Privacy policy
Version 1.1, updated on October 29, 2026 (sign-in with Google). This policy supplements article 8 of the terms of use.
1. Data controller
1.1. The data controller is the publisher of TRIALO, identified in the legal notice (hereinafter "the Publisher").
1.2. Contact for any question regarding personal data: contact [at] trialo.app.
2. Data collected, purposes and legal bases
| Data | Purpose | Legal basis (GDPR, art. 6) |
|---|---|---|
| First name, last name; email address (optional for a student); role (student, teacher); linked class | Create and manage the account, send the login link and code, link the student to their class | Performance of the contract (art. 6.1.b) |
| Google account, if you choose “Continue with Google”: verified email address, first name, last name | Create the account and sign you in; the first and last name are used as default values and can be changed at any time | Performance of the contract (art. 6.1.b) |
| Fictional campaigns, audiences, settings and exports created in the simulator | Let the user find, edit and export them | Performance of the contract (art. 6.1.b) |
| Profile photo (optional) | Personalize the account; let the teacher identify their students | Consent, given by voluntarily adding the photo (art. 6.1.a) |
| Teacher's billing information (company, address, VAT number, billing email); invoices | Bill subscriptions, comply with accounting and tax obligations | Performance of the contract (art. 6.1.b); legal obligation (art. 6.1.c) |
| Access request (profile, first name, last name, email, school or company, optional headcount and message) | Respond to the request and open access | Pre-contractual measures taken at your request (art. 6.1.b); consent (art. 6.1.a) |
| Messages sent to support | Respond to requests | Performance of the contract (art. 6.1.b); legitimate interest in ensuring follow-up (art. 6.1.f) |
| Network-zone fingerprint (never the full IP address), login timestamps, action log | Security: detect account sharing, abuse and intrusion attempts | Legitimate interest (art. 6.1.f) |
| Irreversible hash of the student's email address | Count the seats used by a teacher, without keeping the address in clear text | Legitimate interest (art. 6.1.f) |
| Payment data | Processed exclusively by Stripe; the Publisher neither receives nor stores any card number | Performance of the contract (art. 6.1.b) |
2.2. Never enter real personal data of third parties in the campaigns: everything in them is fictional. No sensitive data within the meaning of article 9 of the GDPR is requested. No automated decision producing legal effects is made.
3. Who sees what?
3.1. The teacher sees the first name, last name, email address (if the student has linked one), profile photo (if the student has added one) and enrollment date of the students in their classes. They also see their campaigns created in their class: they can comment on them and export them as PDFs.
3.2. Other students see no data from other accounts.
4. Retention periods
- 4.1. Student accounts and campaigns: deleted six months after the class ends, with a warning email 30 days beforehand.
- 4.2. Deletion on request: you can delete your account at any time from the simulator; your data is then erased immediately, subject to 4.5.
- 4.3. Security log: 30 days for the network-zone fingerprint; 12 months for the action log (without content or IP address).
- 4.4. Irreversible hash of a student's email address: kept as long as the teacher's subscription exists.
- 4.5. Invoices and accounting records: 10 years (article L. 123-22 of the French Commercial Code).
- 4.6. Support exchanges: 3 years after the last exchange.
- 4.7. Access requests: 12 months after the request.
5. Recipients and processors
- 5.1. Cloudflare, Inc.: hosting of the site, the application and the database.
- 5.2. Stripe Payments Europe, Ltd. (Ireland): payment of subscriptions.
- 5.3. Resend, Inc. (United States): sending of login links and codes and service emails.
- 5.4. Google Ireland Limited (Ireland): optional sign-in with a Google account. Google receives your sign-in request; TRIALO receives only your verified email address, first name and last name. No Google password is passed to TRIALO and no other Google service (Gmail, Drive, calendar) is accessed.
5.5. These providers act as processors (or, for Stripe and Google, as controllers for their own obligations or their own service) under contracts compliant with article 28 of the GDPR. Data is neither sold nor used for advertising purposes.
6. Transfers outside the European Union
6.1. Some providers (Cloudflare, Resend, Google, and Stripe for certain operations) are established in the United States or may process data outside the European Union.
6.2. These transfers are covered by the safeguards provided for in Chapter V of the GDPR: the adequacy decision on the EU–US Data Privacy Framework for providers certified under it, and, failing that or in addition, the European Commission's standard contractual clauses.
7. Cookies and external resources
7.1. TRIALO uses only technical login cookies, strictly necessary for the service to work and exempt from consent: a session cookie and, for a few minutes during a sign-in with Google, a security cookie for the redirection. By default, the session cookie disappears when the browser is closed and the session ends after 2 hours of inactivity (12 hours at most). If you tick “Stay signed in”, it lasts 30 days. No advertising cookie or audience-measurement tool is used.
7.2. Fonts are hosted by TRIALO: no request is sent to a third-party service to display the site.
7.3. Three exceptions, triggered only by an action on your part: the Cloudflare Turnstile anti-bot check at sign-in, sign-in with Google (you leave TRIALO for Google’s page, which applies its own privacy policy and cookies) and the preview of an Instagram post when you paste its link into the simulator (this preview is provided by Instagram/Meta, which may set its own trackers).
8. Your rights
8.1. You have the right of access, rectification, erasure, restriction, objection (notably to processing based on legitimate interest) and portability of your data. Where processing is based on your consent, you may withdraw it at any time (for example by deleting your photo), without affecting the lawfulness of past processing.
8.2. You can change your name, email and photo, and delete your account, directly from "My profile and settings".
8.3. For any other exercise of rights, write to contact [at] trialo.app. Proof of your identity may be requested in case of reasonable doubt. A reply is given within one month, extendable by two months for complex requests.
8.4. If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr).
9. Intended audience
TRIALO is intended for adults: students, vocational trainees and professionals. The service is not intended for minors.
10. Security
The Publisher implements appropriate technical and organizational measures: passwordless sign-in by single-use link or code, encryption of exchanges (HTTPS), partitioning of accounts, limitation of attempts and secure logging. In the event of a data breach likely to create a risk to your rights, the Publisher informs the CNIL and, where applicable, the persons concerned, under the conditions provided by the GDPR.
11. Changes
This policy may be amended to reflect changes in the service or in the law. The effective date appears at the top of the page; in the event of a substantial change, users are informed by email or in the application.