Privacy Policy
Last updated
TGD SOLUTIONS EURL, a company registered in France with its registered office at 11 rue Surcouf, 75007 Paris, France (“we”, “us”), is the data controller in respect of the personal data described in this Policy.
This Privacy Policy describes how we collect, use, store and disclose personal data when you use our website and services (the “Service”), and the rights available to you in respect of that data. It applies to all users of the Service.
By accessing or using the Service you acknowledge that you have read and understood this Policy. This Policy should be read together with our Terms of Service.
1. Controller and Processor
In respect of your account and your use of the Service, we act as a data controller. In respect of the contents of files you upload to the Service, we act as a data processor on your behalf and process that content only in accordance with your instructions, which are given by your use of the Service.
Where files you upload contain personal data relating to third parties, you remain responsible for ensuring that you have a lawful basis for providing that data to us and for having it processed.
2. Information We Collect
We collect the following categories of information.
Account information
Your email address and, where provided, your name. An email address is required in order to authenticate you.
If you sign in with Google, Google sends us your name, your email address, whether Google has verified that address, and the address of your Google profile picture, and we store them as your account information. Google also sends us short-lived tokens, which we use once to read those details and do not keep. We do not ask Google for access to anything else in your Google account, and we do not receive or store your Google password. Google processes your sign in as a controller in its own right, under its own privacy policy.
You may disconnect Google from your account at any time in the settings of the Service, after which it can no longer be used to sign you in. Disconnecting does not remove the Service from your Google account; you can do that in your Google account's settings.
Files and derived data
The files you upload to the Service, and the data extracted from them. Where a file is processed by optical character recognition, the response received from the provider of that service is held for the same limited period as the file itself. Retention periods are set out in section 7.
Session data
Records of your authenticated sessions, including the IP address and browser user agent associated with each session. This data is used to maintain and revoke sessions.
Conversions made without an account
You may convert one file without creating an account. Where you do, we store the file and the data extracted from it in the same way as for an account holder, identified by a randomly generated reference held in a cookie in your browser and in no way linked to your identity. We also record the IP address the request was made from, in order to limit how many such conversions one address may make. If you then create an account, the file and the data extracted from it become part of that account. If you do not, they are deleted on the schedule set out in section 7 and the reference expires after 24 hours.
Credentials
Where you create an API key, we store a cryptographic hash of that key and not the key itself.
Billing information
Where you subscribe to a paid plan, we store an identifier issued by our payment processor and the status of your subscription. We do not collect or store payment card details.
Usage data
Information about how the Service is used, including pages viewed, features used, approximate location derived from IP address, and device and browser type. This data is collected by the product analytics provider named in section 5 and is used to understand and improve the Service. It is not used for advertising and is not combined with the contents of files you upload.
We do not operate advertising or cross-site tracking software on the Service.
3. How We Use Information
We use the information described above in order to:
- provide, operate and maintain the Service;
- process the files you submit and return the resulting data to you;
- authenticate you and secure your account;
- administer subscriptions, billing and applicable taxes;
- respond to your enquiries and provide support;
- detect, prevent and address technical issues, abuse and fraud; and
- comply with our legal and regulatory obligations.
We do not sell personal data. We do not use the files you upload, or data derived from them, to train machine learning models, and we do not permit our service providers to do so.
4. Legal Bases for Processing
Where the General Data Protection Regulation applies, we process personal data on the following bases: performance of a contract, in respect of your account, the processing of your files and the provision of the Service; compliance with a legal obligation, in respect of accounting and tax records; our legitimate interests in securing the Service and preventing abuse, in respect of session and server records; and consent, in respect of analytics cookies and the usage data collected through them.
5. Service Providers
We disclose personal data to the following service providers, each of which processes it solely on our instructions and for the purposes described.
| Name | Where | What for |
|---|---|---|
| Hetzner Online GmbH | Germany | Hosting of application servers and databases. |
| Cloudflare, Inc. | European Union jurisdiction | Object storage for uploaded files and processing responses. The storage bucket is provisioned with European Union jurisdiction, so objects are stored and processed within the European Union. |
| Mistral AI SAS | France | Optical character recognition, where a file cannot be read directly. |
| Stripe, Inc. and Stripe Payments Europe, Ltd. | Ireland and United States | Payment processing, subscription management and tax collection. |
| Resend, Inc. | United States | Delivery of transactional email, including authentication messages. |
| PostHog, Inc. | European Union | Product analytics. Receives usage data as described in section 2 and does not receive the contents of files you upload. |
We may also disclose personal data where required to do so by law, or where necessary to establish, exercise or defend legal claims.
6. Files You Upload
Files which can be read directly are processed on our own infrastructure and are not disclosed to any third party. Files which require optical character recognition are made available to the provider named in section 5 by means of a time-limited link which expires one hour after it is issued. No other third party is given access to the files you upload.
7. Data Retention
Files you upload are deleted automatically within 24 hours of being processed, together with any processing response associated with them. They are not retained beyond that period. This applies equally to a file converted without an account.
The data extracted from a file is retained in your account until you delete it or until your account is closed, so that it remains available for you to export. Deleting an extracted record removes it and any remaining associated data.
Account data is retained for the duration of your account. Records which we are required to retain for accounting, tax or other legal purposes are retained for the period prescribed by the applicable law and are then deleted.
8. International Transfers
Application servers, databases and uploaded files are located within the European Union. Certain service providers named in section 5 are established outside the European Economic Area. Where personal data is transferred outside the European Economic Area, that transfer is made pursuant to an adequacy decision of the European Commission or on the basis of Standard Contractual Clauses.
9. Cookies
We use three cookies which are strictly necessary for the operation of the Service, and no consent is required for any of them.
The first maintains your authenticated session and contains a short-lived signed copy of that session. It expires when your session expires.
The second is set only if you convert a file without an account, at the moment you do so and not before. It contains a randomly generated reference which allows the Service to return that file's results to your browser and to transfer them to an account if you create one. It contains nothing else, is not readable by scripts running on the page, and expires after 24 hours.
The third is set only if you choose to sign in with Google, at the moment you do so. It contains a random value which lets the Service confirm that the response returning from Google belongs to the sign in you started, and not to one started by somebody else. It is not readable by scripts running on the page and expires after five minutes.
We also use analytics cookies, set by the provider named in section 5, to collect the usage data described in section 2. Nothing is stored on your device and nothing is sent to that provider unless you have agreed: you are asked when you first arrive, and analytics remain switched off until you say otherwise.
You may withdraw that consent at any time using the "Analytics preferences" link in the footer of any page, which asks the question again. Withdrawing stops any further collection.
We do not use advertising cookies or cross-site tracking pixels.
10. Security
We implement technical and organisational measures appropriate to the risk, including encryption of data in transit, storage of uploaded files in private buckets accessible only by time-limited signed links, and storage of credentials in hashed form. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Your Rights
Where the General Data Protection Regulation or equivalent legislation applies, you have the right to request access to your personal data, to request its rectification or erasure, to request restriction of or object to its processing, to receive it in a structured and machine-readable format, and to withdraw consent where processing is based on consent.
Data extracted from your files may be exported from the Service at any time, and any file may be deleted from within the Service. For all other requests, contact us at the address in section 14. We will respond within one month of receipt, which period may be extended by a further two months where a request is complex.
You also have the right to lodge a complaint with the supervisory authority in the country in which you reside or work.
12. Children
The Service is intended for business use and is not directed to persons under the age of 16. We do not knowingly collect personal data from persons under that age. If you believe that we have done so, contact us and we will delete it.
13. Changes to This Policy
We may update this Policy from time to time. The date at the head of this page indicates when it was last revised. Where changes are material, we will notify account holders by email before they take effect.
14. Contact
Questions about this Policy, and requests in respect of your personal data, should be sent to [email protected], or in writing to TGD SOLUTIONS EURL, 11 rue Surcouf, 75007 Paris, France.
The supervisory authority for our establishment is the Commission Nationale de l’Informatique et des Libertes (CNIL), 3 Place de Fontenoy, 75007 Paris, France.