Privacy and cookie policy

Last updated: 21 August 2026.

This policy describes how SMT Performances (“we”) processes your personal data when you use the website smtperformances.com (and its language versions), the online shop, the Flashbird mobile app and Flashbird GPS trackers (One, Air, Ultra and earlier models), as well as related accessories (including the SmartKey).

It applies to individuals: customers, app users, website visitors and, where relevant, emergency contacts you enter in the app.

Please read it carefully. By creating an account or using our services, you are informed of these processing activities. Where the law requires it, we collect your consent (non-essential cookies, the FLASHBIRD Emergency service, and any transfer to an investigation provider after a police report).

1. Data controller and data protection officer

The data controller is SMT Performances, La cantine du numérique, 40 rue de la Tour d'Auvergne, 44200 Nantes, France, email: dpo@smtperformances.fr.

A data protection officer (DPO) has been appointed with the CNIL. You can contact the DPO at the same address: dpo@smtperformances.fr.

The competent supervisory authority in France is the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

2. Data we process

Depending on the services you use, we may process the following categories. We do not collect health data. Any emergency form you fill in in the app (identity and phone number of a contact) is not medical data.

• Account: email address, password (stored securely), first name, last name, gender and date of birth (optional), language, time zone, technical account identifiers.
• Orders and billing: delivery and billing details, order history, payment data processed by our payment provider (we do not store the full card number).
• Vehicle and device: the name you give the vehicle, information you enter (make, model, registration, etc.), device identifiers, pairing status, settings (anti-theft, notifications, ride privacy).
• Location and trips: GPS positions of the device, dates and times, speeds and technical events linked to a trip or an anti-theft alert; trip history available in the app for as long as the account and trips have not been deleted.
• SmartKey: pairing of the key with the device, proximity detections, key battery status, events used to disarm the anti-theft function.
• Phone (app): when you use the phone-location button, the phone’s position is used only while that screen is displayed (foreground). We do not access the phone’s location in the background. The camera is used only if you scan a QR code or add a photo (for example of the vehicle), at your action.
• Notifications: push notification token, alert preferences (movement, battery, SmartKey, etc.).
• FLASHBIRD Emergency (optional): if you enable the service, data needed for assistance (account, vehicle, last relevant trip or position, and the emergency details you have entered). The service is off by default.
• Support: content of your messages (email, chat, app), any attachments, ticket history.
• Website: pages viewed, technical connection data, approximate country inferred from the IP address to display the relevant shop, cookie choices, any questionnaire answers.
• Communications: transactional emails (account, order, alert); commercial information emails if you are a customer or where the law allows, with an unsubscribe link.

Fields marked as mandatory when you create an account or place an order are required to provide the service. The app is intended for people aged 16 or over.

3. Purposes and legal bases

We process your data only for specified purposes. The legal bases (Article 6 GDPR) are as follows.

You are not subject to a decision based solely on automated processing that produces legal effects concerning you.

4. Location, anti-theft, SmartKey and privacy mode

The Flashbird device records the vehicle’s position so you can locate it, view your trips and receive alerts (including in the event of unauthorised movement). These data are linked to your account for as long as it exists.

The SmartKey is used to disarm the anti-theft function when the key is detected near the device. Detection events and the key’s battery status may be recorded to operate this feature.

You can hide a trip in the history (the trip is then no longer shown in the app). Hiding a trip does not immediately delete all associated technical traces.

A privacy mode can be enabled on request to support (dpo@smtperformances.fr or the usual support channel). In this mode, the relevant trips are no longer kept in a named form in the history once the SmartKey is detected, according to the service rules. This mode is not offered as a free setting in the app; it can also be turned off (reset) on request to support.

The phone’s location is used only if you open the corresponding screen; it is not collected in the background.

5. FLASHBIRD Emergency

FLASHBIRD Emergency is an optional assistance service, separate from everyday location features. It is off by default. Enabling it constitutes consent to share the data needed with our assistance provider. Once you subscribe, processing is also based on performance of the contract; if an alert is triggered, vital interests may apply.

That provider is Liberty Rider. Liberty Rider may use an insurer / assistance platform (IMA) to carry out the intervention. The countries where the service is available are shown in the app when you subscribe; they may change.

You can turn the service off in the app. Turning it off stops new sharing for assistance; data already sent for an ongoing intervention remain necessary until that intervention ends.

6. Recipients and processors

Your data are accessible to authorised SMT Performances teams (support, technical, accounting), limited to their roles.

We use providers that process data on our behalf (processors, Article 28 GDPR) or, for some services, as joint or separate controllers. The main ones are:

• DigitalOcean — hosting of the application and databases (European Union: in particular the Netherlands and Germany).
• Netlify — hosting of the marketing website.
• SiteGround — hosting of the shop (server in Paris).
• Flespi (Gurtam UAB) — device telemetry platform (European Union).
• Stripe — payments and subscriptions.
• Brevo — transactional emails and, where applicable, information emails.
• Twilio and Vonage — SMS / alert calls when those channels are used.
• Google (Firebase Cloud Messaging) — push notifications.
• Mapbox — maps in the app (United States; standard contractual clauses).
• Zendesk — support tickets.
• OpenAI and Cursor (Anysphere) — artificial-intelligence tools used only for customer support (website chatbot, technical diagnostics). No advertising use.
• Sentry — technical error diagnostics for the app.
• Typeform — forms / questionnaires when you answer them.
• Geoapify — country estimate from the IP address, to display the relevant shop (not an advertising cookie).
• Liberty Rider (and its assistance partner) — only if FLASHBIRD Emergency is enabled.
• Internal administration and technical monitoring tools (limited, logged access).

We do not sell your data to advertisers. We do not serve personalised advertising in the mobile app.

Post-theft investigation. A recovery-assistance provider is not currently used. If that service were reactivated, no location data would be sent to it without your explicit consent, after a police report, and only for the duration of the investigation. We would then update this policy.

Authorities (police, courts, CNIL) may receive data where the law requires it.

7. Transfers outside the European Union

The main hosting of account, trip and telemetry data is in the European Union.

Some providers are established outside the EU (in particular Mapbox and certain notification, email, payment or support services depending on their architecture). In that case, the transfer relies on the European Commission’s standard contractual clauses and, where applicable, the EU–US Data Privacy Framework when the provider is certified, together with additional measures. The former “Privacy Shield” is no longer a valid framework; we do not rely on it.

8. Retention periods

After you delete your account, the app no longer lets you access your trips or the device’s position. Paid subscriptions linked to the account are cancelled. Records needed for accounting and fraud prevention may be kept in a limited form, separate from everyday use of the app.

9. Your rights

Under the GDPR you have the rights of access, rectification, erasure, restriction, objection (including to direct marketing), withdrawal of consent and portability (data you provided to us that are processed by automated means on the basis of contract or consent).

In particular, you can:

• correct some information in the app (account, vehicle);
• delete a trip or your whole account in the app (settings) — deleting the account makes the data inaccessible immediately, then they are erased within the period in section 8;
• export a trip in GPX or CSV format from the app;
• turn off FLASHBIRD Emergency;
• unsubscribe from commercial emails via the link provided;
• request privacy mode or exercise a right by writing to dpo@smtperformances.fr.

For an access request, give the email address of the Flashbird account concerned. We may ask for further information only if it is needed to verify your identity and protect the account. We reply within one month, extendable under the legal conditions.

You may lodge a complaint with the CNIL or with the supervisory authority of your place of residence in the EU.

10. Cookies and trackers (website)

A banner lets you accept or refuse non-essential cookies. Your choices are stored for 30 days. You can change them by reopening the banner (cookie information link, where available) or by deleting cookies in your browser.

Cookies currently used:

These cookies are set by SMT Performances (first-party cookies). On their own they do not profile your browsing with third parties.

Audience measurement and advertising. The site can be configured to load a Google Tag Manager-type tool and measurement or advertising partners only after you accept. As long as you refuse, or as long as those tools are not operationally enabled, no cookie from those partners is set via our banner. If we enable such partners, the list will be specified here or in the banner.

Outside cookies. To display the most relevant country shop, a technical request may be sent to Geoapify based on your IP address. The country obtained may be stored in your browser’s local storage (localStorage) for a limited time (currently 7 days). This is not an advertising cookie; you can delete it by clearing the site’s data.

The Flashbird mobile app does not set the website cookies. Mapbox maps in the app are configured without Mapbox telemetry. We do not integrate an advertising SDK in the app.

11. Security

We implement appropriate technical and organisational measures (European hosting, access control, encryption of traffic, logging, internal policy). No system is infallible. In the event of an incident presenting a high risk to your rights, we will inform you and notify the CNIL when the GDPR requires it.

12. Changes

We may change this policy to reflect a change in the service, the law or our providers. The date at the top is authoritative. In the event of a substantial change, we will inform you by a reasonable means (banner, email or notice in the app).

For any question: dpo@smtperformances.fr.