Privacy Policy

1. Who we are

Thingz is operated by TYROU Grégoire, an Entreprise Individuelle registered in France under SIREN 981 883 655. The service is published under the établissement THINGZ (SIRET 981 883 655 00020), located at 7 rue Veillon, 31500 Toulouse, France.

The service is accessible at thingzapp.com and app.thingzapp.com.

For any question about this policy or your personal data, contact us at privacy@thingzapp.com.

2. What we collect

We collect only the data that is strictly necessary to provide the service.

Account data — when you sign up, we collect your email address and your name. Nothing else is required.

Usage data — we may collect basic technical data such as your IP address, browser type, and the pages you visit, for the purpose of maintaining security and diagnosing errors. This data is not linked to your identity and is not used for tracking or analytics.

Billing data — subscription and payment information is handled entirely by Stripe. We do not see or store your card details. We receive only billing metadata such as subscription status and invoice history.

We do not use third-party analytics tools such as Google Analytics.

3. How we use your data

We use your email address and name exclusively for:

• Creating and managing your Thingz account
• Sending you notifications related to your account activity (hacktions, memos, reminders, status updates)
• Sending you transactional emails such as password resets, billing confirmations, or account alerts
• Contacting you about service updates, if you have opted in to communications

We do not use your data for advertising, profiling, or any purpose unrelated to providing the service.

4. Legal basis for processing (GDPR)

We are subject to the General Data Protection Regulation (GDPR) as a service operated from France within the European Union.

The legal basis for processing your personal data is:

• Contract performance — processing your email and name is necessary to provide the service you signed up for (Article 6(1)(b) GDPR)
• Legitimate interest — basic technical data processed for security and error diagnosis (Article 6(1)(f) GDPR)
• Legal obligation — billing and tax records retained as required by French law (Article 6(1)(c) GDPR)
• Consent — for any optional marketing communications, which you can withdraw at any time

5. Who we share your data with

We do not sell your personal data. We do not share it with third parties for advertising or marketing purposes.

We use a limited number of trusted sub-processors to operate the service:

• Supabase — database and authentication infrastructure, hosted in the European Union
• Railway — application hosting
• Stripe — payment processing and billing. Stripe acts as an independent data controller for payment data under its own privacy policy.
• Sentry — error tracking (no personal data intentionally sent)
• Anthropic — AI features (Carson) are powered by Anthropic's Claude API. Content submitted to AI features may be processed by Anthropic in accordance with their API data processing terms.

If the service is integrated with a third-party tool you have authorised (such as Slack, Microsoft Teams, or HubSpot), data shared through that integration is governed by the terms and privacy policy of that third party.

6. How long we keep your data

We keep your account data for as long as your account is active. If your account is closed or deactivated, we delete your personal data within 180 days, unless we are required by law to retain it longer.

Billing records may be retained for longer periods as required by French accounting and tax law.

If your account is scheduled for deletion, you will be notified in advance and given the opportunity to export your data before deletion occurs.

7. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — you can request a copy of the data we hold about you
• Right of rectification — you can ask us to correct inaccurate data
• Right of erasure — you can ask us to delete your data
• Right to restriction — you can ask us to limit how we use your data
• Right to portability — you can ask us to provide your data in a portable format
• Right to object — you can object to processing based on legitimate interest
• Right to withdraw consent — if processing is based on consent, you can withdraw it at any time

To exercise any of these rights, contact us at privacy@thingzapp.com. We will respond within 30 days.

You also have the right to lodge a complaint with the French data protection authority, the CNIL.

8. Cookies

Thingz uses only strictly necessary cookies required for the service to function — specifically, session cookies used for authentication. These cookies are essential and cannot be disabled without breaking the service.

We do not use advertising cookies, tracking cookies, or third-party analytics cookies.

9. Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted connections (HTTPS), database access controls, and row-level security on all data.

No method of transmission over the internet is completely secure. If you believe your data has been compromised, contact us immediately at privacy@thingzapp.com.

10. Children

Thingz is a business tool intended for adults acting in a professional capacity. We do not knowingly collect personal data from anyone under the age of 16. If you believe a minor has created an account, please contact us and we will delete it promptly.

11. Changes to this policy

We may update this policy from time to time. When we do, we will update the date at the top of this page and, if the changes are significant, notify you by email.

Your continued use of Thingz after a change constitutes acceptance of the updated policy.

12. Contact

For any question about this policy, your data, or a request to exercise your rights:

• Email: privacy@thingzapp.com
• General contact: hello@thingzapp.com
• Postal: TYROU Grégoire — THINGZ, 7 rue Veillon, 31500 Toulouse, France