Trebia Privacy Policy

TRASIMENE SAS, 61 rue de Lyon, 75012 Paris: contact@trasimene.com. In accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi Informatique et Libertés), you have rights over your personal data. The data protection contact can be reached at the same email address.

Account: email address, name, hashed password (bcrypt, unreadable by TRASIMENE SAS) or, if you sign in with a Google account, or with an Apple account on iPhone and on trasimene.com, the identifier that this service sends us together with your email address and your name; registration date, unique identifier, the account's app (Trebia), language, preferences (notifications, newsletter, usage analytics) and profile photo if you add one.

At sign-up, at each sign-in and at each session renewal, our servers also record the platform, the app version, the device model and, on Android, the store from which the app was installed. They infer the account's country from your IP address once only, using a geolocation database installed on our servers, without keeping the address, and never when the connection goes through one of our VPN servers (the address would then be that of the server).

As an account can only be signed in on one device at a time, our servers keep the identifier of the signed-in device: on Android, a hash specific to Trebia computed from the phone's Android identifier; on iPhone, an identifier generated at random at installation and kept in the phone's keychain.

Account security and logs: security history of your account (sign-up, sign-ins, failed sign-ins, password change: date, IP address and technical description of the device or browser), viewable in your profile; technical logs of our servers (IP address, technical description of the device or browser, date and address of each request). On Android, at sign-up and at sign-in, the app attaches a Google Play Integrity token, verified with Google, which attests that the app and the device are genuine.

Notifications: the app offers you only once to allow notifications, the first time you arrive in the app. When you are signed in, our servers record your device's notification token (Firebase Cloud Messaging and, on iPhone, Apple's notification service) to send you Trebia messages (account, subscription, service information). These messages are displayed only if you have allowed notifications; you can turn them off at any time in the phone's settings.

Approximate location inferred from the IP address: the VPN screen shows a map and the IP address visible on the Internet, before and after connecting. To do this, the app asks our servers for the location that corresponds to the IP address from which it contacts them: your public IP address or, once the VPN is connected, that of the VPN server. Using a geolocation database installed on our own systems (DB-IP Lite, db-ip.com, licensed under CC BY 4.0), our servers infer from it the country, the region, the city, approximate coordinates and, if the database knows it, the Internet service provider. No address is sent to an external service for this purpose, and our servers do not keep the response. The map is provided by Google Maps on Android and by Maps (Apple) on iPhone, which receive the requests for the base map of the area displayed. The last IP address displayed, the city and the coordinates are kept on the phone for immediate display, and erased when you sign out of your account. The app never asks for access to the phone's location.

Usage measurement in the app: to learn which screens are used and improve the app, it sends Firebase Analytics (Google) the screens displayed and the steps of the journey (sign-up, sign-in, subscription, VPN connection and disconnection with the country of the chosen server), the phone model and the system version; Firebase Analytics links them to your account identifier and, on Android, to the device identifier described above. On Android, sign-up is also reported to Firebase Analytics through an event that Google Ads can use to measure our advertising campaigns. The content of your traffic is never part of it. This measurement is on from installation; you can turn it off at any time in the app, “My Account” tab, then your profile, “Usage analytics” switch. This setting turns off neither the internal measurement nor the error reports described below. The app does not ask for tracking permission on iPhone and does not use the advertising identifier on Android.

Error reports: in the event of a crash or error, Sentry and Firebase Crashlytics receive the technical trace, the device model, the system and app versions and a technical identifier of the device, without your name or your email address. They do not depend on the “Usage analytics” setting, because they are used to fix failures.

Internal measurement: on first opening, each time the app is opened (once a day on Android, each time it comes to the foreground on iPhone), each time the VPN screen is opened and after a crash, the app sends our servers the event type, the platform, the device identifier, the app and system version, the device model, the language and the date; for a crash, the screen displayed, the error type and a message of no more than 256 characters. Our servers infer the country from the IP address, with the same geolocation database, without keeping the address, and link these events to your account when you are signed in.

Installation source: on first launch, the app sends our servers the source of its installation, so that we know which campaign or website led you to Trebia. On iPhone, this is an attribution token provided by Apple (AdServices): our servers exchange it with Apple for the Apple Search Ads campaign, ad group, keyword and country, when the installation comes from one of these ads; this Apple service asks for no tracking permission. On Android, it is the install referrer provided by Google Play (source, campaign and, if there is one, click identifier), also attached to your sign-up. This source is recorded with the device's first-opening event, which is erased after 13 months, and copied to your account, where it is erased together with the account.

Support: if you write to support from the app or from your Trebia account area on trasimene.com, we receive your name, your email address, the subject, your message and the attachments you add (one document and one image at most), as well as technical information: device identifier, model, system version, app version, time zone and, on Android, security patch level. To handle your request, our servers attach to your message a summary of your account: plan, status, price and store of the subscription, subscription and renewal dates, registration date, sign-in methods, whether or not the email address is verified, country, language, installation store and number of previous requests. All of this arrives in our contact@trasimene.com mailbox; the request (name, email address, subject, message, platform, version) is also recorded for follow-up. If you write to us directly by email, we receive what your email contains.

Reasons for cancellation and deletion: if you state why you want to cancel (before opening the management of your subscription) or why you are deleting your account, we record the reasons chosen and your comment, linked to your account, to improve the service. These answers are optional.

Newsletter: there is only one newsletter, that of the Trasimène team (news and tips), shared by all our apps. When you sign up by email, the “Newsletter” box is ticked by default; you can untick it. If it remains ticked, your email address and your name join our mailing list at Resend, once your address is confirmed. You can unsubscribe at any time via the link in each newsletter, or with the “Newsletter” switch in your profile.

Payment: no card data is stored by TRASIMENE SAS. Subscriptions purchased on the App Store or on Google Play are managed by Apple or Google; those purchased on trasimene.com are managed by RevenueCat and paid through Stripe, our PCI-DSS certified payment provider. As soon as the app is opened, RevenueCat receives an anonymous identifier to show you the offers and their prices; once you are signed in, it receives your Trebia account identifier, to link the subscription to your account, and sends us the events of your subscription (purchase, renewal, cancellation, expiry, price paid).

On-device access: on Android, Internet and network state (granted at installation), the system VPN permission, running a foreground service indicated by a persistent notification while the tunnel is active, and notifications. On iPhone, adding a VPN configuration and notifications. Trebia does not ask for location, the list of your apps, or access to your files, contacts, photos or notifications; if you choose a profile photo or an attachment, only the image you select is read. This data is never sold.

Trebia encrypts your device's traffic with the WireGuard® protocol up to the VPN server you choose, and masks your IP address: the sites and services you visit see the address of that server. All of the device's traffic goes through the tunnel; on Android, only Google Play and Google Play services are excluded from it, so that purchases work. Trebia neither filters nor blocks any site. When you use it:

• Content and sites visited: we do not read, record or keep the content of your traffic, or the list of the sites you visit.
• History of your connections: for each connection, our servers record the chosen server, your device's WireGuard public key, the address assigned to your device in the tunnel, the connection time, the time of the last presence signal sent by the app (roughly every 4 to 5 minutes while the tunnel is active) and the disconnection time. This information is used to open and close your access to the server, to balance the load across the servers, to re-establish the tunnel after standby and to show you your last connection. It is erased automatically 72 hours after your access ends, that is, after you disconnect or, at the latest, 7 days after the connection was opened. Your public IP address is not recorded in this history.
• Connections counted for our statistics: each connection opened is also recorded for our usage statistics (account, app, platform, time). This record is erased after 72 hours; we then keep only numbers, such as the number of VPN connections and users per day, without any account identifier.
• Data volume: the subscription has no data limit. Our servers record the volume of data received and sent by each account, totalled per month, to monitor the load and cost of the service internally; this record leads to no limit and no action on your subscription. Each monthly total is kept for 13 months.
• Encryption keys: the WireGuard key pair is created on your device, at each connection. Only the public key is sent to our servers; the private key does not leave your device. On iPhone, it is kept in the keychain, together with the tunnel access token (valid for 7 days) that lets the iPhone re-establish the connection without opening the app.
• Your real IP address: while the tunnel is open, the VPN server knows, like any WireGuard server, the public IP address from which your device connects. It stays in the server's memory and is not recorded by us.
• Resolution of site names: the DNS queries (the translation of site names into addresses) issued in the tunnel are sent to Cloudflare's public resolvers (1.1.1.1 and 1.0.0.1). They reach them from the IP address of our VPN server, not from yours. We neither receive nor keep these queries.
• Your Trebia account area on trasimene.com: when signed in to your Trebia account on trasimene.com, you see your device (model and platform), the date of your last VPN connection, whether the tunnel is active, and the country and city of the server used; neither your IP address nor your data usage is shown there.
• Servers: traffic passes only through WireGuard servers that TRASIMENE SAS sets up and runs itself, on virtual machines rented from Google Cloud, in the countries listed in the app (see Article 09). When you choose a server located outside the European Union, your traffic exits onto the Internet from that country.
• No monetisation: we do not sell, share or redirect your traffic for advertising or commercial purposes.
• Automatic connection: for subscribers, it is enabled by default. On Android, the VPN connects when the app is opened; it does not start with the phone. On iPhone, a system “on-demand” rule re-establishes the tunnel as soon as a network is available, without opening the app. You can turn it off at any time in the VPN screen. On iPhone, the app removes this rule and the VPN configuration from the phone when you sign out of your account, when you delete it, and when the end of your subscription is established.

• Contract performance (Art. 6.1.b GDPR): user account, provision of the VPN (connection history, keys, Trebia account area on trasimene.com), approximate location shown on the VPN screen, subscription management, service notifications and emails, support.
• Consent (Art. 6.1.a GDPR): analytics and marketing cookies of the trasimene.com website (see Article 06).
• Legitimate interests (Art. 6.1.f GDPR): platform security and fraud prevention (Play Integrity, security history, technical logs, signed-in device, identifiers of banned accounts), error reports (Sentry, Firebase Crashlytics), usage measurement in the app (can be refused with the “Usage analytics” switch), internal measurement, connections counted for our statistics, installation source, monitoring of the volume of data exchanged (load and cost of the service), reasons for cancellation and deletion.
• Direct marketing to our customers (Article L34-5 of the French Postal and Electronic Communications Code; legitimate interests, Art. 6.1.f GDPR): sending of the newsletter, which presents services similar to those you use. You can refuse it at sign-up by unticking the box, then at any time via the link in each mailing or in your profile.
• Legal obligation (Art. 6.1.c GDPR): retention of your payment history (date, plan, price, store used), including after your account is deleted, for 10 years, the retention period for accounting records (Article L123-22 of the French Commercial Code).

• Account: for as long as you do not delete it. An account with no sign-in at all for 3 years is deleted; an email notifies you 30 days beforehand.
• VPN connection history: erased 72 hours after access ends (disconnection or, at the latest, 7 days after the connection was opened).
• Connections counted for our statistics: 72 hours; only numbers, without any account identifier, are kept afterwards.
• Volume of data exchanged: each monthly total, 13 months.
• Account security history: 7 days.
• Technical logs of our servers: 30 rolling days.
• Notifications displayed in the app: 7 days.
• Internal measurement and crash reports sent to our servers: 13 months, including events sent before any sign-in to an account, such as the first opening.
• Installation source copied to the account, reasons for cancellation and deletion: until the account is erased.
• Support requests: 3 years after the last exchange, including after the account is deleted.
• Payment history: 10 years, including after the account is deleted.
• Ban: in the event of a ban for breach of the terms of use, the identifiers that make it possible to enforce it (email address, account identifier, Google or Apple identifier, device identifier) are kept for 5 years, even after the account is deleted.
• Newsletter: until you unsubscribe; your address then remains recorded as unsubscribed, so that nothing more is sent to you, until your account is erased.
• Account deletion: see Article 12.

TRASIMENE SAS uses the following providers, which process data on its behalf and are bound by a GDPR-compliant data processing agreement:

• Google Cloud: hosting of the API and the data (accounts, VPN connection history, volumes) in region europe-west1 (Belgium, EU), technical logs (Cloud Logging) and VPN server machines in 19 countries (see Article 09), https://cloud.google.com/security/compliance/gdpr
• Firebase (Google LLC): Cloud Messaging for notifications (device token, title and text of the notifications sent), Analytics for usage measurement and Crashlytics for crash reports, https://firebase.google.com/support/privacy
• Sentry (Functional Software Inc.): error reports from the apps and the API; servers in the European Union for the apps, https://sentry.io/privacy
• RevenueCat Inc.: management of subscriptions taken on the App Store, Google Play and trasimene.com (account identifier, purchases, subscription status), https://www.revenuecat.com/privacy
• Stripe Inc.: card payment on trasimene.com, via RevenueCat; card details are entered at Stripe and never pass through our servers, https://stripe.com/privacy
• Resend Inc.: sending of our emails (address confirmation, account, subscription, newsletter); for the newsletter, your address and your name are on our mailing list at Resend, https://resend.com/legal/privacy-policy
• Infomaniak Network SA (Switzerland): mailbox of contact@trasimene.com, where your messages to support arrive, https://www.infomaniak.com/fr/cgv/politique-de-confidentialite

Recipients that process data on their own behalf, as part of the service:

• Apple Inc.: App Store, notifications on iPhone, Apple sign-in, attribution of installations from Apple Search Ads (AdServices) and Maps for the map on the VPN screen on iPhone, https://www.apple.com/legal/privacy
• Google LLC: Google Play, Google sign-in, Play Integrity (which proves to our servers that the Android device and app are genuine), Google Play install referrer and Google Maps for the map on the VPN screen on Android, https://policies.google.com/privacy
• Cloudflare, Inc.: resolution of the site names requested in the VPN tunnel (public resolvers 1.1.1.1 and 1.0.0.1), which receives these queries from the address of our VPN server, never from yours, https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/

The Trebia app does not use cookies. The Trebia pages on trasimene.com (presentation, purchase, Trebia account area) use the cookies described in the privacy policy of the trasimene.com website: essential cookies without consent, analytics and marketing cookies with consent, which you can manage at any time with the “Manage cookies” button at the bottom of the page.

Under Articles 15 to 22 of the GDPR, you have the following rights:

Right of access (Art. 15) · Right to rectification (Art. 16) · Right to erasure (Art. 17) · Right to data portability (Art. 20) · Right to object (Art. 21) · Right to restriction of processing (Art. 18) · Right to withdraw your consent at any time.

To exercise your rights: contact@trasimene.com, or support in your signed-in area (in the app, or on trasimene.com after signing in to your Trebia account, see https://trasimene.com/apps/trebia/support), response within 30 days. Proof of identity may be requested. State the app concerned (Trebia) and the email address of the account: any accounts you may have in our other apps are separate accounts.

If you believe that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, https://www.cnil.fr

Your account data, the history of your VPN connections and your monthly volumes are hosted in the European Union (Google Cloud, Belgium). The technical logs of our servers are kept by Google Cloud with no commitment as to region. Some providers process data outside the Union: Sentry (a US company, with app data stored in the Union), RevenueCat, Stripe, Resend, Google (Firebase, Play Integrity, Maps, Google sign-in) and Apple (notifications, Apple sign-in, Apple Search Ads attribution, Maps) in the United States. Infomaniak processes data in Switzerland, a country recognised by the European Commission as offering equivalent protection. These transfers are governed by standard contractual clauses approved by the European Commission, by the EU-US Data Privacy Framework where the provider is certified under it, or by an adequacy decision. Cloudflare's DNS resolvers may respond from servers located outside the Union: they receive only the site names requested, from the address of our VPN server, with nothing that identifies you.

Trebia lets you choose a VPN server in 19 countries: France, Germany, the Netherlands, Poland and Finland within the Union; the United Kingdom, Switzerland, the United States, Canada, Brazil, South Africa, Qatar, India, Singapore, Indonesia, Japan, South Korea, Taiwan and Australia outside it. When you choose a server outside the Union, your encrypted traffic passes through that machine, rented from Google Cloud and run by TRASIMENE SAS, which knows your IP address for the duration of the connection, then exits onto the Internet from that country; the history of your connections, for its part, remains stored in the Union.

Access to the service is restricted to adults; minors must obtain the express consent of the holder of parental authority (see the Terms of Service). In accordance with Article 45 of the French Data Protection Act (loi Informatique et Libertés), a minor under 15 years of age cannot consent alone to the processing of their personal data: the joint consent of the minor and the holder of parental authority is required. The holder of parental authority may exercise GDPR rights on behalf of the minor by writing to contact@trasimene.com.

In accordance with Article 85 of the French Data Protection Act (loi Informatique et Libertés), you may set directives regarding the retention, erasure and disclosure of your personal data after your death, and modify them at any time by writing to contact@trasimene.com. In the absence of directives, your heirs may exercise certain rights under the conditions provided by law.

You can delete your Trebia account in the app (“My Account” tab, then your profile, “Delete my account”; the same link appears on the subscription screen) or on trasimene.com, in your Trebia account area (“Settings”, then “Delete my account”). The steps to follow are set out on the page https://trasimene.com/apps/trebia/delete-account. Deletion concerns only your Trebia account: an account created with the same address in another of our apps remains active.

As soon as you confirm, you are signed out on all your devices and your access is cut off, including your access to the VPN; on iPhone, the app removes the VPN configuration from the phone. Your notification tokens are erased, and your newsletter subscription is removed if none of your other accounts with us is subscribed to it. The history of your VPN connections is erased 72 hours after your access is cut off. The rest (account record, profile photo, monthly volumes, security history, internal measurement and crash reports linked to the account, installation source, reasons for cancellation and deletion) is erased 30 days after the request, the account record last; during these 30 days, no one can sign in to your account any more. An email confirms the deletion and states the date of permanent erasure.

We keep your payment history (10 years), the messages you sent to support (3 years after the last exchange) and, in the event of a ban, the identifiers that make it possible to enforce it (5 years). Internal measurement events that are not linked to your account, such as the first opening of the app, are erased after 13 months.

Deleting your account does not stop a subscription taken on the App Store or on trasimene.com: cancel it first where you took it (see the page https://trasimene.com/apps/trebia/delete-account). For a Google Play subscription, we also ask Google to cancel it at the time of deletion; check afterwards that the cancellation does appear in Google Play.