Privacy Policy
Last update: 5 May 2026
1. Data Controller
The controller of personal data collected on Targumi is Benjamin Maubacq, sole proprietor (French Entreprise Individuelle), SIREN 850 609 744, registered office at 10 Avenue du général Maistre, 75014 Paris, France.
For any question regarding your data or this policy: [email protected]
2. Data collected and purposes
Targumi only collects data strictly necessary for the purposes stated:
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Email, first name, hashed password | Account creation and management | Contract performance (art. 6.1.b) | Account duration + 3 years |
| Target language, level, progress | Personalised learning path | Contract performance (art. 6.1.b) | Account duration + 3 years |
| Payment data (via Stripe) | Processing purchases and subscriptions | Contract performance (art. 6.1.b) | 10 years (accounting obligation) |
| IP address, login logs | Security, fraud prevention | Legitimate interest (art. 6.1.f) | 12 months |
| Email + newsletter preferences | Communications (tips, updates) | Consent (art. 6.1.a) | Until unsubscribe |
| Analytics cookies | Anonymous audience measurement, service improvement | Consent (art. 6.1.a) | 13 months max |
| Quiz and level test answers | CEFR level calculation and recommendations | Contract performance / Consent | Account duration + 1 year |
3. Processors
To deliver the service, Targumi uses processors within the meaning of GDPR article 28. Each is bound by a Data Processing Agreement (DPA):
| Processor | Purpose | Location | DPA |
|---|---|---|---|
| Supabase | Main database (auth, profiles, user content) | Union Européenne (Frankfurt, Allemagne) | DPA |
| Hetzner Online GmbH | Web hosting and server infrastructure | Allemagne (Falkenstein, Nuremberg) | DPA |
| Stripe Payments Europe Ltd | Credit card payment processing | Irlande (Dublin) + transferts encadrés vers États-Unis | DPA |
| Resend | Transactional email delivery (welcome, password, invoices) | États-Unis (avec clauses contractuelles types UE) | DPA |
| Google LLC | Anonymous audience measurement (Google Analytics 4) if consent, Google Meet for live classes | États-Unis (clauses contractuelles types UE + adhésion EU-US Data Privacy Framework) | DPA |
| Meta Platforms Ireland Ltd | Meta Pixel (Facebook/Instagram) for ad conversion measurement if consent | Irlande (Dublin) + transferts encadrés États-Unis | DPA |
4. Transfers outside the EU
Some of our processors (Stripe, Resend, Google, Meta) may transfer data outside the European Union, especially to the United States. Such transfers are framed by:
- The European Commission's Standard Contractual Clauses (Decision 2021/914)
- Adherence to the EU-US Data Privacy Framework for Google and Meta (since July 2023)
- Additional technical safeguards (encryption, pseudonymisation)
5. Your rights (GDPR)
Pursuant to GDPR articles 15 to 22, you have the following rights:
- Right of access: obtain a copy of your data
- Right to rectification: correct inaccurate data
- Right to erasure (“right to be forgotten”): delete your account and data
- Right to restriction of processing in certain cases
- Right to portability: receive your data in a machine-readable format
- Right to object, especially to marketing
- Right to withdraw consent at any time, with no retroactive effect
- Right to set directives for what happens to your data after your death
To exercise your rights: [email protected] or by mail to 10 Avenue du général Maistre, 75014 Paris, France. We will reply within one month (extendable to 3 months for complex requests).
If you believe your rights are not respected, you can lodge a complaint with the CNIL: https://www.cnil.fr/fr/plaintes
6. Cookies
We use cookies whose detailed list and purposes are described in our Cookie Policy. On your first visit, a banner lets you configure your preferences.
7. Security
Targumi implements appropriate technical and organisational measures to protect your data: TLS encryption, password hashing (bcrypt), Row-Level Security (RLS), restricted team access, admin action logging.
No system being infallible, in case of a data breach likely to result in a risk to your rights and freedoms, we will notify the CNIL within 72 hours and inform you individually if required (GDPR articles 33 and 34).
8. Minors
Targumi is intended for users aged 16 or older. For minors between 13 and 16, registration requires parental consent under GDPR article 8. Contact us for immediate deletion if you discover an underage minor has registered.
9. Changes
This policy may be updated to reflect service or regulatory changes. For substantial changes, you will be notified by email at least 30 days before they take effect.
10. Contact
For any question about your personal data or this policy:
Email: [email protected]
Mail: Benjamin Maubacq, 10 Avenue du général Maistre, 75014 Paris, France