General Conditions of Use - Objectory

Terms of Use – MVP (Minimum Viable Product)

Version (valuables limited company, July 25).

1. Purpose

These Terms of Use (the β€œTerms”) govern the use of our mobile application, which is currently in its testing phase (MVP). By accessing the app, you agree to these terms.

2. Testing Phase

The app is currently being tested by a limited group of users, upon invitation only, which requires the individual validation of each account. It is not yet commercially available. This testing phase is intended to improve the product before its official launch later this year. By participating, you agree to be part of this limited test group.

3. Data Protection and security

We take the protection of your data very seriously. Here is our commitment:

Data encryption: All information you enter into the app is encrypted. This means your data is protected and only you have access to it.

Confidentiality: We do not access the content of your personal data stored in the app.

Use of personal data: The only non-encrypted personal information we collect is your email address, first name, and last name. These are used exclusively to communicate with you (e.g., to share updates or collect feedback).

No sharing or selling: This information will never be shared or sold to third parties under any circumstances.

The data is stored in a European based data center. Β 

4. Security

This document outlines our data security and hosting practices.

Data Encryption

All data you input into the application is encrypted, and we do not have access to it.

The SSL encryption key for the back-end is stored in Google Cloud Platform (GCP), our cloud provider.

The database is encrypted both at rest and in transit using an SSL key, also hosted and managed by GCP.

Backup and Recovery Procedures

We use Cloud SQL with a 14-day SQL backup retention configuration (global standard).

Point-in-time restore functionality, utilizing database logs, allows for daily backups and restoration to a precise moment (down to the second) within the last 14 days.

Cloud Run enables rollbacks to previous program versions.

Data Hosting and Physical Storage Location

Our servers are located in a Google datacenter in Belgium, within the EU-WEST1 zone.

Security Standards and Certifications Followed

Authentication & Authorization: OAuth2 via Firebase.

Dependency Verification: Package verification via NPM audit and YARN Audit.

Licensing: Exclusive use of MIT-licensed (or equivalent) packages.

SQL Injection Protection: Achieved through the use of our ORM.

Resource Management: OAuth2 scoping and unique resource management per user to prevent IDOR (Insecure Direct Object References).

Secure Data Access: Temporary URL signing for all BLOB data access.

Access Control: Verified via Middleware & Usecase with role-based access management (Authorization).

Database Access: Limited to accepted IP ranges configured on servers.

Server Communication: Secure connection (VPN) implemented in GCP between back-end and database.

Dedicated Users: Each database access has a dedicated user (support access, back-end access, read access).

Front-end Code Protection: Production bundle obfuscation (without publishing .map files), similar to other providers.

GraphQL API: Introspection disabled in production.

Secure Tokens: Use of scopes and resources in token management.

OWASP Compliance: Designed to be compatible with the OWASP Top 10 at the time of MVP delivery.

Anti-spam Protection: IP blocking in case of excessive consecutive requests.

API Resource Limitation: Depth control on the GraphQL API.

Code Review: Security service verification of each code on the main branch.

Tech-Lead Validation: Manual security review (OWASP) of critical PRs by the tech lead.

Secure Deployment: Automation via CI/CD with tag creation and integration test validation.

Environments: Staging and production environments implemented.

Deployment Consistency: Use of identical Docker images based on the same commit.

Containerization: Docker for development, staging, and production environments.

5. Consent

By using the MVP version of the app, you agree:

to take part in a real-world test,

to give some feedback through surveys and through one-on-one interactions (teams or phone call); Β 

that we may use your contact details to reach out to you regarding product development (email address);

that your data will be processed in accordance with this policy. Β 

6. Updates

These Terms may evolve as the project progresses. You will be informed of any updates.

‍

OBJECTORY (hereinafter the "Application") is an application developed by Valuables s.r.l, whose registered office is located at 2, Avenue des Dessus de Lives(LO) in 5101 Namur (Belgium), a company registered under BCE number nΒ°1023.369.596 (hereinafter "Valuables").

‍

The use of the application is subject to the full and complete acceptance of these General Conditions of Use.

‍

Article 1 - General Provisions

‍

1.1. Purpose

‍

The purpose of these General Conditions of Use (hereinafter the "GCU") is to define the terms of access and use of the services offered via the OBJECTORY mobile application, by any user (hereinafter the "User").

‍

1.2. Scope of Application

‍

The GCU applies to any natural person aged at least 13 who uses the Application. Registration by a minor requires the prior authorization of a holder of parental authority.

‍

Article 2 - Description of Services

‍

The Application offers the following services (hereinafter the "Service"):

  • The Application provides the User with a platform allowing the centralized management of personal items and their associated information.
  • The Application allows the User to record, organize and store information relating to their items (including photographs, documents, videos, voice recordings, and descriptive data), in a dedicated personal space.
  • The Application allows the user to import existing inventories (Excel format), and to export Application inventories (PDF or Excel format).
  • The Application ensures the storage of User data in a secure environment, in accordance with the technical standards defined by Valuables (see Security and protection of your data). The User retains exclusive control over the information they record, which is only accessible to them or to the people they authorize.

Valuables has access to no User data (in particular, no data relating to their assets) except those indicated in Article 9 of these GCU.

‍

Article 3 - Registration Procedures

‍

3.1. Registration – mandatory steps

‍

Before any registration, the User must download OBJECTORY onto their phone, with a compatible operating system (Android or iOS).

‍

The User undertakes to provide accurate and up-to-date information during registration: surname, first name, email address. Access to the Application requires the creation of a user account.

‍

An email is sent by OBJECTORY to the email address mentioned by the User, to confirm their registration. Confirmation of the email address is necessary to activate the User's registration.

‍

3.2. PIN code and encryption key linked to assets

‍

The User chooses a specific PIN code to access their OBJECTORY account. The PIN code is strictly personal, confidential, and non-transferable. It cannot therefore be shared or communicated to third parties.

‍

In addition to the PIN code associated with their OBJECTORY account, the User must define, for each asset created in the Application, a specific password constituting an "encryption key". This key is exclusively known to the User and cannot be recovered or saved by Valuables.

‍

In the event of loss of the encryption key, the User acknowledges that they will no longer be able to access the data of the asset concerned and that this data will be definitively lost.

‍

The User is solely responsible for the conservation and confidentiality of their PIN code and their encryption key, and releases Valuables from all responsibility in this regard. The User undertakes to modify their PIN code if they suspect that its confidentiality has been compromised.

‍

3.3. Registration of minors under 16 years of age

‍

In accordance with Article 8 of the GDPR, the lawful processing of personal data of children under 16 years of age requires the consent given by the holder of parental authority in respect of the child concerned. However, Member States may provide for a lower age, which may not be lower than 13 years.

‍

In application of this provision, Belgian legislation provides for a minimum age of 13 years (Article 7 of the law of July 30, 2018), and French law provides for a minimum age of 15 years (Article 45 of the French Data Protection Act "Loi Informatique et LibertΓ©s").

‍

The minor User must, depending on the legislation applicable to their situation, obtain the consent of the person holding parental authority for their registration with OBJECTORY.

‍

The person holding parental authority is responsible for the supervision of the minor User.

‍

Article 4 – The Subscription

‍

4.1. Subscription and payment

‍

The User has access to the functionalities of OBJECTORY provided that they have subscribed to one of the available subscription formulas. The different descriptions of the formulas are available on the following link: https://www.objectoryapp.com/

‍

The User must subscribe to a paid subscription on the Valuables Application using a third-party payment system via mobile application platforms[1] (Apple App Store or Google Play Store).

‍

Subscriptions are billed in advance, either monthly or annually, depending on the option selected by the User. Subscription fees are automatically debited at the start of each billing period, unless the User cancels their subscription before the end of the current period.

‍

The prices displayed include all applicable taxes, including VAT at 21%, and are calculated based on the information provided by the User during subscription.

‍

A fourteen-day free trial period is offered to new Users who subscribe to a paid subscription for the first time. During this period, the User has access to certain features of the chosen subscription, described on the pricing page indicated above. At the end of this trial period, the User's subscription is automatically activated and billed, unless the User cancels it before the end of the trial period.

‍

4.2. Modification of Prices and Tax Rates

‍

Valuables reserves the right to modify the prices of paid subscriptions, including recurring subscription fees, to reflect changes in the features offered, operational costs, or for legal, regulatory, or economic reasons.

‍

Any price modification is notified to the User at least thirty days before its entry into force, by email or via a notification in the Application.

‍

The price modification takes effect from the next billing period following the notification date.

‍

If the User does not accept a price modification, they can refuse it by cancelling their subscription before the modification comes into effect. The use of the Application by the User after the entry into force of the modification constitutes acceptance of the new price.

‍

4.3. Invoicing and Cancellation

‍

The User is billed recurrently on the first day of each billing period for the subscription fees then in force.

‍

The User can cancel their subscription at any time by logging into their OBJECTORY account and following the instructions available in their account settings. Termination takes effect at the end of the current billing period, and no refund or credit is granted for a partially used period, unless expressly stated otherwise in these Conditions or by applicable law.

‍

4.4. Right of Withdrawal

‍

In accordance with Belgian legislation, the User has a legal right of withdrawal which expires fourteen days after the date of conclusion of the contract. The date of conclusion of the contract corresponds to the end of the free trial period.

‍

4.5. Termination by Valuables

‍

Valuables may charge the User late interest at the rate referred to in Article XIX.4 of the Economic Law Code, on any late payment after sending a first free reminder, a formal notice, and the expiry of a period of at least fourteen calendar days, starting either on the third working day following the sending of the formal notice, or, in the event of an electronic reminder, the calendar day following the day on which the reminder is sent to the User.

‍

Valuables will do its utmost to contact the User in the event of late payment, using the email address the User provided in the Valuables subscription management system. It is the User's responsibility to keep their contact details up to date to guarantee the reception of communications from Valuables.

‍

If an invoice remains unpaid for more than sixty (60) calendar days, Valuables reserves the right to suspend the User's access to the Application's paid services.

‍

In the event of failure to pay an invoice or a subscription, access to the Service may be temporarily suspended, in accordance with the rules applied by the distribution platform concerned.

‍

4.6. Payment Obligations

‍

The User undertakes to keep their payment information up to date and to ensure that the payment method used is valid and has sufficient funds to cover the subscription fees. In the event of payment failure, Valuables reserves the right to suspend the User's access to paid services until payment is regularized.

‍

Article 5 - Support and maintenance

‍

Valuables implements reasonable security monitoring to keep the Application and the tools used up-to-date and operational. This monitoring is ensured proactively and includes in particular monitoring of technical and security updates for the systems and services used.

‍

5.1. Notification and incident management

‍

Users can report any bug, malfunction or anomaly via the functionalities provided for this purpose within the Application.

‍

Upon receipt of a report, Valuables undertakes to:

  • Acknowledge receipt of the request;
  • Analyze the incident and take appropriate measures within a reasonable time, it being understood that Valuables undertakes, without being able to guarantee it, to resolve major incidents (technical incident preventing the use of the Platform) within 24 hours. Minor incidents, involving the partial unavailability of one or more functionalities, will be processed as far as possible within 5 working days.
  • Inform the User concerned of the progress and, where applicable, the resolution of the incident.

Incident management is carried out by Valuables, directly or, where applicable, in coordination with its suppliers or technical partners.

‍

5.2. Maintenance and unavailability

‍

Valuables may temporarily interrupt access to the Application for reasons of maintenance, updating, technical improvements or evolution of the content or their presentation.

‍

Where possible, Valuables will notify periods of unavailability for maintenance in advance and will ensure that they are scheduled between 8:00 p.m. and 8:00 a.m. CET.

‍

Valuables cannot be held responsible in the event of unplanned unavailability of the Application, particularly in the event of major incident repair. Valuables will do everything possible to restore Application service within a reasonable time.

‍

Article 6 - User's Responsibility

‍

The User undertakes, in their use of the Application, to:

  • Comply with these General Conditions;
  • Ensure the confidentiality of their password;
  • Not infringe the rights of third parties or the proper functioning of the Application;
  • Not attempt to obtain unauthorized access to other subscription formulas of the Application;
  • Regularly export their data via the tools made available;
  • Not interfere with the use of the Application;
  • Not send, distribute, make available or transmit any software or other computer file containing a harmful virus/component;
  • Not use the Application for illegal purposes;
  • Not interfere with or disrupt the networks connected to the Application;
  • Not infringe intellectual, industrial or commercial property rights over the elements published on the Application;
  • Only communicate information consistent with reality and update it regularly;
  • Only disclose information relating to their private life and their person which they consider that the dissemination and communication do not harm their rights and are not prejudicial to them;
  • Only communicate information and data which they have the power and authorization to disclose and use within the framework of the Application;
  • Not communicate or disseminate, in any form or nature whatsoever, via the Application, content which infringes the rights of third parties or which is defamatory, abusive, threatening, obscene, offensive, hateful, violent, inciting violence, of a political, racist, xenophobic, vulgar, pornographic nature, or any content which is criminally punishable or generally does not correspond to the spirit of OBJECTORY;
  • Follow the recommendations and good practices relating to data confidentiality (How Objectory protects your data and your items.);
  • Not store sensitive data (e.g. bank card numbers, passwords, postal addresses, etc.) in the free fields of the Application.

In the event of non-compliance with the principles set out above, OBJECTORY reserves the right to immediately deactivate the account of the responsible User, to prohibit them from accessing and registering for the Application subsequently, and to claim payment of all damages in order to repair the damage suffered by Valuables following non-compliance with these provisions.

‍

Account deactivation implies the destruction of all files, documents, and information communicated by the User on the Application.

‍

Article 7 - Responsibility of Valuables

‍

Valuables expressly declines all responsibility in the event of non-compliance with the obligations of Users or in the event of damage caused to them. Where applicable, the faulty or responsible User guarantees Valuables against any recourse by third parties and any conviction pronounced against it.

‍

Valuables declines all guarantee concerning:

  • The loss, alteration or unavailability of data recorded by the User (photos, descriptions, documents, etc.);
  • The accuracy, completeness or updating of the information entered by the User;
  • The market value, authenticity or condition of the items inventoried via the Application;
  • The permanent availability of the Application or data, particularly in the event of maintenance, technical failure or force majeure.

The Application is provided "as is", without guarantee that:

  • The data will be stored indefinitely or without error;
  • The physical items corresponding to the User's entries exist, are in their possession or are correctly described;
  • The valuations or estimates (if applicable) of the items are accurate or up to date.

Valuables has no general obligation to monitor the information it transmits or stores, nor any general obligation to actively seek facts or circumstances revealing illicit activities, in accordance with Article 6 of Regulation (EU) 2022/2065 of the European Parliament and of the Council of October 19, 2022 on a single market for digital services and amending Directive 2000/31/EC. In the event of publication of illicit content on the Application, the responsibility of Valuables can only be engaged if it was actually aware of the illicit activity or information and if it did not react promptly, from the moment of its knowledge of all the required details, to remove the illicit information or make access to it impossible.

‍

Valuables does not guarantee that the Application will always be accessible and is not responsible for a lack of functioning, impossibility of access or poor conditions of use attributable to unsuitable equipment, computer hacking, a virus, the access provider, network congestion of the Internet, dysfunctions of the host, or for any other reason not exclusively arising from a fault directly attributable to Valuables.

‍

Valuables declines all responsibility in the event of loss of data due to malfunction of the Application.

‍

Although Valuables has taken all necessary precautions in setting up the Application and its content, it gives no express or implicit guarantee of any kind, as to the suitability for a particular use or other specific expectations.

‍

The User expressly acknowledges that the use of the Application is done under their own responsibility and that Valuables can in no case be held responsible for direct or indirect damages, including loss of income or recourse by third parties, relating to the use of the Application.

‍

Valuables is not responsible for the impossibility of restoring data in the event of accidental deletion by the User, file corruption or technical failure. The User is solely responsible for the external backup of their data (e.g. regular export, local copy).

‍

Valuables is also not responsible for the financial or emotional consequences linked to the loss or unavailability of data, including in the event of account termination or closure of the Application.

‍

Article 8 - "FEA push" Notifications

‍

OBJECTORY may send push notifications to the User. These notifications may include information relating to activity suggestions or updates.

‍

The User can deactivate push notifications by selecting the appropriate option in their profile.

‍

Article 9 - Personal Data

‍

The User's personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR). The purpose of this privacy policy is to provide clear and transparent information on how Valuables processes your personal data as part of your use of the Application available on iOS and Android.

‍

9.1. Data Controller

‍

Subject to what is indicated in point 9.10 below, the data controller is Valuables s.r.l, whose registered office is located at 2, Avenue des Dessus de Lives(LO) in 5101 Namur (Belgium), a company registered under BCE number nΒ°1023.369.596.

‍

For any questions relating to the processing of your personal data, you can contact francois@objectory.be

‍

9.2. Data Collected

‍

The following data may be collected:

  • Mandatory identification data: surname, first name, email address;
  • Optional identification data: Country of residence, date of birth, civil and family status;
  • Connection and navigation data (IP address, device type, connection time, etc.);

9.3. Cookies and similar technologies

‍

The Application uses cookies and other similar technologies to ensure its operation, improve the user experience and analyze the use of the Application.

‍

Certain cookies are strictly necessary for the operation of the Application (in particular to allow authentication, session management and security). These cookies do not require user consent.

‍

Other cookies, in particular analytical cookies, make it possible to collect information relating to the use of the Application (such as interactions, functionalities used or navigation data), in order to improve its performance and functionalities. The use of these cookies is subject to the User's prior consent, which can be withdrawn at any time.

‍

The User can manage or deactivate cookies via their device or browser settings.

‍

The refusal of certain cookies may however affect the proper functioning of the Application.

‍

9.4. Purposes of Processing

‍

Data processing has the following purposes:

  • Registration for the Application and provision of a User profile;
  • Sending of newsletters;
  • Provision and personalization of the services offered;
  • Anonymous statistical analysis of the use of the Application;
  • Compliance with applicable legal and regulatory obligations.

9.5. Legal Bases for Processing

‍

Data is processed on the following legal bases:

  • Execution of the contract (GCU accepted by the User): mandatory identification data;
  • User Consent: optional identification data;
  • User Consent: mandatory identification data for sending newsletters;
  • Legitimate interest of OBJECTORY (improvement of services): connection and navigation data.

9.6. Recipients of Data

‍

Personal data is not communicated to third parties, except:

  • To technical service providers acting on behalf of OBJECTORY;
  • To administrative or judicial authorities, in accordance with the law;
  • To third-party partners, only with the explicit consent of the User.

9.7. Invitations and creation of third-party accounts (editor / reader)

‍

The User can invite third parties to access their assets via OBJECTORY. This invitation constitutes personal data processing carried out under the responsibility of the User.

‍

When the User invites a third party (editor or reader), they guarantee having obtained their prior consent.

‍

OBJECTORY has access to no personal data related to the invitation of third parties.

‍

9.8. Retention Period

‍

Data is kept for the period necessary to achieve the described purposes, then archived or deleted in accordance with legal obligations.

‍

Optional profile data is deleted upon User unsubscription.

‍

Anonymized connection data, interaction with the contents of the Application, may be kept for analysis and statistics.

‍

9.9. User Rights concerning the processing of their own personal data

‍

Users whose personal data is processed by Valuables can exercise the following rights, within the limits of the GDPR.

  • The right of access allows you to be informed and to request to receive a copy of the personal data processed.
  • The right to rectification allows you to request the modification or updating of inaccurate or incomplete personal data.
  • The right to erasure: allows you to ask Valuables to erase the personal data processed, provided that the processing is not necessary in the context of the use of the Application and within the limits provided for in Article 17 of the GDPR.
  • The right to data portability: allows you to receive a copy of personal data in a structured, commonly used and machine-readable format (e.g. pdf document) or to request that this data be directly transmitted to another data controller when technically possible.
  • The right to restriction of processing: allows you to request a limitation (temporary or permanent) of the processing of personal data, in whole or in part, within the limits provided for in Article 18 of the GDPR.
  • The right to object: allows you to refuse the processing of personal data, without this being able to prejudice the processing carried out lawfully before this refusal, and within the limits provided for in Article 21 of the GDPR. The right to object may apply to certain categories of communications.

Any request can be sent to francois@objectory.be. You will be asked to send a copy of any official identity document including the surname and first name of the person exercising these rights and allowing them to justify their identity.

‍

9.10. Data Security

‍

Valuables implements all appropriate technical and organizational measures to ensure the security and confidentiality of the User's personal data (see Security and protection of your data).

‍

9.11. Intervention of Valuables as processor for certain processing operations

‍

All personal data of the User or third parties, stored in documents or information saved by the User in the Application, are subject to the following provisions.

‍

The User, by transmitting and saving these documents, notes, and information, acts as the data controller for all personal data, whatever it may be, which may be reproduced therein. Valuables intervenes only as a processor for the storage of these documents and information on its servers.

‍

Processing by Valuables only lasts as long as the information and documents are kept on the User's account, and ends, in any event, upon termination of the subscription to the Application, by the erasure of the documents, notes, and information encoded by the User in the Application. Valuables does not have access to the personal data contained in the documents, notes, and information stored by the User on the Application.

‍

Valuables, as a processor, processes this personal data only for the storage of documents and information on its servers, and is authorized to subcontract this processing to any third-party provider meeting the required security conditions (see Security and protection of your data).

‍

The User, as the data controller, must ensure the legal basis for the processing and compliance with all other obligations incumbent on them in this capacity as data controller. The User is responsible for erasing all personal data from the documents, notes, and information they save in the Application, if their processing is not compliant with the applicable provisions.

‍

9.12. Policy Update

‍

This personal data protection policy is subject to change. Any modification will be notified to the User via the Application or by email.

‍

Article 10 - Intellectual Property

‍

All the literary and graphic elements included in the Application (interface, typography, logos, graphics, photographs, animations, icons, sounds, videos, characters, texts, etc.) are the exclusive intellectual property of Valuables or its partners, and may not be reproduced, used or represented without its prior written authorization. The same applies to the Valuables database and its content, and to the source codes of the Application, as well as to any software enabling the functioning of the Application.

‍

The right to use these elements, granted to Users, is limited to accessing the Application Services, within the Application, and as long as the User is subscribed to the Application.

‍

Users are not authorized to modify, copy, reproduce, download, disseminate, transmit, decompile and compile, commercially exploit, distribute, in any way whatsoever, the pages or parts of pages of the Application or the computer codes of the underlying elements.

‍

OBJECTORY is a registered trademark of Valuables.

‍

Article 11 - Unsubscription from the Application

‍

The User can unsubscribe from the Application at any time by notifying it via their profile page.

‍

Valuables may, without prior notification, notice or compensation, deactivate a User's account in the event of non-compliance with the rules set out in these general conditions, or in the event of fraud.

‍

User unsubscription entails the erasure of all data, documents, and information saved in the Application. Erasure is irreversible and the User is responsible for extracting data from the Application before any unsubscription (pdf or excel).

‍

Account deactivation is without prejudice to any legal action or request for compensation which could be introduced by OBJECTORY for the protection of its interests. Unsubscription will not give rise to any compensation for the User.

‍

Article 12 - Modifications to the GCU

‍

These GCU may be modified at any time. The User will be informed of the modifications and must accept them to continue using the Application.

‍

Article 13 - Applicable Law and Disputes

‍

The contractual relations between the parties to which these general conditions apply are governed exclusively by Belgian law. In the event of a dispute over the application or interpretation of these conditions, and in the event of failure to resolve it amicably, the Courts of the judicial district of Brussels have sole jurisdiction unless the Company, acting as plaintiff, prefers to bring the action before any other competent court.

‍

[1] If the User subscribes via a mobile store (Apple App Store or Google Play Store), the additional general conditions of these platforms also apply to their purchase, including their refund and billing policies. Valuables has no control over these additional conditions and cannot be held responsible for them.

‍