Privacy Policy

TrackSorter is committed to protecting your privacy and personal data. This privacy policy explains how we collect, use, and protect your information in accordance with the General Data Protection Regulation (GDPR) and French legislation.

1. Data Controller

The data controller for your personal data is SPYK SAS, a French company operating TrackSorter. For any questions regarding your personal data, you can contact us via our contact form.

2. Data Collected

2.1 Data You Provide

• Account data : email address, password (encrypted), name (optional)
• Billing data : name, billing address, payment information (processed by Stancer)
• Communications : messages sent through our contact form or by email

2.2 Automatically Collected Data

• Technical data : IP address, browser type, operating system, session identifier
• Usage data : service usage statistics, number of photos analyzed, credits used
• Desktop app data : application version, operating system, anonymized error reports

2.3 Image-Related Data

• Thumbnails : reduced versions of your images (low resolution) used only for AI analysis
• Metadata : filename, capture date, EXIF data from the original file

3. Purposes of Processing

We use your data for the following purposes:

Purpose	Legal Basis
Provision of image sorting service	Contract performance
User account management	Contract performance
Payment processing and billing	Contract performance / Legal obligation
Credits and subscriptions management	Contract performance
Referral program and promo codes	Contract performance
Customer support and inquiry response	Legitimate interest
Service and AI improvement	Legitimate interest
Marketing communications (if consent)	Consent
Fraud prevention and security	Legitimate interest
Compliance with legal and tax obligations	Legal obligation

4. Data Retention

We retain your data for the following periods:

• Account data : for the duration of your account, then 3 years after closure
• Billing data : 10 years (legal accounting obligation)
• Image thumbnails : deleted within 30 days of analysis
• Connection logs : 1 year (legal obligation)
• Cookies : maximum 13 months

5. Data Sharing

5.1 Service Providers

We use the following service providers:

• Stancer : credit card payment processing (France)
• Hosting provider : server and data hosting (European Union)
• Email service : sending transactional emails

All our service providers are bound by data processing agreements compliant with GDPR.

5.2 Other Recipients

We never sell your personal data. We may share your data with competent authorities if required by law.

6. Data Transfers

Your data is hosted and processed within the European Union. Photo processing and the analysis API are hosted by us on our own servers. No transfer to a third country is performed.

7. Cookies and Similar Technologies

7.1 Types of Cookies Used

• Essential cookies : necessary for the website to function (session, authentication, language preferences)
• Analytics cookies : to understand how you use our service and improve it

7.2 Cookie Management

You can manage your cookie preferences via the consent banner displayed on your first visit, or at any time through your browser settings. Refusing non-essential cookies does not affect the basic functionality of the service.

8. Data Security

We implement appropriate technical and organizational security measures to protect your data:

• Encryption of data in transit (HTTPS/TLS)
• Password encryption (secure hashing)
• Restricted data access (principle of least privilege)
• Regular and secure backups
• Access monitoring and logging

9. Your Rights (GDPR)

In accordance with GDPR and the French Data Protection Act, you have the following rights:

• Right of access : obtain a copy of your personal data
• Right to rectification : correct your inaccurate or incomplete data
• Right to erasure : request deletion of your data ("right to be forgotten")
• Right to restriction : restrict processing of your data in certain circumstances
• Right to portability : receive your data in a structured, machine-readable format
• Right to object : object to processing of your data for legitimate reasons
• Right to withdraw consent : at any time for processing based on consent
• Right to define directives : regarding the fate of your data after your death

9.1 How to Exercise Your Rights

To exercise your rights, you can:

• Use the options available in your account dashboard
• Contact us via our contact form

We will respond to your request within one month. This period may be extended by two months for complex requests, in which case we will inform you.

9.2 Complaint to CNIL

If you believe that the processing of your data does not comply with regulations, you have the right to lodge a complaint with the French Data Protection Authority (CNIL):

• Website: www.cnil.fr
• Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

10. Protection of Minors

TrackSorter is not intended for persons under 16 years of age. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided us with personal data, please contact us.

11. Changes to this Policy

We may update this privacy policy periodically. In case of substantial changes, we will notify you by email or through a notification on our service. The date of the last update is indicated at the top of this page.

12. Contact

For any questions regarding this privacy policy or your personal data, you can contact us via our contact form.