Privacy Policy
Publisher: Symbiome, 2637 Route de Montremont, 74230 Thônes, France, registered with the Annecy Trade and Companies Register under number 999 600 778 R.C.S. Annecy.
Contact: contact@trackbats.com
URL: https://trackbats.com/en/privacy-policy/
Preamble
Symbiome (hereinafter the "Publisher") is committed to protecting your personal data. This Privacy Policy describes how the Publisher collects, uses, retains and protects the personal data of users of the TrackBats service (hereinafter the "Service"), in accordance with the General Data Protection Regulation (GDPR – EU Regulation 2016/679) and applicable national legislation.
Article 1 – Data controller
The data controller for personal data collected through the Service is:
Symbiome
2637 Route de Montremont
74230 Thônes, France
Email: contact@trackbats.com
Representative: Arthur Talpaert, co-founder
Article 2 – Data collected
2.1 Data provided directly by the User
When creating an account and using the Service, the Publisher collects the following data:
- Email address
- Password (stored in hashed and secure form — not accessible in plain text by the Publisher)
- Registration date and last login date
- Analysis history (number of videos processed, dates, statuses)
- Subscription plan and purchase history
2.2 Data collected automatically
When using the Service, the following data may be collected automatically:
- IP address
- Browser type and operating system
- Pages visited and duration of visit
- Connection and usage logs
2.3 User Content
Videos uploaded by the User to the Service are processed for analysis purposes. This content may be used to improve the Detection Models in accordance with the ToS, provided it does not contain identifiable personal data (faces, licence plates, etc.).
Article 3 – Purposes and legal basis for processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Account creation and management | Performance of contract (Art. 6.1.b) |
| Provision of the video analysis Service | Performance of contract (Art. 6.1.b) |
| Subscription management and invoicing | Performance of contract (Art. 6.1.b) |
| User support | Performance of contract (Art. 6.1.b) |
| Improving Detection Models (content without personal data) | Legitimate interest (Art. 6.1.f) |
| Statistical analysis of Service usage | Legitimate interest (Art. 6.1.f) |
| Sending communications about Service updates | Legitimate interest (Art. 6.1.f) |
| Compliance with legal obligations (accounting, tax) | Legal obligation (Art. 6.1.c) |
Article 4 – Retention periods
| Data category | Retention period |
|---|---|
| Account data (email, password) | Until account deletion by the User |
| Analysis history | Until account deletion by the User |
| Billing data | 10 years (statutory accounting obligation) |
| Connection logs | 12 months |
| User Content (videos) | Until deletion by the User |
| Content used for Model training | Retained indefinitely in anonymised form |
| Account data after 24 months of inactivity | Deleted after 30 days prior notice |
Article 5 – Recipients of data
5.1 Sub-processors
The Publisher uses the following sub-processors for hosting and operating the Service:
| Sub-processor | Role | Location |
|---|---|---|
| OVHcloud | Service hosting and data storage | France (EU) |
| Brevo (ex-Sendinblue) | Transactional email delivery | France (EU) |
| Stripe Payments Europe Ltd | Subscription payments, invoicing and VAT calculation | Ireland (EU); possible transfers to the United States |
| Google Ireland Ltd – reCAPTCHA Enterprise | Protecting forms (sign-up, contact, booking) against spam and bots | Ireland (EU); possible transfers to the United States |
| Google Ireland Ltd – Google Tag Manager | Audience measurement, only with your consent | Ireland (EU); possible transfers to the United States |
All sub-processors are bound by contractual data protection obligations compliant with the GDPR. Payment card details are entered directly on Stripe's pages and never pass through the Publisher's servers.
5.2 Transfers outside the EU
The Publisher endeavours to keep all processing within the European Union. Stripe and Google may however transfer some data to the United States. These transfers are covered by the EU–U.S. Data Privacy Framework, to which these companies adhere, and by the European Commission's standard contractual clauses.
5.3 Competent authorities
The Publisher may be required to disclose personal data to competent authorities pursuant to a judicial order or statutory obligation.
Article 6 – User rights
In accordance with the GDPR, you have the following rights regarding your personal data:
- Right of access: obtain a copy of the personal data held about you.
- Right of rectification: have inaccurate or incomplete data corrected.
- Right to erasure ("right to be forgotten"): request deletion of your data, subject to statutory retention obligations.
- Right to restriction of processing: request temporary suspension of processing of your data.
- Right to data portability: receive your data in a structured, machine-readable format.
- Right to object: object to processing of your data based on legitimate interest, in particular the use of your videos to train Detection Models.
How to exercise your rights: Any request must be sent by email to contact@trackbats.com, specifying your identity and the nature of your request. The Publisher undertakes to respond within 30 days.
Right to lodge a complaint: If you consider that the processing of your personal data does not comply with applicable regulations, you have the right to lodge a complaint with the relevant supervisory authority. In France, this is the CNIL (Commission Nationale de l'Informatique et des Libertés):
- Online: https://www.cnil.fr/fr/plaintes
- By post: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
Article 7 – Cookies and trackers
7.1 Cookies used
The Service uses cookies that are strictly necessary for its operation and security, which do not require consent. Only with your agreement, it also uses audience-measurement trackers. No advertising cookies are used.
| Cookie / tracker | Purpose | Consent | Duration |
|---|---|---|---|
| Authentication session | Maintaining login | Not required | Session |
| CSRF token | Form security | Not required | Session |
| Google reCAPTCHA Enterprise | Protecting forms against spam and bots | Not required (Service security) | Per Google, up to 6 months |
| Google Tag Manager | Audience measurement of the Service | Required | 13 months maximum |
| Consent choice | Remembering whether you accepted or refused audience measurement | Not required | 6 months |
7.2 Cookie management
On your first visit, a banner lets you accept or refuse audience measurement, as easily one as the other. Until you accept, Google Tag Manager is not loaded. Your choice is kept for 6 months; you can change it at any time through the "Cookie settings" link at the bottom of every page.
The User may also configure their browser to refuse cookies. Refusing strictly necessary cookies may cause the Service to malfunction.
Article 8 – Data security
The Publisher implements the following technical and organisational measures to protect personal data:
- Encrypted communications via HTTPS (TLS)
- Passwords stored in hashed form (bcrypt algorithm)
- Data access restricted to authorised personnel only
- Regular data backups
- Hosting on ISO 27001 certified infrastructure (OVHcloud)
In the event of a personal data breach likely to result in a risk to the rights and freedoms of Users, the Publisher undertakes to notify the CNIL within 72 hours and to inform affected Users as soon as possible.
Article 9 – Amendments to the Privacy Policy
The Publisher reserves the right to amend this Privacy Policy at any time, in particular to comply with new regulations. Users will be informed of any significant change by email or via a notification on the Service.
The version in force is the one accessible at https://trackbats.com/en/privacy-policy/, identified by the date of last update at the top of this document.
Article 10 – Contact
For any questions regarding this Privacy Policy or the processing of your personal data:
Symbiome
2637 Route de Montremont
74230 Thônes, France
Email: contact@trackbats.com