Privacy Policy

1. Data Controller

This policy explains how your personal data is collected and processed when you use the TourTap application and website.

The data controller is Clément Maldonado, sole trader trading under the business name “Maldonado Studio”, whose registered office is at 1 rue Marguerin, 75014 Paris, France (SIRET 105 940 563 00023).

For any question regarding your data: rgpd@tourtap.app.

2. Data We Collect

• • Identification and account: first name, last name, nickname, email address, password (stored in encrypted form), profile picture.
• • Sign-in with Apple or Google: the identifier provided by the service, the email address shared and a sign-in token, when you use these sign-up methods.
• • Location: the geographic coordinates of events and the position used to display the map, only with your consent.
• • Content you publish: events, photos, and the messages exchanged in group conversations and private messages.
• • Technical data: IP address, device type, operating system, app version and platform, push notification token.
• • Subscription data: paid subscriptions are currently disabled. If reactivated, a customer identifier and transaction identifiers may be stored. Your payment details never pass through our servers: they are handled by the payment providers.
• • Events from external sources: some displayed events come from public sources (event listings, organiser websites). Only the event's public information (title, date, place, description, image) is reused. Any person concerned may request its rectification or removal at rgpd@tourtap.app.

3. Purposes and Legal Bases

• • Create and manage your account, display events, enable interactions and messaging — performance of the contract (our Terms of Use).
• • Use your location and send you push notifications — your consent, which you can withdraw at any time in your device settings.
• • Ensure security, prevent abuse, moderate content and improve the service — our legitimate interest.
• • Handle reports and respond to requests from authorities — compliance with a legal obligation.

4. Retention Periods

• • Your account and the associated content are kept for as long as your account is active.
• • If you delete your account, your data is erased within 30 days, unless a legal retention obligation applies.
• • Accounts created but never verified are automatically deleted within 24 hours.
• • Technical logs are kept for a maximum of 12 months.

5. Recipients and Processors

We do not sell your data. It is accessible to the providers strictly necessary to operate the service, acting as processors:

• • Pulseheberg (France) — hosting of servers and database.
• • Zoho (European Union data center) — professional email and handling of contact emails.
• • Brevo (France) — sending of transactional emails (verification, password reset).
• • Apple and Google — sign-in via their services, push notifications, app distribution and map display on mobile (Apple Maps on iOS, Google Maps on Android).
• • OpenStreetMap (foundation based in the United Kingdom) — provision of the map tiles displayed on the website.

We may also disclose your data where required by law or at the request of a competent authority.

6. Transfers Outside the European Union

Some providers (notably Apple and Google, for sign-in, notifications and app distribution) may process data in the United States. These transfers are covered by appropriate safeguards under the GDPR (standard contractual clauses and/or the Data Privacy Framework).

7. Your Rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights:

• • Right of access, rectification and erasure of your data.
• • Right to restriction and right to object to processing.
• • Right to data portability.
• • Right to withdraw your consent at any time, without affecting processing already carried out.
• • Right to set directives regarding the fate of your data after your death.

You can delete your account directly from the app. To exercise your other rights, contact rgpd@tourtap.app. You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

8. Data Security

We implement technical and organizational measures to protect your data: encryption of communications (TLS), hashed storage of passwords and restricted access. As no system is infallible, we encourage you to use a strong password and keep it confidential.

9. Minors

TourTap is exclusively reserved for adults (18 years and older). We do not knowingly collect data relating to minors. If we become aware that an account has been created by a person under 18, it will be deleted. If you believe this is the case, contact us at rgpd@tourtap.app.

10. Cookies and Trackers

The website only uses cookies strictly necessary for its operation (session management and security). In line with the recommendations of the CNIL, these cookies do not require your consent. We do not use any analytics, tracking or advertising cookies.

11. Changes to This Policy

We may update this Privacy Policy. Any change is published on this page with a new update date; in the event of a significant change, you will be informed by appropriate means.

12. Contact

For any question about this policy or your personal data: rgpd@tourtap.app