Privacy Policy
Last update: 17 October 2026
1. Data Controller
The controller of personal data collected on Targumi (website and mobile app) is Targumi, a French simplified joint-stock company (SASU), SIREN 107 207 466, registered office at Bâtiment 1, 30 rue Jean Jaurès, 95400 Arnouville, France.
For any question regarding your data or this policy: [email protected]
2. Data collected and purposes
Targumi only collects data strictly necessary for the purposes stated:
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Email, first name, hashed password | Account creation and management | Contract performance (art. 6.1.b) | Account duration + 3 years |
| Identifier and profile information sent by Apple or Google (email address, name), if you sign in with them | Signing in to your account | Contract performance (art. 6.1.b) | Account duration |
| Target language, level, progress | Personalised learning path | Contract performance (art. 6.1.b) | Account duration + 3 years |
| Payment data (via Stripe or PayPal) | Processing purchases and subscriptions | Contract performance (art. 6.1.b) | 10 years (accounting obligation) |
| Device notification token (mobile app) | Sending app notifications | Consent (permission given on the device) | Until the account is deleted or the token becomes invalid |
| Messages and attachments sent to support | Answering your requests | Contract performance (art. 6.1.b) and legitimate interest (art. 6.1.f) | As long as needed to follow up on your requests |
| IP address, login logs | Security, fraud prevention | Legitimate interest (art. 6.1.f) | 12 months |
| Email + newsletter preferences | Communications (tips, updates) | Consent (art. 6.1.a) | Until unsubscribe |
| Analytics cookies (website only) | Anonymous audience measurement, service improvement | Consent (art. 6.1.a) | 13 months max |
| Quiz and level test answers | CEFR level calculation and recommendations | Contract performance / Consent | Account duration + 1 year |
3. Service providers
To deliver the service, Targumi uses the service providers below, which only receive the data needed for their task. The table links to their privacy policy and, when they publish one, to their Data Processing Agreement (DPA) within the meaning of GDPR article 28:
| Provider | Purpose | Location | Documents |
|---|---|---|---|
| Supabase | Database and authentication: account, profile, progress, preferences, messages sent to support | European Union (Frankfurt, Germany) | Privacy DPA |
| Hetzner Online GmbH | Web hosting and server infrastructure | European Union (Helsinki, Finland) | Privacy DPA |
| Cloudflare, Inc. | Traffic routing and protection: every connection to the website and the app goes through its network | Global network (data centre closest to you), US company certified under the EU-US Data Privacy Framework | Privacy DPA |
| Stripe Payments Europe Ltd | Credit card payment processing | Ireland (Dublin) plus framed transfers to the United States | Privacy DPA |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payments made with PayPal | Luxembourg | Privacy |
| Resend | Email delivery: account, classes, invoices, newsletters | United States (with EU standard contractual clauses) | Privacy DPA |
| o2switch | Hosting of the support inbox ([email protected]) | France | Privacy |
| Google LLC | Sign in with Google; live classes (Google Meet); delivery of app notifications (Firebase Cloud Messaging); YouTube videos embedded in lessons; on the website only and according to your cookie choices, audience and advertising measurement (Google Analytics, Google Ads, Google Tag Manager) | United States (EU standard contractual clauses plus EU-US Data Privacy Framework certification) | Privacy DPA |
| Apple Distribution International Ltd | Sign in with Apple; delivery of notifications on iPhone and iPad (Apple Push Notification service) | Ireland, transfers to the United States governed by standard contractual clauses | Privacy |
| Meta Platforms Ireland Ltd | Meta Pixel (Facebook, Instagram), on the website only and according to your cookie choices: ad conversion measurement | Ireland (Dublin) plus framed transfers to the United States | Privacy DPA |
| Microsoft Corporation | Microsoft Clarity, on the website only and after you accept audience measurement cookies: page usage analysis (click maps, session recordings) | United States | Privacy |
| Anthropic Ireland, Limited | Preparing support replies with the Claude artificial intelligence: content of your message and the account details needed for the reply | United States (Anthropic servers) | Privacy |
4. Mobile app
The Targumi app (iPhone, iPad and Android) displays the targumi.com website: the processing described in this policy applies to it in the same way. A few points are specific to it:
- No audience measurement or advertising tool (Google Analytics, Google Ads, Google Tag Manager, Meta Pixel, Microsoft Clarity) is loaded in the app.
- Notifications: if you allow them, the app records a notification token linked to your account. It is sent to Google (Firebase Cloud Messaging) and, on iPhone and iPad, to Apple (Apple Push Notification service), which deliver the notifications. You set reminders and class alerts in your Profile, under Notifications, and you can turn off all notifications in your device settings.
- Offers and promotions on iPhone and iPad: these notifications are only sent to you if you have turned on “Offers and promotions” in your Profile, under Notifications. You can turn it off at any time in the same place.
- Sign in with Apple or Google: Apple or Google send us an identifier and the profile information you agree to share (email address, name). With Apple, you can hide your address behind a relay address. We never receive your Apple or Google password.
- Account deletion: available directly in the app, see section 7.
5. Support and artificial intelligence
The messages you send to support (website and app forms, email to [email protected]) are stored to follow up on your request. To prepare the reply, their content and the account details needed for the reply (for example your plan, your payments or your classes) may be sent to Claude, an artificial intelligence service from the company Anthropic.
The support and contact forms ask for your consent, with a checkbox, before the message is sent.
6. Transfers outside the EU
Some of our service providers (including Stripe, Resend, Cloudflare, Google, Apple, Meta, Microsoft and Anthropic) may transfer data outside the European Union, especially to the United States. Such transfers are framed by:
- The European Commission's Standard Contractual Clauses (Decision 2021/914)
- The EU-US Data Privacy Framework for the companies certified under it (for example Google, Meta and Cloudflare)
- Additional technical safeguards (encryption, pseudonymisation)
7. Your rights (GDPR)
Pursuant to GDPR articles 15 to 22, you have the following rights:
- Right of access: obtain a copy of your data
- Right to rectification: correct inaccurate data
- Right to erasure (“right to be forgotten”): delete your account and data
- Right to restriction of processing in certain cases
- Right to portability: receive your data in a machine-readable format
- Right to object, especially to marketing
- Right to withdraw consent at any time, with no retroactive effect
- Right to set directives for what happens to your data after your death
Delete your account yourself: on the website or in the app, open your Profile and choose “Delete my account”. Deletion erases your account, your profile, your progress and the notification tokens of your devices. If you signed in with Apple, we also ask Apple to revoke the access granted to Targumi. Invoices are kept for the period required by our accounting obligations. Messages exchanged with support are not erased automatically: write to us to request their deletion. See also the Delete your account page.
To exercise your rights: [email protected] or by mail to Bâtiment 1, 30 rue Jean Jaurès, 95400 Arnouville, France. We will reply within one month (extendable to 3 months for complex requests).
If you believe your rights are not respected, you can lodge a complaint with the CNIL: https://www.cnil.fr/fr/plaintes
8. Cookies
We use cookies whose detailed list and purposes are described in our Cookie Policy. On your first visit to the website, a banner lets you configure your preferences. This banner does not appear in the app, which loads no audience measurement or advertising tool.
9. Security
Targumi implements appropriate technical and organisational measures to protect your data: TLS encryption, password hashing (bcrypt), Row-Level Security (RLS), restricted team access, admin action logging.
No system being infallible, in case of a data breach likely to result in a risk to your rights and freedoms, we will notify the CNIL within 72 hours and inform you individually if required (GDPR articles 33 and 34).
10. Minors
Targumi is intended for users aged 16 or older. Below that age, registration requires parental consent, as stated in our Terms. Contact us for immediate deletion if you discover that a minor has registered without consent.
11. Changes
This policy may be updated to reflect service or regulatory changes. For substantial changes, you will be notified by email at least 30 days before they take effect.
12. Contact
For any question about your personal data or this policy:
Email: [email protected]
Mail: Benjamin Maubacq, Bâtiment 1, 30 rue Jean Jaurès, 95400 Arnouville, France