stream of the session, simulated location, chosen device and OS version, session duration	Performance of the contract	For the session; usage durations kept during the subscription to count quotas
Answer your support and contact requests	Name, email, message, attachments, technical information you provide (Extension version, browser, OS)	Legitimate interest; performance of the contract for customers	3 years from the last exchange
Send service emails (confirmation, invoices, end of trial, renewal, security)	Email address, name, account information	Performance of the contract; legal obligation	Duration of the account
Keep you informed about new features (newsletter)	Email address, language	Consent, or legitimate interest for customers regarding similar services (French Postal and Electronic Communications Code, Art. L. 34-5)	Until you unsubscribe, at most 3 years after the last contact
Understand why the Extension is uninstalled	Chosen reason, optional comment and email address, Extension version	Consent (optional survey)	12 months
Measure Extension usage to improve it	Random identifier (or account ID if signed in), usage events (activation, chosen device, screenshot, video, zoom), browser, language, OS, Extension version	Legitimate interest. You can object at any time by turning off statistics in the Extension settings	25 months
Measure Site audience; on account, payment and contact pages, record browsing sessions to understand the difficulties encountered	Pages viewed, events, browser identifier, interactions (clicks, scrolling), device type, country; ID and email if signed in. Input fields are masked in recordings	Consent (cookie banner)	Statistics 25 months; session recordings 30 days
Detect and fix technical errors in the account and payment flow	Error message, page concerned, browser, OS, IP address	Legitimate interest (service reliability)	90 days
Display advertising in the free version	Advertising cookies and identifiers, IP address, page displayed, ad interaction data	Consent for personalized advertising; legitimate interest for non-personalized contextual advertising	Depending on partners, cookies 13 months at most
Display prices in your currency	IP address, used to determine your country	Legitimate interest	Not stored; only the country is remembered in your browser
Secure the Services and keep proof of your choices	Technical logs (IP address, date, requested resource, browser), proof of cookie consent	Legitimate interest; legal obligation	12 months

Data marked as mandatory in our forms is necessary to provide the requested service. Without it, we cannot process your request.

We make no decision based solely on automated processing that produces legal effects concerning you. Refusing a free trial to a card already used does not prevent you from subscribing.

The permissions requested at installation are used exclusively to run the simulation:

• Access to all sites (host permissions), tabs, scripting and webNavigation: display the website of the current tab inside the chosen device frame, whatever its address, including on localhost;
• webRequest and declarativeNetRequest: apply the User-Agent and headers of the simulated device, and display websites that refuse to be embedded in a frame;
• activeTab, tab capture and offscreen document: take screenshots and videos, locally;
• storage: remember your settings;
• contextMenus and shortcuts: offer the Extension's actions in the context menu and on the keyboard.

The use and transfer of information received from browser APIs adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements: this information is only used to provide and improve the simulation feature, is not sold, not used for advertising, not used to determine creditworthiness, and is not read by any human except with your explicit consent, for security purposes or to comply with the law.

The Site uses cookies and similar technologies (local storage, pixels) in three categories:

• Necessary: sign-in, security, payment, storing your consent choices. They do not require your consent;
• Analytics and session recording: only set if you accept them;
• Advertising: set by our advertising partners in the free version, only with your consent for personalized advertising. Most of these partners take part in the IAB Transparency and Consent Framework (TCF).

On your first visit, a banner lets you accept, refuse or choose category by category, as easily one way as the other. You can change your choices at any time using the cookie settings icon displayed on the Site. Your choice is kept for 12 months.

Your data is only accessible to the publisher and to the technical providers below, which process it on our behalf and under our instructions (processors within the meaning of Article 28 GDPR), unless stated otherwise:

Provider	Role	Data location
Netlify, Inc.	Site hosting	United States, global network
Supabase Pte. Ltd.	Database, accounts, authentication	Ireland (EU)
Amazon Web Services EMEA SARL	API, video storage and conversion	France (EU)
Salesforce, Inc. (Heroku)	Content and shared video administration tool	United States
Stripe Payments Europe, Ltd.	Payment, subscriptions, invoicing, fraud prevention	Ireland (EU), United States
PayPal (Europe) S.à r.l. et Cie, S.C.A.	Payment, if you choose PayPal (independent controller)	Luxembourg (EU)
Mailjet SAS (Sinch)	Email delivery	European Union
PostHog, Inc.	Usage statistics, session recording	United States
Functional Software, Inc. (Sentry)	Error monitoring	Germany (EU)
FingerprintJS, Inc.	Identification of devices signed in to an account	United States
CookieHub ehf.	Cookie consent management	Iceland (EEA)
Appetize.io, Inc.	Real-device simulation in the cloud	United States
Artia International S.R.L. (ip-api.com)	Country detection for price display	Romania (EU)
komoot GmbH (Photon) and CARTO	Address search and map tiles for location simulation	Germany (EU); Spain (EU) and United States
Google Ireland Ltd. (AdSense), BuySellAds (Carbon Ads), TheMonetizer	Advertising in the free version (independent controllers for their own purposes)	European Union, United States

If you use the tunnel feature to expose a local server to the real-device simulation, the cloudflared software you install connects to Cloudflare, Inc., which then acts under its own terms.

Extension stores (Google Chrome Web Store, Microsoft Edge Add-ons, Mozilla Add-ons) process installation and review data as independent controllers.

Your data may also be disclosed to administrative or judicial authorities where required by law, or to our advisers to defend our rights.

Some providers are based in the United States. These transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework where the provider is certified, or otherwise on the Standard Contractual Clauses adopted by the European Commission, supplemented by additional measures where necessary. You can obtain a copy of these safeguards by writing to us.

We implement appropriate measures to protect your data: encrypted connections (HTTPS), passwords stored as irreversible hashes, per-user data isolation at database level, restricted administrative access, payments delegated to PCI-DSS certified providers. In the event of a data breach likely to result in a high risk to your rights, you will be informed as required by the GDPR.

You have the following rights regarding your data:

• right of access and to obtain a copy;
• right to rectification;
• right to erasure, unless the law requires us to keep certain data (invoices, for example);
• right to restriction of processing;
• right to portability of the data you provided;
• right to object to processing based on our legitimate interest, and at any time to direct marketing;
• right to withdraw your consent at any time, without affecting processing already carried out;
• right to set instructions regarding your data after your death (French law).

To exercise them, write to support@webmobilefirst.com from the address linked to your account. We answer within one month, which may be extended by two months for complex requests. We will only ask for proof of identity in case of reasonable doubt.

If, after contacting us, you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France – www.cnil.fr, or with the supervisory authority of your country of residence.

The Services are intended for professionals and adult individuals. Creating an account and subscribing to a paid plan as a minor under 15 requires the consent of a legal guardian.

This policy may change, in particular when we add a feature or a provider. The date of the last update appears at the top of the page. In the event of a significant change, account holders will be informed by email or in the Extension.