Taje Privacy Policy

TRASIMENE SAS, 61 rue de Lyon, 75012 Paris: contact@trasimene.com. In accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi Informatique et Libertés), you have rights over your personal data. The data protection contact can be reached at the same email address.

User account: email address, name, hashed password (bcrypt, not readable by TRASIMENE SAS) or, if you sign in with Google or Apple, the identifier that this service assigns to your account together with the name and email address it sends us; registration date, unique identifier, the account's app (Taje), language, preferences (notifications, newsletter), profile photo if you add one. Our servers also record the platform, the app version, the device model and, on Android, the store that installed the app; they infer the account's country from your IP address once, using a geolocation database installed on our servers, without keeping the IP address.

As an account is signed in on only one device at a time, our servers keep the identifier of the signed-in device. This identifier is specific to Taje: on Android, it is computed from the device identifier and the name of the app; on iPhone, it is a number generated at random on first opening and kept in the phone's keychain, which retains it even if you uninstall the app.

Account security and logs: technical logs of our servers (IP address, user-agent, date and time, address of the request); account security history (sign-up, sign-ins and failed sign-ins, password reset, sign-outs: date, IP address and user-agent); push notifications (Firebase or Apple token, revocable). On Android, at sign-up and at sign-in, the app attaches a Google Play Integrity token, verified with Google, which attests that the app and the device are genuine.

Free check without an account: on first opening, Taje offers to let you scan a QR code without creating an account, and the first check of a link is free. When this first link is checked, the app opens with our servers a guest session specific to Taje, linked to the device identifier (see “User account”), with the phone's language and, on Android, its model. Our servers keep this guest (device identifier, language, creation date, number of checks used) so that only one free check is offered per device. The check follows the rules of the “Link checking” paragraph below; it is not entered in the check history, and the internal measurements sent during this session are linked to the guest. Our servers do not link this guest to the account you create afterwards: they erase it as soon as a Taje account is created or signed in to on this phone, and at the latest 12 months after its creation.

Link checking (QR code or typed address): the code is read on your phone (on Android by Google's ML Kit reading tool, built into the app; on iPhone by Apple's reader). Only web links, that is, addresses that begin with http:// or https://, go to our servers; a site name on its own, for example “exemple.fr”, is completed as “https://exemple.fr”. Any other content of a code (Wi-Fi network and its password, contact card, email address, phone number, text) stays on your phone: it is displayed without being sent. Each link checked is sent in full to our servers, which compare it with their lists of dangerous sites and with Google Safe Browsing, and follow its redirects to judge its destination as well. To do this, our servers:

• send Google Safe Browsing the name of the site or, when the site is hosted on a platform shared by many sites or designated by an IP address, the full address, without what follows the “#” sign and without any login credentials;
• resolve the name of the site with the public DNS resolvers of Google and Cloudflare;
• open the address from our servers to follow its redirects: the target site, and each site to which it redirects, then receives a visit coming from our servers, not from your phone;
• consult, with the site name alone, the public certificate logs (crt.sh, Cert Spotter) and the public directory of domain names (RDAP service rdap.org, which forwards the request to the domain's registry) to show you the age of its certificate and the creation date of the domain.

The VirusTotal service is not queried. The usage measurements linked to a check never contain the address checked.

Check history: for each check made with your account that results in a verdict, our servers keep, linked to your account, the address checked (without any login credentials it might contain, in the form user:password@), the site name, the verdict and its category, and the date. You can view it, with a current subscription, in the app and in your Taje account area on trasimene.com; you can erase one entry or the whole history at any time. Each entry is erased automatically after 90 days, with or without a current subscription, and the whole history is erased with your account (see Article 12). As an address may contain personal information (for example an identifier placed in a link you received), avoid checking links you do not want a record of, or erase them afterwards.

Blocklist of our servers: when a check reveals that a site is dangerous according to Google Safe Browsing (or, for an IP address, according to our threat intelligence sources), our servers add the name of this site, or the public IP address, to their blocklist, which is used by all the security services of TRASIMENE SAS. Only the exact name of the site, or the IP address, is entered, never the full address, and with no link to your account. Shared hosting platforms and trusted domains are never entered automatically, and very popular sites first go through a human review. These entries are kept for 6 months. To limit abuse, our servers count the entries triggered by each account, or by each guest, during the day (20 at most), in the form of a hash of its identifier, kept for 2 days. A site entered by mistake can be reported to us at contact@trasimene.com.

QR code generator: the QR code is created entirely on your phone; Taje sends what you enter nowhere (link, text, Wi-Fi network and its password, contact card). You can save it to your photos (on iPhone, with your permission to add photos; on Android, in the phone's “Pictures/Taje” folder, without any special permission) or share it: the image to be shared is prepared in the space reserved for the app on your phone (on iPhone, it is erased after sharing; on Android, it is replaced at the next share). Only the fact that a QR code has been created is counted in our usage measurements, without its content.

Notifications: once you are signed in, our servers record your device's notification token (Firebase or Apple) to send you Taje messages (subscription, account, service information). They are displayed only if you have allowed notifications: the app offers this to you only once, the first time you arrive in the app, and you can turn them off at any time in the settings of the phone or of the app. The content of the messages sent is kept for 7 days. No notification is sent to a guest.

Usage measurement in the app: to learn which screens are used and improve the app, Taje sends Firebase Analytics (Google) the screens displayed and the steps of the journey (sign-up, sign-in, subscription, reading of a code with its verdict, opening of a link, creation of a QR code), never the address checked or the content of a code, as well as the information that Firebase collects by itself (phone model, system version, approximate country, sessions). Once you are signed in, Firebase Analytics links this data to your account identifier and, on Android, to the device identifier. On Android, Google Play reports the uninstallation of the app to Firebase; our servers link this event to your account to measure the loyalty of our users. On Android, sign-up is also reported to Google Analytics as a standard event, which can be used to measure the effectiveness of our Google Ads campaigns. The app does not ask for tracking permission on iPhone and does not collect the advertising identifier on Android. This measurement is on from installation; you can turn it off at any time in the app, “My Account” tab, then your profile, “Usage analytics” switch.

Internal measurement and error reports:

• Internal measurement: on first opening, when the app is opened (at most once a day on Android, at each session on iPhone), when the scanner is displayed, when a code that is not a web link is read and when a QR code is created, the app sends our servers the event type, the platform, the device identifier, the app and system version, the model, the language and the date, without the address checked or the content of a code. Our servers also count each link check, with its outcome (safe or dangerous), without the address. They infer the country from your IP address, with the same geolocation database, without keeping the IP address, and link these events to your account, or to the guest, as soon as a session is open.
• Crashes: after an abrupt closure, the app sends our servers the model, the versions, the device identifier, the screen displayed, the error type and a message of no more than 256 characters. Technical reports of the same kind go to Firebase Crashlytics (Google) and to Sentry, without your name or your email address; on iPhone, those sent to Sentry carry the device identifier.
• Neither the internal measurement nor the error reports depend on the “Usage analytics” setting.

Installation source: on first opening, the app sends our servers the source of its installation, so that we know which campaign or website led you to Taje. On Android, it is the install referrer provided by Google Play (source, campaign and, if there is one, click identifier), also attached to your sign-up. On iPhone, this is an attribution token provided by Apple (AdServices): our servers exchange it with Apple for the Apple Search Ads campaign, ad group, keyword and country, when the installation comes from one of these ads; this Apple service asks for no tracking permission. This source is recorded with the device's first-opening event, which is erased after 13 months, then copied to your account; the account's copy is erased together with the account.

Support: if you write to support from the app or from your Taje account area on trasimene.com, we receive your message, its subject and the attachments you add (two at most, one document and one image, 5 MB each), with your name and your email address taken from your account, and technical information sent by the app (device identifier, model, system version, app version, time zone and, on Android, security patch level). To be able to reply to you, our servers attach to it a record taken from your account: status of your subscription (plan, store, price paid, dates), registration date and last sign-in date, whether or not the email address is confirmed, country, language, device (platform, model, system, installation store, identifier) and your previous requests. All of this reaches us by email in the contact@trasimene.com mailbox; the message is also recorded for follow-up. Without a signed-in account, the app opens your own email app addressed to contact@trasimene.com.

Cancellation survey and reasons for deletion: when you open the management of your subscription, the app may ask you why you are leaving (choice from a list and optional comment); when you delete your account, you can also state your reasons. These answers are optional, linked to your account, used to improve Taje and erased with your account.

Newsletter: there is only one newsletter, that of the Trasimène team (news and tips), shared by all our apps. When you sign up by email, in the app as on trasimene.com, the “Newsletter” box is ticked by default; you can untick it. If it remains ticked, your email address and your name join our mailing list at Resend, once your address is confirmed. You can unsubscribe at any time via the link in each newsletter, or in your account settings.

Payment: no card data is stored by TRASIMENE SAS. Subscriptions purchased in the App Store or on Google Play are managed by Apple or Google; those purchased on trasimene.com are paid by card with our PCI-DSS certified payment provider (Stripe), via RevenueCat. As soon as the app is opened, RevenueCat receives an anonymous identifier to show you the offers and their prices; once you are signed in, it receives your Taje account identifier to link the subscription to your account, and sends us the events of your subscription (purchase, renewal, cancellation, expiry, amount). We keep your payment history (date, plan, price, store used), including after your account is deleted (see Article 04).

On-device access: camera (scanner only; the code is read on the phone), notifications and, on iPhone, adding images to your photos (saving a QR code you have created). For a profile photo or an image attached to a support message, you choose the image yourself in the phone's picker: Taje receives only that image. Taje does not ask for location, the list of your apps, or access to your files, your contacts or your notifications, and does not read the clipboard. This data is never sold.

• Contract performance and pre-contractual steps taken at your request (Art. 6.1.b GDPR): user account, link checking and check history, free check without an account, subscription management, service notifications, support.
• Consent (Art. 6.1.a GDPR): analytics and marketing cookies of the trasimene.com website (see Article 06).
• Legitimate interests (Art. 6.1.f GDPR): platform security and fraud prevention (including Play Integrity, the limits on the free check and on the blocklist, and the identifiers of banned accounts), error reports (Sentry, Firebase Crashlytics, crash reports sent to our servers), usage measurement in the app (can be refused with the “Usage analytics” switch), internal operational measurement, installation source, cancellation survey and reasons for deletion, and the blocklist of our servers, fed by the checks, for the benefit of all the users of our services.
• Direct marketing to our customers (Article L34-5 of the French Postal and Electronic Communications Code; legitimate interests, Art. 6.1.f GDPR): sending of the newsletter, which presents services similar to those you use. You can refuse it at sign-up by unticking the box, then at any time via the link in each mailing or in your account settings.
• Legal obligation (Art. 6.1.c GDPR): retention of your payment history (date, plan, price, store used), including after your account is deleted, for 10 years, the retention period for accounting records (Article L123-22 of the French Commercial Code).

• Account: kept for as long as you do not delete it, whether or not a subscription is current. An account with no sign-in at all for 3 years is deleted; an email notifies you 30 days beforehand.
• Technical logs of our servers: 30 rolling days.
• Account security history: 7 days.
• Check history: 90 days per entry, can be erased at any time, erased with the account.
• Guest (free check without an account): erased as soon as a Taje account is created or signed in to on the same phone, and at the latest 12 months after its creation.
• Blocklist: 6 months per entry, with no link to an account; names awaiting human review: 90 days after they last appeared; daily counter of entries: 2 days.
• Internal measurement (usage and crash events sent by the app, counts made by our servers): 13 months at most, including for events sent without an account; the count of checks made by our servers is erased after 35 days.
• Content of the notifications sent: 7 days.
• Support requests: 3 years after the last exchange, including after the account is deleted.
• Cancellation survey, reasons for deletion and installation source copied to the account: until the account is erased.
• Newsletter: until you unsubscribe; your address then remains recorded as unsubscribed, so that nothing more is sent to you, until your account is erased.
• Payments: 10 years, including after the account is deleted.
• Ban: in the event of a ban for breach of the terms of use, the identifiers that make it possible to enforce it (email address, account identifier, Google or Apple identifier, device identifier) are kept for 5 years, even after the account is deleted.
• Account deletion: see Article 12.

TRASIMENE SAS uses the following providers, which process data on its behalf and are bound by a GDPR-compliant data processing agreement:

• Google Cloud: hosting of the API and the data (accounts, check history, blocklist) in region europe-west1 (Belgium, EU) and technical logs (Cloud Logging), https://cloud.google.com/security/compliance/gdpr
• Firebase (Google LLC): Cloud Messaging for notifications (device token, title and text of the notifications sent), Analytics for usage measurement and Crashlytics for crash reports (see “Usage measurement in the app”), https://firebase.google.com/support/privacy
• Google Safe Browsing (Google LLC): checking of links (name of the site, or full address in the cases described under “Link checking”), https://safebrowsing.google.com/
• Sentry (Functional Software Inc.): error reports from the apps and from our servers; servers in the European Union for the apps, https://sentry.io/privacy
• RevenueCat Inc.: management of subscriptions taken on the App Store, Google Play and trasimene.com (account identifier, purchases, subscription status), https://www.revenuecat.com/privacy
• Stripe Inc.: card payment on trasimene.com, via RevenueCat; card details are entered at Stripe and never pass through our servers, https://stripe.com/privacy
• Resend Inc.: sending of our emails (address confirmation, password, account deletion, subscription, newsletter); for the newsletter, your address and your name are on our mailing list at Resend, https://resend.com/legal/privacy-policy
• Infomaniak Network SA (Switzerland): mailbox of contact@trasimene.com, where your messages to support arrive, https://www.infomaniak.com/fr/cgv/politique-de-confidentialite

Recipients that process data on their own behalf, as part of the service:

• Apple Inc.: App Store, notifications on iPhone (APNs), Apple sign-in, attribution of installations from Apple Search Ads (AdServices), https://www.apple.com/legal/privacy
• Google LLC: Google Play, Play Integrity, Google Play install referrer, Google sign-in, and ML Kit, the code reading tool on Android, which sends Google performance and usage measurements of the tool, never the image or the content read, https://policies.google.com/privacy
• the public DNS resolvers of Google and Cloudflare, which receive from our servers the name of the sites checked;
• the public certificate logs crt.sh (Sectigo) and Cert Spotter (SSLMate), the RDAP service rdap.org and the registry of the domain concerned, which receive from our servers the name of the sites checked;
• the sites checked themselves, which our servers visit to follow their redirects.

The Taje app does not set cookies. The pages of trasimene.com, including those the app opens (legal documents) and your Taje account area, use the cookies described in the privacy policy of the trasimene.com website: essential cookies without consent, analytics and marketing cookies with consent, which you can manage at any time via the “Manage cookies” button at the bottom of the page.

Under Articles 15 to 22 of the GDPR, you have the following rights:

Right of access (Art. 15) · Right to rectification (Art. 16) · Right to erasure (Art. 17) · Right to data portability (Art. 20) · Right to object (Art. 21) · Right to restriction of processing (Art. 18) · Right to withdraw your consent at any time.

To exercise your rights: contact@trasimene.com, or support in your signed-in area (in the app, or in your Taje account area on trasimene.com, see https://trasimene.com/apps/taje/support), response within 30 days. Proof of identity may be requested. State the app concerned (Taje) and the email address of the account: any accounts you may have in our other apps are separate accounts. You can erase all or part of your check history yourself at any time, in the app or in your Taje account area on trasimene.com.

If you believe that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, https://www.cnil.fr

Your account data and your check history are hosted in the European Union (Google Cloud, Belgium). The technical logs of our servers are kept by Google Cloud with no commitment as to region. Some providers process data outside the Union: Sentry (a US company, with app data stored in the Union), RevenueCat, Stripe, Resend, Google (Firebase, Safe Browsing, Play Integrity, ML Kit, Google sign-in) and Apple (notifications, Apple sign-in, Apple Search Ads attribution) in the United States. Infomaniak processes data in Switzerland, a country recognised by the European Commission as offering equivalent protection. These transfers are governed by standard contractual clauses approved by the European Commission, by the EU-US Data Privacy Framework where the provider is certified under it, or by an adequacy decision. The DNS resolvers, the certificate logs, the RDAP directory, the domain name registries and the sites checked may be located outside the Union: they receive from our servers only site names or, for the sites checked, the address of the link, with nothing else that identifies you.

Access to the service is restricted to adults; minors must obtain the express consent of the holder of parental authority (see the Terms of Service). In accordance with Article 45 of the French Data Protection Act (loi Informatique et Libertés), a minor under 15 years of age cannot consent alone to the processing of their personal data: the joint consent of the minor and the holder of parental authority is required. The holder of parental authority may exercise GDPR rights on behalf of the minor by writing to contact@trasimene.com.

In accordance with Article 85 of the French Data Protection Act (loi Informatique et Libertés), you may set directives regarding the retention, erasure and disclosure of your personal data after your death, and modify them at any time by writing to contact@trasimene.com. In the absence of directives, your heirs may exercise certain rights under the conditions provided by law.

You can delete your Taje account at any time: in the app, from your profile (“Delete my account”, at the bottom of the page) or from the subscription screen; or on trasimene.com, in your Taje account area, “Settings” section. The steps to follow are set out on the page https://trasimene.com/apps/taje/delete-account. Deletion concerns only your Taje account: an account created with the same address in another of our apps remains active.

As soon as you confirm, your access is cut off: you are signed out on all your devices, no one can sign in to your account any more, your notification tokens are erased and your newsletter subscription is removed if none of your other accounts with us is subscribed to it. An email confirms the deletion and the date of permanent erasure. Nothing else is erased at that moment: 30 days after your request, everything that belongs to your account is erased (including the check history, the security history, the internal measurements linked to the account, your answers to the surveys and your profile photo), the account record last.

We keep your payment history (10 years), your messages to support (3 years after the last exchange) and, in the event of a ban, the identifiers that make it possible to enforce it (5 years). Internal measurement events that are not linked to your account, such as the first opening of the app, are erased after 13 months. The sites entered in the blocklist of our servers, which are not linked to your account, remain there until they expire.

Deleting your account does not stop a subscription taken on the App Store or on trasimene.com: cancel it first where you took it (see the page https://trasimene.com/apps/taje/delete-account). For a Google Play subscription, we also ask Google to cancel it at the time of deletion; check afterwards that the cancellation does appear in Google Play.