Privacy policy
This policy explains which personal data is processed when you visit the Tosloc site or use the service, why, for how long, and how to exercise your rights. The French version prevails.
Updated 2026-10-18
1. Data controller
The data controller is Hadi Tahini, Entrepreneur individuel (French sole trader) trading as Tosloc, SIREN 990 123 572, business address 200 rue de la Croix-Nivert, 75015 Paris, France.
For any question or request about your data: contact@tosloc.fr.
2. Our role, depending on the data
- We are the controller for data about site visitors, account holders and subscription billing.
- We act as a processor for the data our customers enter about their own clients, site contacts and staff. For that data, contact the business you deal with: it decides how the data is used. The terms of this role are in the data processing agreement.
3. Site and demo visitors
The tosloc.fr site and the demo (demo.tosloc.fr) use no audience-measurement, advertising or social-media cookies, and load no third-party scripts of that kind.
We record each visit on our server, without a cookie and without reading anything on your device: the page path, the referrer host, a truncated IP address (last octet removed for IPv4, IPv6 cut to /48), the approximate city derived locally from it, and the user agent. This does not depend on the cookie banner: it happens the same way whether you accept or refuse.
Legal basis: legitimate interest in measuring the site’s audience. Kept 395 days. You can object by writing to contact@tosloc.fr.
4. Account holders
We process your name, email address, password hash, language and sign-in events (truncated IP address, city, user agent; for a failed attempt, the email typed is kept).
Legal basis: performance of the contract, and legitimate interest in keeping the service secure. Sign-in events and audit logs are kept 365 days, error logs 90 days.
5. Employee location (staff of our customers)
- Live position is shared only while sharing is switched on during an active job. It is deleted after 24 h or as soon as sharing is switched off.
- Visit start and end coordinates are kept 60 days.
- The employer, our customer, decides how this data is used and is its controller; we act on its behalf. The employee can switch sharing off at any time.
6. Cookies and trackers
We use only cookies the site and the app need to work, or that remember a choice you made (language, theme, your answer to the banner). These cookies are exempt from consent. The full list is below.
Refusing cookies in the banner does not limit your access to the site: no cookie that needs consent is set, whether you accept or refuse. Your answer, including a refusal, is remembered so you are not asked again on every page.
The banner is provided by Cookiebot (Usercentrics, Denmark). You can change or withdraw your choice at any time with the “Cookie settings” link at the bottom of every page of the site.
The app also keeps, in your browser’s storage, your recent searches (cleared when you sign out) and unfinished form drafts (cleared when you close the tab).
Subscription payment takes place on a page hosted by Stripe (checkout.stripe.com), which applies its own cookie policy.
| Cookie | Where | Purpose | Duration |
|---|---|---|---|
| CookieConsent | tosloc.fr | Remembers your answer to the cookie banner (accept or refuse) | 12 months |
| NEXT_LOCALE | tosloc.fr, app, demo | Remembers the display language | Until you close the browser |
| tosloc_theme | App, demo | Remembers the theme you chose | 12 months |
| tosloc_session | App, demo | Signals that a session is open, to send you to the right page | 30 days, removed on sign-out |
| tosloc_refresh | App, demo | Keeps you signed in securely (unreadable by page scripts) | 30 days, removed on sign-out |
7. Recipients and sub-processors
The providers that process data on our behalf are listed on the “Sub-processors” page, with their purpose, the data concerned and their location.
8. Transfers outside the European Union
Where a sub-processor is located outside the European Economic Area, the basis for the transfer is stated for that provider on the “Sub-processors” page. For more detail, write to contact@tosloc.fr.
9. Retention
| Data | Period |
|---|---|
| Site visits (truncated IP, city, user agent) | 395 days |
| Sign-in events | 365 days |
| Audit logs | 365 days |
| Error logs | 90 days |
| Visit start and end coordinates | 60 days |
| Live employee positions | At most 24 h, or as soon as sharing is switched off |
| Deleted files | Removed from storage after 30 days |
| Identity printed on issued invoices and accepted quotes | 10 years (French legal requirement) |
| Pay and working-time records | 5 years |
| Canceled workspace | Deleted 90 days after cancellation, with notices at 30 and 7 days; workspaces holding invoices or payroll records are retained until those records’ legal retention period has been addressed; you can export them at any time |
| Backups | Erased data can persist in backups until the backup retention period ends |
10. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability. To exercise them: contact@tosloc.fr, or the “Download my data” function in the app. We reply within one month.
A workspace owner can export the data of a client or an employee, export the whole workspace (.tar.gz archive) and erase a client or an employee. The identity printed on issued invoices or accepted quotes is then kept 10 years, and pay and working-time records 5 years, as the law requires.
You may lodge a complaint with the CNIL (www.cnil.fr).