Privacy Policy

Version 1.5 — effective October 31, 2026 (update: hearing about an organizer's next events)

This policy describes how Torool collects, uses, and protects your personal data. It applies to the Torool mobile app and to the guest webapp accessible via the link your organizer sent you.

0. Who is the data controller

The data controller is DBEK, with registered office at 75 rue de Lourmel, 75015 Paris, France, registered with the Paris Trade and Companies Register under number 932 689 037.

Contact: contact@dbek.fr
Publication director: Mathieu Baldek

DBEK is not required to appoint a Data Protection Officer (DPO) under Article 37 of the GDPR. For any data-related question, contact the address above.

1. Data we collect

1.1. Organizer account

• Credentials: email address, password (hashed, never readable).
• Displayed identity: display name, profile picture (avatar, optional — stored in a public Supabase bucket).
• Preferences: language (fr / en), theme (light / night / neon / follow system), selected app icon, email visibility to guests.
• Account state: creation date, premium status (boolean), number of events created.

1.2. Third-party sign-in

If you choose "Continue with Google" or "Continue with Apple", we receive from these providers: your email, your name, and your profile picture if available. Apple may offer to hide your real email via "Hide My Email" — in that case we receive an alias only you can link to your real email.

1.3. Events and guests

• Events: title, date, location, description, table and seating plan configurations you create.
• Guests: first name, last name, email (optional), phone (optional), RSVP status, 6-character access code, funnel responses (diet, transport, +1, dress code, arrival time, etc., depending on the chosen format).
• Guest access code: random 6-character code letting a guest access their invitation without creating an account.
• Email left after replying (optional): on the invitation page, after replying, you can leave your email for the day-before reminder and notices of changes to the event (time, date, place, cancellation) only, and to receive your personal link again if you ask for it. You only receive the invitation to a next edition of that event if you asked for it (box unticked by default). This address is visible to the organizer and, if there are any, to their co-organizers. It is never added to a community's contacts nor used for other events, and it never identifies you: only your personal link gives access to your reply.
• Event add-ons (when enabled by the organizer): carpooling (driver contact details — phone and/or email —, departure point, schedule, seat count, shared with the passengers of that ride), accommodation, potluck, cost sharing (declared amounts and Lydia / Revolut / PayPal payment handles entered voluntarily, visible to the participants concerned).
• Shared content: photos uploaded to the event album and guestbook messages — visible to the other participants of the event.
• Address search: when you type a place (event location, carpool departure point, accommodation), the typed text is sent to the Google Places API for autocompletion. Your device location is never read.
• Hearing about an organizer's next events (optional): if you ask for it, DBEK processes your address and first name, based on your consent confirmed by email, to send you their events when they decide to. The organizer sees your first name and a masked address, showing the first letter and the domain (i***@example.com). Retention: 3 years after the last contact. You can withdraw at any time through the link in each email. We keep proof of this consent: dates of the request and confirmation, version of the text shown, originating event, hashed IP address.

As the organizer, you are responsible for ensuring your guests consent to having their name and contact details appear in the app. For this collection, you act as a joint controller with us.

1.4. Clubs and memberships

• Clubs: name, description, cover image, and the club's member list (name, email, membership status and expiry date).
• Paid memberships: if a club enables paid membership fees, the payment is processed by Stripe. We keep the payment status and the receipt; we never see or store your card number.
• Club organizers: membership fee collection goes through Stripe Connect. Identity verification (KYC) is performed and stored by Stripe; we only store the Stripe account ID and its status.

1.5. Subscription and payments

• Torool Premium is a monthly subscription purchased via the App Store (Apple), Google Play, or by card on the web via Stripe.
• Apple, Google, or Stripe transaction ID.
• Your Premium subscription status (active / expired).
• RevenueCat subscription event history linked to your account (purchase, renewal, cancellation, restoration).
• For web payments: Stripe processes your card data directly; it never transits through our servers.
• Referrals: your referral code, the accounts created with your link (first name and signup date) and the end date of your free month of Premium. If you share your referral link, your first name (first word of your display name) is shown to the person who opens it, and yours to your referrer if you sign up with a link; never your email or your full name.

1.6. Diagnostics

• Technical error logs (stack trace, app version, device type) sent to Sentry.
• Torool user ID attached to the log (never your email, never your name).
• Product analytics (page views, journeys, clicks) via PostHog (EU instance), with no cookie and no persistent storage on the website: the anonymous identifier only exists for the duration of your visit. Personal access codes (/join/… links) are removed before anything is sent. No data is ever sold.
• In the mobile app, usage measurement (screens viewed, actions) also goes through PostHog (EU instance); it is linked to your account and uses an identifier stored on the device. You can object to it by writing to us.
• On invitation pages: the country of the visit, inferred by our hosting provider, is kept for statistics; Torool does not keep the IP address.

1.7. Data we do not collect

Torool does not read your device location, contacts, photo library, or messages. The only photos we receive are the ones you voluntarily choose to upload (your avatar, or a photo added to an event album). No advertising SDK is integrated into the mobile app and no data is ever sold; on the website, no advertising cookie is set without your consent, and invitation pages never load any advertising tool (see 1.8).

1.8. Advertising and signup source

On the website, outside invitation pages (/e, /join, /programme, which never load these tags), and only if you accept advertising cookies in the banner, we use the Google tag (Google Ads campaign measurement) and the Meta pixel to find out which campaigns bring in signups. Without your consent, neither the Google tag nor the Meta pixel is loaded, and no advertising cookie is set.

When you create an account, we keep the source of your visit: campaign parameters (utm_…), landing page and referring site. Ad click identifiers (gclid, fbclid, msclkid…) are only kept if you accepted advertising cookies.

2. Purposes and legal bases

Apart from the request described in 1.3, which you consent to yourself: no data is used for direct marketing in this version of the service. If we add such processing in the future, it will be strictly based on your prior consent (Art. 6.1.a) and you will be notified.

3. Subprocessors

We use the following providers to operate the service. Each one has signed a GDPR-compliant Data Processing Agreement (DPA).

4. International transfers

When your data is transferred outside the European Union (to RevenueCat, Apple, Google, Meta, Stripe Inc., Resend, Sentry, or Vercel's US region), it is protected by:

• The EU-US Data Privacy Framework (DPF) certification under which these providers are registered;
• Or, by default, the European Commission's Standard Contractual Clauses (decision 2021/914).

The primary database and avatar storage are hosted within the European Union (Supabase, Ireland region). The main processing of your personal data therefore takes place in the EU.

5. Retention

6. Your rights

Under GDPR articles 15 to 22, you have the following rights:

• Access: obtain a copy of your data. You can export it directly from the app: Settings › Account › Export my data.
• Rectification: correct inaccurate data. Most fields are editable directly (profile, events). For others, write to us.
• Erasure: delete your account and all associated data via Settings › Account › Delete my account.
• Portability: receive your data in a structured, readable format (JSON), via the same export feature.
• Objection: object to processing based on legitimate interest (for example, refuse Sentry error log collection). Write to us.
• Restriction: ask us to freeze the processing of your data in case of dispute.
• Withdrawal of consent: for any consent-based processing, you can withdraw it at any time.

To exercise a right not directly available in the app, write to contact@dbek.fr. Reply within 30 days maximum (an additional month in case of complexity, with reasoned notification).

7. Security

• TLS 1.2+ encryption for all transfers.
• Passwords hashed with bcrypt by Supabase Auth (never stored in plaintext).
• Time-limited JWT access tokens + refresh token rotation.
• Postgres Row-Level Security policies: you only access your own events, never another organizer's.
• Regular dependency and key access audits.
• Informal penetration tests before each major release.

8. Automated decision-making and profiling

Torool performs no fully automated decision producing legal effects concerning you (GDPR Art. 22). No profiling for scoring, ad targeting, or price modulation is implemented.

9. Minors

Torool is intended for users aged 15 and over. Age is not actively verified but is stated at signup and in the terms of service. If you are a parent or guardian and notice that a child under 15 has signed up, contact contact@dbek.fr for immediate deletion (within 24 business hours).

10. Cookies and local storage

The mobile app does not use cookies. It stores locally (AsyncStorage) your session token and your preferences (language, theme, app icon), and keeps the PostHog usage measurement identifier on the device (see 1.6).

The guest webapp (used by your guests from the link you share) uses:

• the browser's local storage (localStorage / sessionStorage) to manage the guest's anonymous session;
• the browser's local storage to remember, per event, your "Later" choice on the offer to receive the reminder by email (no email address is stored on the device);
• a first-party functional cookie per event (torool_invite_…, 90-day lifetime) that remembers your invitation code so you are recognized on your next visit without re-entering your email;
• a random session identifier (sessionStorage, cleared when the tab closes) used solely to deduplicate the event page view counter shown to the organizer.

Referral link (torool.com/r/…): when you open it, the referral code is kept for 30 days in the browser's local storage and in a first-party functional cookie (torool_ref, torool.com domain), so your free month of Premium is applied when you create your account. It is deleted as soon as it has been used. No measurement, no ad network: no banner needed.

On invitation pages, no advertising cookie, no third-party tracker, no pixel: only the storage listed above, strictly necessary for the service (exemption under Article 82 of the French Data Protection Act, ePrivacy Art. 5.3).

On the rest of the site, the Google tag and the Meta pixel are only loaded with your consent, given or refused in the banner; without it, no advertising cookie is set. You can withdraw this consent at any time: clear the cookies for torool.com and the banner will ask you again.

11. Notification in case of data breach

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we commit to notify the CNIL within 72 hours of discovery, in accordance with GDPR Article 33. If the breach is likely to result in a high risk, you will be informed directly in the app and by email.

12. Supervisory authority

If you believe your rights are not respected, you can lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL): cnil.fr/en/plaintes, 3 place de Fontenoy, 75007 Paris, France. EU residents outside France may also contact their national data protection authority.

13. Changes

We may update this policy. Any substantial change (new subprocessor, new purpose, new data category) will be notified in the app at least 30 days before it takes effect. Editorial changes (typo fixes, rephrasing with no substantive impact) are published without notice and tracked in the "Version" line at the top of the document.

14. Contact

For any question about this policy or your data: contact@dbek.fr.

Privacy Policy v1.2 — DBEK, Paris Trade Register 932 689 037. Compliant with GDPR (EU 2016/679) and the French Data Protection Act.