Skip to main content

Privacy Policy

Last update: 17 October 2026

1. Data Controller

The controller of personal data collected on Targumi (website and mobile app) is Targumi, a French simplified joint-stock company (SASU), SIREN 107 207 466, registered office at Bâtiment 1, 30 rue Jean Jaurès, 95400 Arnouville, France.

For any question regarding your data or this policy: [email protected]

2. Data collected and purposes

Targumi only collects data strictly necessary for the purposes stated:

DataPurposeLegal basis (GDPR)Retention
Email, first name, hashed passwordAccount creation and managementContract performance (art. 6.1.b)Account duration + 3 years
Identifier and profile information sent by Apple or Google (email address, name), if you sign in with themSigning in to your accountContract performance (art. 6.1.b)Account duration
Target language, level, progressPersonalised learning pathContract performance (art. 6.1.b)Account duration + 3 years
Payment data (via Stripe or PayPal)Processing purchases and subscriptionsContract performance (art. 6.1.b)10 years (accounting obligation)
Device notification token (mobile app)Sending app notificationsConsent (permission given on the device)Until the account is deleted or the token becomes invalid
Messages and attachments sent to supportAnswering your requestsContract performance (art. 6.1.b) and legitimate interest (art. 6.1.f)As long as needed to follow up on your requests
IP address, login logsSecurity, fraud preventionLegitimate interest (art. 6.1.f)12 months
Email + newsletter preferencesCommunications (tips, updates)Consent (art. 6.1.a)Until unsubscribe
Analytics cookies (website only)Anonymous audience measurement, service improvementConsent (art. 6.1.a)13 months max
Quiz and level test answersCEFR level calculation and recommendationsContract performance / ConsentAccount duration + 1 year

3. Service providers

To deliver the service, Targumi uses the service providers below, which only receive the data needed for their task. The table links to their privacy policy and, when they publish one, to their Data Processing Agreement (DPA) within the meaning of GDPR article 28:

ProviderPurposeLocationDocuments
SupabaseDatabase and authentication: account, profile, progress, preferences, messages sent to supportEuropean Union (Frankfurt, Germany)Privacy
DPA
Hetzner Online GmbHWeb hosting and server infrastructureEuropean Union (Helsinki, Finland)Privacy
DPA
Cloudflare, Inc.Traffic routing and protection: every connection to the website and the app goes through its networkGlobal network (data centre closest to you), US company certified under the EU-US Data Privacy FrameworkPrivacy
DPA
Stripe Payments Europe LtdCredit card payment processingIreland (Dublin) plus framed transfers to the United StatesPrivacy
DPA
PayPal (Europe) S.à r.l. et Cie, S.C.A.Payments made with PayPalLuxembourgPrivacy
ResendEmail delivery: account, classes, invoices, newslettersUnited States (with EU standard contractual clauses)Privacy
DPA
o2switchHosting of the support inbox ([email protected])FrancePrivacy
Google LLCSign in with Google; live classes (Google Meet); delivery of app notifications (Firebase Cloud Messaging); YouTube videos embedded in lessons; on the website only and according to your cookie choices, audience and advertising measurement (Google Analytics, Google Ads, Google Tag Manager)United States (EU standard contractual clauses plus EU-US Data Privacy Framework certification)Privacy
DPA
Apple Distribution International LtdSign in with Apple; delivery of notifications on iPhone and iPad (Apple Push Notification service)Ireland, transfers to the United States governed by standard contractual clausesPrivacy
Meta Platforms Ireland LtdMeta Pixel (Facebook, Instagram), on the website only and according to your cookie choices: ad conversion measurementIreland (Dublin) plus framed transfers to the United StatesPrivacy
DPA
Microsoft CorporationMicrosoft Clarity, on the website only and after you accept audience measurement cookies: page usage analysis (click maps, session recordings)United StatesPrivacy
Anthropic Ireland, LimitedPreparing support replies with the Claude artificial intelligence: content of your message and the account details needed for the replyUnited States (Anthropic servers)Privacy

4. Mobile app

The Targumi app (iPhone, iPad and Android) displays the targumi.com website: the processing described in this policy applies to it in the same way. A few points are specific to it:

  • No audience measurement or advertising tool (Google Analytics, Google Ads, Google Tag Manager, Meta Pixel, Microsoft Clarity) is loaded in the app.
  • Notifications: if you allow them, the app records a notification token linked to your account. It is sent to Google (Firebase Cloud Messaging) and, on iPhone and iPad, to Apple (Apple Push Notification service), which deliver the notifications. You set reminders and class alerts in your Profile, under Notifications, and you can turn off all notifications in your device settings.
  • Offers and promotions on iPhone and iPad: these notifications are only sent to you if you have turned on “Offers and promotions” in your Profile, under Notifications. You can turn it off at any time in the same place.
  • Sign in with Apple or Google: Apple or Google send us an identifier and the profile information you agree to share (email address, name). With Apple, you can hide your address behind a relay address. We never receive your Apple or Google password.
  • Account deletion: available directly in the app, see section 7.

5. Support and artificial intelligence

The messages you send to support (website and app forms, email to [email protected]) are stored to follow up on your request. To prepare the reply, their content and the account details needed for the reply (for example your plan, your payments or your classes) may be sent to Claude, an artificial intelligence service from the company Anthropic.

The support and contact forms ask for your consent, with a checkbox, before the message is sent.

6. Transfers outside the EU

Some of our service providers (including Stripe, Resend, Cloudflare, Google, Apple, Meta, Microsoft and Anthropic) may transfer data outside the European Union, especially to the United States. Such transfers are framed by:

  • The European Commission's Standard Contractual Clauses (Decision 2021/914)
  • The EU-US Data Privacy Framework for the companies certified under it (for example Google, Meta and Cloudflare)
  • Additional technical safeguards (encryption, pseudonymisation)

7. Your rights (GDPR)

Pursuant to GDPR articles 15 to 22, you have the following rights:

  • Right of access: obtain a copy of your data
  • Right to rectification: correct inaccurate data
  • Right to erasure (“right to be forgotten”): delete your account and data
  • Right to restriction of processing in certain cases
  • Right to portability: receive your data in a machine-readable format
  • Right to object, especially to marketing
  • Right to withdraw consent at any time, with no retroactive effect
  • Right to set directives for what happens to your data after your death

Delete your account yourself: on the website or in the app, open your Profile and choose “Delete my account”. Deletion erases your account, your profile, your progress and the notification tokens of your devices. If you signed in with Apple, we also ask Apple to revoke the access granted to Targumi. Invoices are kept for the period required by our accounting obligations. Messages exchanged with support are not erased automatically: write to us to request their deletion. See also the Delete your account page.

To exercise your rights: [email protected] or by mail to Bâtiment 1, 30 rue Jean Jaurès, 95400 Arnouville, France. We will reply within one month (extendable to 3 months for complex requests).

If you believe your rights are not respected, you can lodge a complaint with the CNIL: https://www.cnil.fr/fr/plaintes

8. Cookies

We use cookies whose detailed list and purposes are described in our Cookie Policy. On your first visit to the website, a banner lets you configure your preferences. This banner does not appear in the app, which loads no audience measurement or advertising tool.

9. Security

Targumi implements appropriate technical and organisational measures to protect your data: TLS encryption, password hashing (bcrypt), Row-Level Security (RLS), restricted team access, admin action logging.

No system being infallible, in case of a data breach likely to result in a risk to your rights and freedoms, we will notify the CNIL within 72 hours and inform you individually if required (GDPR articles 33 and 34).

10. Minors

Targumi is intended for users aged 16 or older. Below that age, registration requires parental consent, as stated in our Terms. Contact us for immediate deletion if you discover that a minor has registered without consent.

11. Changes

This policy may be updated to reflect service or regulatory changes. For substantial changes, you will be notified by email at least 30 days before they take effect.

12. Contact

For any question about your personal data or this policy:

Email: [email protected]
Mail: Benjamin Maubacq, Bâtiment 1, 30 rue Jean Jaurès, 95400 Arnouville, France