Tootela is operated by Tootela SAS, a French company. This policy is provided in English for convenience; in case of dispute, French law applies as set out in our Terms of Service.
1. Who we are
This Privacy Policy applies to the website tootela.net and the Tootela application. The data controller is Tootela SAS, registered office Bureau 326, 59 rue de Ponthieu, 75008 Paris, France, registered in France under Paris 104 301 569.
If you have any question about how we handle your data, contact contact@tootela.net. For data protection requests specifically, you can reach our DPO at contact@tootela.net.
2. What we collect
We only collect what's needed to operate the service. There are five categories:
Account data
- Name, email address, password (hashed by our authentication provider, never stored in clear)
- Company name, role, country (used to localise the product)
- Profile picture if you upload one
Customer content
The data you create or upload while using Tootela : messages, documents, files, contacts, deals, tickets, projects, calendar events, etc. You own this content. We process it on your behalf to make the product work. We do not access it for any other purpose.
Usage data
Information about how you use the product : pages visited, features used, errors encountered, approximate location derived from your IP address, browser and OS type. We use this to improve the product and to debug issues. On the marketing site, analytics run only if you consent (see section 10).
Billing data
If you subscribe to a paid plan, we collect billing details : company name, billing address, VAT number. Card numbers are handled directly by our payment processor (Stripe) and never touch our servers.
Support data
When you contact us, we keep a record of the conversation so we can help you and improve the product over time.
3. How we use it
- Provide the service: create your account, sync your data, deliver messages, generate invoices, etc.
- Operate and improve: understand which features are used, fix bugs, monitor performance.
- Communicate: respond to support requests, send transactional emails (account confirmation, sign-in codes, billing receipts, security alerts), send service announcements.
- Marketing: if you opted in, send a low-volume product newsletter. You can unsubscribe with one click.
- AI features: when you use an AI feature (assistant, document AI, receipt analysis, meeting recaps), the relevant content is sent to our AI provider (Google Gemini) solely to generate the response for that feature.
- Legal and security: prevent fraud and abuse, comply with legal obligations, enforce our terms, protect our rights and the rights of others.
We do not use your customer content to train AI models, and our contracts with AI providers prohibit them from training on it. We do not sell your data. We do not share your data with advertisers.
4. Legal bases (GDPR)
Under the GDPR we need a legal basis for each processing activity. Here's how it maps:
| Activity | Legal basis |
|---|---|
| Running your account, processing your customer content, AI features you invoke | Performance of contract (Art. 6(1)(b)) |
| Billing and tax records | Legal obligation (Art. 6(1)(c)) |
| Improving the service, security, fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Marketing emails, analytics cookies on the marketing site | Consent (Art. 6(1)(a)) |
5. Who we share data with
We use a small number of vetted subprocessors, each under a written data processing agreement with appropriate GDPR safeguards:
| Subprocessor | Purpose | Region |
|---|---|---|
| Supabase Inc. | Database, authentication, storage | EU — eu-west-3 (Paris, France) |
| Vercel Inc. | Application hosting, CDN, edge compute | Global edge |
| Stripe Inc. | Payment processing (incl. Stripe Connect for customers’ own invoice payments) | Ireland (EU) + USA |
| Resend Inc. | Transactional email delivery | USA (with EU SCCs) |
| Google LLC | Generative AI (Gemini API) for the AI assistant : opt-in only | USA (with EU SCCs) |
| LiveKit Inc. | Video meetings and calls (real-time audio/video infrastructure) | USA (with EU SCCs) |
| B2B Router (DocProcess group) | E-invoicing network access (Peppol / French PDP flows) | EU |
| Google LLC — Google Analytics 4 | Audience measurement : consent-gated, only loads after opt-in | USA (with EU SCCs) |
| Vercel Inc. — Vercel Analytics | Privacy-friendly, cookieless page analytics | Global edge |
| Google LLC — OAuth | Optional Gmail / Google Calendar sync : only when the user connects their Google account | USA (with EU SCCs) |
We update this list when it changes. If you have a Tootela DPA in place, we notify you 30 days before adding a new subprocessor so you can object.
Beyond that, we share data only:
- With your explicit instruction (e.g. when you connect a third-party integration such as Gmail or Google Calendar sync)
- If required by law, court order, or to protect against fraud or imminent harm
- In the context of a business transfer (merger, acquisition), with continuity of these privacy commitments
6. International transfers
Tootela is a French company and our database lives in the EU (eu-west-3 (Paris, France)). Some of our subprocessors operate from outside the EU (notably the United States). When that happens, the transfer is covered by Standard Contractual Clauses (SCCs) approved by the European Commission, plus supplementary technical and organisational measures.
For AI features, content is sent to our AI provider (Google Gemini) only when you use the feature, and only what is needed to generate the response. Our agreement with the provider prohibits training on this content.
7. How long we keep data
| Data | Retention |
|---|---|
| Account and customer content (active subscription) | For the lifetime of the account |
| Account and customer content (after deletion) | Permanently deleted within 30 days of deletion request, except for content covered by legal hold |
| Backups | Overwritten on our provider's daily backup rotation |
| Billing records | 10 years (French tax law) |
| Server access logs | Retained by our hosting providers under their standard rotation, then deleted |
| Marketing data | Until you unsubscribe; we keep the record of your unsubscribe so we don't contact you again |
8. Security
Data is encrypted in transit (TLS) and at rest by our infrastructure providers. Authentication is managed by Supabase (passwords hashed, never stored in clear), with email-code two-factor authentication available. Access inside a workspace is role-based, and workspaces are isolated from each other at the database level. Our providers take daily backups. The full picture lives on our Security page.
Despite our best efforts, no system is unbreakable. If a breach occurs that is likely to result in a risk to your rights, we'll notify the CNIL within 72 hours and inform affected users without undue delay.
9. Your rights
Under the GDPR you have the right to:
- Access: ask for a copy of the personal data we hold about you
- Rectification: correct inaccurate data
- Erasure: ask us to delete your data ("right to be forgotten")
- Restriction: ask us to stop processing your data temporarily
- Portability: receive your data in a structured, machine-readable format
- Objection: object to processing based on legitimate interest, including profiling
- Withdraw consent: for any processing based on consent, at any time
- Lodge a complaint: with the French data protection authority, the CNIL (cnil.fr)
To exercise any of these rights, email contact@tootela.net. We respond within 30 days.
10. Cookies
The marketing site uses Google Analytics, loaded only after you consent via the cookie banner; the product itself uses only the cookies needed to keep you signed in. The full list and how to manage them (including the "Cookie preferences" link in the footer) is on our Cookie Policy.
11. Children
Tootela is a B2B product reserved for professional use. The service is not directed to children under 16, and we don't knowingly collect personal data from them. If you believe a child has created an account, contact us and we'll delete it.
12. Changes to this policy
If we make material changes, we'll notify you by email and via an in-product banner at least 30 days before they take effect. The "last updated" date at the top of the page always reflects the current version.
13. Contact
Questions, concerns, requests : contact@tootela.net or contact@tootela.net for data protection specifically. Postal mail: Tootela SAS, Bureau 326, 59 rue de Ponthieu, 75008 Paris, France.