Legal
Privacy Policy
How Tallrung uses the personal data of the people who use its app and website, and the rights they have.
Effective 11 November 2026
1.Who we are
Tallrung is run by JRM E-COMMERCE, a société par actions simplifiée (SAS), RCS Paris 907 676 928, of 9 rue des Colonnes, 75002 Paris, France (“Tallrung”, “we”, or “us”). We are the controller of the personal data this policy describes.
For any question about your data, or to use your rights, write to privacy@tallrung.com, or by mail to the address above. We have not appointed a data protection officer; write to privacy@tallrung.com.
2.Whom this policy covers
This policy covers the people whose data we decide how to use:
- Merchants’ owners, Members, and invited people, and anyone who signs up or tries to;
- people who visit our landing page and our legal pages;
- people who write to support, report content, or send us a legal request; and
- contacts at our suppliers and partners.
It doesn’t cover Buyers on Merchants’ Funnels and Landers, whose data we process for the Merchant. Section 12 explains what that means for you if you are a Buyer.
3.What we collect, why, and on what basis
Most data comes from you: what you type, upload, and connect. Some comes from your browser and device. When a Member invites you, we get your email address from them.
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Create and run your account and Workspace | Name, email address, password (stored only as a hash), Google account id if you sign in with Google, Workspace name, your role, and invitations (the invitee’s email and the inviter). | Contract (GDPR art. 6(1)(b)). | While the account is open, then the period in section 8. |
| Keep accounts secure | Sign-in sessions with the IP address and browser (user agent) that opened them, and counters of attempts per email address and per IP address. | Legitimate interest in security (art. 6(1)(f)). | A session until you sign out or it expires (7 days, renewed while you use it). The record of an expired session, with its IP address and browser, is deleted within 6 months. A counter until about a day after its time window ends. |
| Stop fake sign-ups and keep the one-trial-per-person rule | Your email address’s domain, the answer of a DNS lookup on it, signals from Vercel BotID, the time the form took, a hidden field bots fill, a one-way hash of your normalized email address, and your network (an IPv4 address, or the first half of an IPv6 address). | Legitimate interest in preventing fraud and abuse of free AI spending (art. 6(1)(f)). | The domain and bot checks are not stored. The network counter is kept about 30 days. The email hash is kept as long as the rule needs it, after the account closes too. |
| Bill plans and Credits | Billing name, email, and address, tax ID, plan, invoices, payments, and Credit purchases. Card details are held by Stripe, never by us. | Contract (art. 6(1)(b)), and our legal duties to keep accounting records (art. 6(1)(c)). | 10 years for invoices and payment records (Code de commerce, art. L123-22). |
| Keep the Workspace’s activity log | The Member’s email and user id, what they did (such as publishing, refunds, privacy requests, and exports), on what, when, and the outcome. Searches are logged without their text. | Legitimate interest in security and accountability within each Workspace (art. 6(1)(f)). | 1 year from each entry, then deleted. |
| Give support, keep the Services secure, and stop abuse, through staff access | When our staff open a Workspace and act in it as one of its users: everything that user could see and do, and an internal record of the access (which staff member, which user and Workspace, the reason, when it started and ended, and each change made during it). | Legitimate interest in helping you, securing the Services, stopping abuse, and meeting legal duties (art. 6(1)(f)). | The internal record: 1 year from the access, then deleted. |
| Keep the Services secure and enforce our Terms and policies, through bans | When our staff ban a person: who is banned, the reason, whether the person is shown it, the end date if there is one, which staff member banned them or lifted the ban, and when. | Legitimate interest in securing the Services, stopping abuse, and enforcing our Terms and policies (art. 6(1)(f)). | 1 year after the ban ends or is lifted, then deleted. |
| Send service emails | Your email address, and the content of the email: confirmations, password resets, invitations, trial and billing notices, low-credit warnings, and privacy-request notices. | Contract (art. 6(1)(b)), and legitimate interest for service notices (art. 6(1)(f)). | Sent through Resend. We keep no copy beyond the record that an email was queued. |
| Provide the Services with your content | What you put in: products, brand profile, pages, images, references, and chat messages with the AI. These may contain personal data, such as a support contact in your brand profile. | Contract (art. 6(1)(b)). | While the account is open, then the period in section 8. |
| Answer support requests | Your name, email address, and what you write to us. | Contract, or legitimate interest in answering you (art. 6(1)(b) or (f)). | 3 years after our last exchange, or after your account closes if that is later. |
| Handle reports, legal requests, and disputes | The reporter’s name and email address, the report, and our decision; the data a court or an authority asks for; and what a dispute needs. | Legal obligations, including the EU Digital Services Act (art. 6(1)(c)), and legitimate interest in defending our rights (art. 6(1)(f)). | 5 years after our decision, the period in which a claim about it can be brought (Code civil, art. 2224), or until a dispute about it is settled. |
| Run the landing page | The request your browser sends: IP address, browser, the page, and the time, as Vercel logs it to host and protect the site. | Legitimate interest in running a secure website (art. 6(1)(f)). | Vercel shows us these logs for 1 day (our Pro plan), and we keep no copy. Vercel keeps its own records under its privacy notice. |
Where the basis is our legitimate interest, we have weighed it against your rights, and you may object under section 9. We don’t use your data for advertising, we don’t sell it, and the app loads no analytics or advertising tags of its own.
4.The sign-up checks
Because a free trial is real AI spending, sign-up checks each request before it makes an account:
- Your email’s domain is compared with a list of about 10,000 disposable-email domains.
- One DNS lookup checks that the domain can receive email. If the lookup fails, the sign-up goes through.
- In production, Vercel BotID checks that a browser, not a script, sent the form; a signed token checks that the form was open at least 2 seconds; and a hidden field catches bots that fill every field. Sign-in with Google skips these three checks.
- A one-way hash of your email address, normalized first, is checked against the trials already given, and your network is counted: at most 3 trials start from one network in 30 days.
A refused sign-up is told why in general terms. A repeat sign-up still gets a Workspace, without a trial. These are automated checks. If you think one refused you by mistake, write to support@tallrung.com, and a person will review it.
5.Who receives your data
Our staff see your data only as their work needs, and they are bound by confidentiality. For support you ask for, for security, to stop abuse, or where the law requires it, staff may open a Workspace and act in it as one of its users, for at most one hour at a time. Each such access, with every change made during it, is recorded in an internal audit log that only our staff can read and that we keep for 1 year. It isn’t shown in the Workspace’s activity log, and we don’t notify the user. We share your data with the providers that run the Services for us, under contracts that bind them to protect it:
| Provider | What it does | Where |
|---|---|---|
| Vercel Inc. | Hosts the app, the landing page, and every funnel site, and runs the server code, the scheduled jobs, and the headless browser that checks pages before they publish. Stores uploaded and generated images (Vercel Blob). Connects custom domains. Runs the bot check on the sign-up form (Vercel BotID). | United States (server code in US East). Requests pass through Vercel's worldwide edge network, including EU locations. |
| Neon (Neon, LLC, and its parent Databricks, Inc.) | Hosts the database that holds every record of the Services, on Amazon Web Services. | United States (AWS us-east-1, Northern Virginia). |
| Google LLC | Suggests and completes shipping addresses as a Buyer types at checkout (Google Places API). Our server sends the typed text, never the Buyer's IP address. | United States and Google's other locations. |
| Resend (Plus Five Five, Inc.) | Sends the Services' own emails to Merchants and their members: sign-up confirmations, password resets, invitations, trial and billing notices, and low-credit warnings. | United States. |
| OpenRouter, Inc. | Runs the AI models that write pages, read images, and make images, from what a Merchant gives the Services: product details, the brand profile, pages, pages to copy, and images. It passes each request to an AI model provider, a company that runs AI models on its own servers. We don't choose which provider serves a request. | United States (OpenRouter). The model providers may be in the United States and in other countries outside the EU. |
| Atlas Cloud (ATLAS CLOUD AI INC.) | Makes and edits images for pages, from the Merchant's prompts and product photos. | United States (New York). |
| Stripe (Stripe Payments Europe, Ltd., and Stripe, LLC) | Bills our plans and credit purchases, on our own Stripe account: Checkout, the billing portal, saved cards, invoices, and tax IDs. Card numbers are held by Stripe only. | Ireland and the United States. |
Google is also an independent controller when you sign in with Google. When you connect an account of your own (Stripe, PayPal, Shopify, Meta, Google, or TikTok), we exchange data with it on your instruction, under your agreement with that provider.
We may also disclose data to authorities and courts when the law requires it, to our professional advisors under confidentiality, and to a buyer of our business, who would be bound by this policy.
6.Transfers outside the EU
The Services are hosted in the United States: the database in AWS us-east-1, and the server code in Vercel’s US East region. So your data is transferred outside the European Economic Area.
Where the provider is certified under the EU-US Data Privacy Framework, the European Commission’s adequacy decision of 10 July 2023 covers the transfer. Otherwise, it is covered by the Standard Contractual Clauses the Commission adopted in 2021, with additional measures where needed. The Sub-processors page states each provider’s mechanism. You may ask us for a copy of the clauses at privacy@tallrung.com.
7.Security
- All traffic to the app and to the sites is encrypted in transit (HTTPS).
- Passwords are stored only as hashes. Integration secrets are encrypted with AES-256-GCM under keys kept apart from the database.
- Access in a Workspace follows each Member’s role, and the activity log records sensitive actions.
- Card numbers are entered in Stripe’s own fields and never reach our servers.
- Sign-in, sign-up, and password-reset requests are rate-limited.
8.How long we keep data
We keep data only as long as its purpose needs, as the table in section 3 states. In general:
- When an account closes, we keep its data for 30 days, so that you can ask for a copy, then delete it within a month. The copies in the database’s restore history expire within 6 hours after that.
- A Workspace locked for longer than 12 months may be closed, after we tell its owners, and its data is then deleted as above.
- We keep invoices and payment records for 10 years, as French commercial law requires.
- We keep what a legal claim or an authority’s request needs until it is settled.
- We keep the trial-claim hash after an account closes, so that deleting an account doesn’t start a second trial.
Some of these deletions don’t run automatically yet: deleting a closed account’s data, closing a long-locked Workspace, and deleting old activity-log entries, staff-access records, ended ban records, expired session records, support emails, and reports. Until they are automated, our staff do them by hand, at least once a month.
9.Your rights
Under the GDPR and the French Data Protection Act, you have the right to:
- access your data and get a copy of it;
- correct it;
- have it erased;
- restrict its use;
- object to a use based on our legitimate interest;
- receive the data you gave us in a common machine-readable format, and have it sent to another provider;
- withdraw a consent you gave, without affecting what was done before; and
- give instructions about what happens to your data after your death.
Write to privacy@tallrung.com. We answer within one month, which we may extend by two months for a complex request, after telling you. We may ask you to prove who you are. Some data we must keep, such as invoices, even after a request to erase it.
You may complain to the French data protection authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France; cnil.fr), or to the authority where you live or work.
11.Minors
The Services are for businesses. We don’t knowingly collect data from anyone under 18 as a user of the app.
12.If you bought from, or visited, a Merchant’s funnel
Merchants use Tallrung to run their own sales pages, on their own domains or, for testing, on a subdomain of tallrung.site. When you visit one or buy on it, the Merchant is the controller of your data: the Merchant decides why it is collected and how it is used. We process it on the Merchant’s behalf, under our Data Processing Agreement, only to run the page, the checkout, and the order.
That data includes your contact details, shipping address and phone, your order, your IP address and browser, the visit’s source (such as an ad’s click id), and the cookies the page sets. Payments go to the Merchant’s own Stripe or PayPal account, and orders to the Merchant’s Shopify store.
To use your rights, contact the Merchant: their details are in the policies on their checkout and on their website. If you write to us, we send your request to the Merchant and tell you that we did.
13.Changes to this policy
We may update this policy. We show the date it took effect at the top. When a change matters to you, we tell Merchants by email and in the app before it takes effect.