Privacy Policy
Last updated: 25 September 2026
Controller: Maxime Ragionieri, Entrepreneur individuel (EI), trading as TabToCart, 40 rue Bourges, 72000 Le Mans, France — hello@tabtocart.com
What we collect and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account data (name, email, company, hashed password) | Provide the Service | Contract | Account lifetime; deleted on request |
| Billing data (handled by Stripe: billing address, VAT number, payment method) | Invoicing, payments | Contract, legal obligation | 10 years for accounting records (French Commercial Code) |
| Scan data (URLs, technical results, element snippets, screenshots of public pages) | Provide monitoring and reports | Contract / legitimate interest (free scans) | Free scans 30 days; screenshots 90 days; history per plan |
| Free-scan requests (URL, email if provided, daily-rotated hashed IP) | Deliver results, prevent abuse | Legitimate interest | 30 days |
| Product analytics (cookie-less events such as "scan started", no IP) | Improve the Service | Legitimate interest | 13 months |
| Emails (transactional, alerts, reports, onboarding tips) | Service communication | Contract / legitimate interest (tips, with one-click opt-out) | Log kept 13 months |
| Newsletter (email, language, sign-up source, consent and confirmation dates) | Monthly barometer and practical tips | Consent (double opt-in), withdrawable at any time via the link in each email | Until unsubscription, then the address is kept only as an opt-out record |
| Barometer (public pages of a sample of online stores, technical results) | Anonymous aggregate statistics | Legitimate interest (research on accessibility) | Results kept to compute trends; screenshots not kept; stores never named |
We do not store payment card data, cookies from scanned websites, or data about visitors of scanned websites. Snippets are stripped of form values.
Cookies
We use a session cookie when you log in, a short-lived cookie to remember your sign-up intent, a language cookie, and first-party referral/source cookies used only to credit referrals and count sign-ups per source. No advertising or cross-site tracking cookies. See the Cookie Policy.
Recipients and sub-processors
- Render Services, Inc. — Hosting of servers, database and backups — Frankfurt, Germany (EU); US company, Standard Contractual Clauses
- Stripe Payments Europe Ltd. — Payments, invoicing, tax calculation — Ireland (EU); transfers under Stripe's DPA
- Sendinblue SAS (Brevo) — Transactional and lifecycle emails — France (EU)
- Cloudflare, Inc. (optional) — DNS, CDN, bot protection (Turnstile) — EU/US; EU-US Data Privacy Framework
Your rights
You can access, rectify, export, restrict or delete your data, object to processing based on legitimate interest, and withdraw consent. Export and deletion are available directly in Settings. Contact hello@tabtocart.com. You may lodge a complaint with the CNIL (www.cnil.fr).
Security
Passwords are hashed (bcrypt); sessions are random tokens stored as hashes; data is encrypted in transit (TLS); backups are encrypted; scanners run in isolated browsers with network egress restricted to public internet addresses.