Privacy Policy
Last updated
TGD SOLUTIONS EURL, a company registered in France with its registered office at 11 rue Surcouf, 75007 Paris, France (“we”, “us”), is the data controller in respect of the personal data described in this Policy.
This Privacy Policy describes how we collect, use, store and disclose personal data when you use our website and services (the “Service”), and the rights available to you in respect of that data. It applies to all users of the Service.
By accessing or using the Service you acknowledge that you have read and understood this Policy. This Policy should be read together with our Terms of Service.
1. Controller and Processor
In respect of your account and your use of the Service, we act as a data controller. In respect of the contents of files you upload to the Service, we act as a data processor on your behalf and process that content only in accordance with your instructions, which are given by your use of the Service.
Where files you upload contain personal data relating to third parties, you remain responsible for ensuring that you have a lawful basis for providing that data to us and for having it processed.
2. Information We Collect
We collect the following categories of information.
Account information
Your email address and, where provided, your name. An email address is required in order to authenticate you.
Files and derived data
The files you upload to the Service, and the data extracted from them. Where a file is processed by optical character recognition, the response received from the provider of that service is held for the same limited period as the file itself. Retention periods are set out in section 7.
Session data
Records of your authenticated sessions, including the IP address and browser user agent associated with each session. This data is used to maintain and revoke sessions.
Credentials
Where you create an API key, we store a cryptographic hash of that key and not the key itself.
Billing information
Where you subscribe to a paid plan, we store an identifier issued by our payment processor and the status of your subscription. We do not collect or store payment card details.
Usage data
Information about how the Service is used, including pages viewed, features used, approximate location derived from IP address, and device and browser type. This data is collected by the product analytics provider named in section 5 and is used to understand and improve the Service. It is not used for advertising and is not combined with the contents of files you upload.
We do not operate advertising or cross-site tracking software on the Service.
3. How We Use Information
We use the information described above in order to:
- provide, operate and maintain the Service;
- process the files you submit and return the resulting data to you;
- authenticate you and secure your account;
- administer subscriptions, billing and applicable taxes;
- respond to your enquiries and provide support;
- detect, prevent and address technical issues, abuse and fraud; and
- comply with our legal and regulatory obligations.
We do not sell personal data. We do not use the files you upload, or data derived from them, to train machine learning models, and we do not permit our service providers to do so.
4. Legal Bases for Processing
Where the General Data Protection Regulation applies, we process personal data on the following bases: performance of a contract, in respect of your account, the processing of your files and the provision of the Service; compliance with a legal obligation, in respect of accounting and tax records; our legitimate interests in securing the Service and preventing abuse, in respect of session and server records; and consent, in respect of analytics cookies and the usage data collected through them.
5. Service Providers
We disclose personal data to the following service providers, each of which processes it solely on our instructions and for the purposes described.
| Name | Where | What for |
|---|---|---|
| Hetzner Online GmbH | Germany | Hosting of application servers and databases. |
| Cloudflare, Inc. | European Union jurisdiction | Object storage for uploaded files and processing responses. The storage bucket is provisioned with European Union jurisdiction, so objects are stored and processed within the European Union. |
| Mistral AI SAS | France | Optical character recognition, where a file cannot be read directly. |
| Stripe, Inc. and Stripe Payments Europe, Ltd. | Ireland and United States | Payment processing, subscription management and tax collection. |
| Resend, Inc. | United States | Delivery of transactional email, including authentication messages. |
| PostHog, Inc. | European Union | Product analytics. Receives usage data as described in section 2 and does not receive the contents of files you upload. |
We may also disclose personal data where required to do so by law, or where necessary to establish, exercise or defend legal claims.
6. Files You Upload
Files which can be read directly are processed on our own infrastructure and are not disclosed to any third party. Files which require optical character recognition are made available to the provider named in section 5 by means of a time-limited link which expires one hour after it is issued. No other third party is given access to the files you upload.
7. Data Retention
Files you upload are deleted automatically within 24 hours of being processed, together with any processing response associated with them. They are not retained beyond that period.
The data extracted from a file is retained in your account until you delete it or until your account is closed, so that it remains available for you to export. Deleting an extracted record removes it and any remaining associated data.
Account data is retained for the duration of your account. Records which we are required to retain for accounting, tax or other legal purposes are retained for the period prescribed by the applicable law and are then deleted.
8. International Transfers
Application servers, databases and uploaded files are located within the European Union. Certain service providers named in section 5 are established outside the European Economic Area. Where personal data is transferred outside the European Economic Area, that transfer is made pursuant to an adequacy decision of the European Commission or on the basis of Standard Contractual Clauses.
9. Cookies
We use a cookie which is strictly necessary for the operation of the Service. It maintains your authenticated session and contains a short-lived signed copy of that session. It expires when your session expires. No consent is required for this cookie.
We also use analytics cookies, set by the provider named in section 5, to collect the usage data described in section 2. Nothing is stored on your device and nothing is sent to that provider unless you have agreed: you are asked when you first arrive, and analytics remain switched off until you say otherwise.
You may withdraw that consent at any time using the "Analytics preferences" link in the footer of any page, which asks the question again. Withdrawing stops any further collection.
We do not use advertising cookies or cross-site tracking pixels.
10. Security
We implement technical and organisational measures appropriate to the risk, including encryption of data in transit, storage of uploaded files in private buckets accessible only by time-limited signed links, and storage of credentials in hashed form. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Your Rights
Where the General Data Protection Regulation or equivalent legislation applies, you have the right to request access to your personal data, to request its rectification or erasure, to request restriction of or object to its processing, to receive it in a structured and machine-readable format, and to withdraw consent where processing is based on consent.
Data extracted from your files may be exported from the Service at any time, and any file may be deleted from within the Service. For all other requests, contact us at the address in section 14. We will respond within one month of receipt, which period may be extended by a further two months where a request is complex.
You also have the right to lodge a complaint with the supervisory authority in the country in which you reside or work.
12. Children
The Service is intended for business use and is not directed to persons under the age of 16. We do not knowingly collect personal data from persons under that age. If you believe that we have done so, contact us and we will delete it.
13. Changes to This Policy
We may update this Policy from time to time. The date at the head of this page indicates when it was last revised. Where changes are material, we will notify account holders by email before they take effect.
14. Contact
Questions about this Policy, and requests in respect of your personal data, should be sent to [email protected], or in writing to TGD SOLUTIONS EURL, 11 rue Surcouf, 75007 Paris, France.
The supervisory authority for our establishment is the Commission Nationale de l’Informatique et des Libertes (CNIL), 3 Place de Fontenoy, 75007 Paris, France.