Privacy Policy

1. Data controller

The data controller is ETHILIFE, a SAS with a share capital of 500 €, registered with the Montpellier Trade Registry under no. 909 349 045, with its registered office at 377 Tertre Avenue Grassion Cibrand, 34130 Mauguio, France.

Any question: hello@tipote.com.

2. Scope

This policy covers the marketing site tiquiz.fr and the Tiquiz application (interactive quizzes, lead capture, marketing integrations). Tiquiz® is a registered trademark of ETHILIFE.

3. Data we collect

We collect only what the service needs. The data comes from three sources: what you type in yourself, what your browser sends automatically, and what our payment providers return after a transaction.

What you give us:

• Identity: first name, last name, email address. Required to create an account; without them the service cannot work.
• Billing: postal address, country, company name and VAT number if you have one. Asked at purchase time, to issue a compliant invoice.
• Phone: optional, never required.
• Content you create: your quizzes, questions, answers, result profiles, images and brand settings.

What your browser sends automatically:

• IP address, browser type, operating system, device, language.
• Access logs: date, time, page requested, response code. They serve security and fault diagnosis, not profiling.

What the service measures about your usage: number of quizzes created, views, starts, completions, conversion rate, last activity dates. These feed YOUR statistics and our subscription tracking.

Leads captured by your quizzes: the email addresses and answers of your quiz visitors. For that data YOU are the controller and Tiquiz acts as a processor, as set out in section 6. It is partitioned: only your account can read it (section 11).

Payment: card numbers and bank details are entered and handled directly by Stripe and PayPal. They never pass through our servers and Tiquiz stores none of them. We only receive the transaction reference, amount, currency and status.

4. Purposes and legal bases

Each processing operation answers a specific purpose and rests on an identified legal basis.

• Performance of the contract: creating and maintaining your account, giving you access according to your plan, collecting your subscription, issuing your invoices, answering your support requests, sending you messages related to your account (confirmation, security, renewal, cancellation).
• Consent: sending you marketing communications, setting non-essential cookies, publishing your testimonial. Each can be withdrawn at any time, as easily as it was given, without affecting your access to the service.
• Legitimate interest: improving the product from aggregated usage measurements, securing accounts, detecting and preventing fraud, abuse and self-referral attempts, keeping the service running.
• Legal obligation: keeping accounting and tax records, answering a request from a competent authority.

We make no automated decision producing legal effects concerning you, and we do no advertising profiling.

5. Use of Artificial Intelligence

Tiquiz uses AI models to generate quizzes and analyse your statistics. These operations do not trigger any automated decision producing legal effects. Outputs are suggestions that you validate.

6. Roles (specific to Tiquiz)

For the leads your quizzes capture, you are the data controller and Tiquiz acts as a processor. You are responsible for compliance with the applicable regulation and for informing your quiz visitors.

7. Recipients and processors

Your data is accessible only to the people and providers strictly required to run the service. Each one is bound by a contract imposing the same confidentiality and security obligations described here.

• Supabase: database and authentication hosting.
• Hostinger: application server hosting.
• Cloudflare: page delivery, protection against abuse and attacks.
• Stripe and PayPal: payment collection and subscription management. They are controllers for bank data.
• Resend: delivery of the emails we send you.
• Anthropic: artificial intelligence models, for the generation and analysis features.
• Systeme.io: only if you enable the marketing integration, and only with the key you provide.
• Google Analytics: audience measurement, set only after your consent.

No data is sold, rented, traded or handed to data brokers. No data is passed to advertisers. Outside this list, a disclosure can only happen on request from a competent judicial or administrative authority.

8. International transfers

Some sub-processors are located outside the EU. Transfers are framed by Standard Contractual Clauses or other adequate mechanisms recognised by the European Commission.

9. Retention

• Active account: for the whole duration of use.
• Inactive account: 3 years after last access.
• Prospecting data: 3 years.
• Invoices: 10 years (legal accounting requirement).
• Cookies: 13 months maximum.

10. Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data, as well as the right to withdraw consent at any time. Write to hello@tipote.com to exercise these rights. We reply within one month. You can also file a complaint with the French supervisory authority CNIL (www.cnil.fr) or your local EU authority.

11. Security

We implement technical and organisational measures proportionate to the risk:

• encryption in transit (TLS) across all domains, and encryption at rest for the database;
• data partitioned per account, enforced by the database itself (row-level security): an account can only read its own quizzes and leads;
• strict access control, logical isolation of production and development environments, access logging;
• regular backups with tested restoration;
• API keys for your tools (Systeme.io, GoHighLevel, webhook) encrypted with AES-256-GCM before being stored, never shown again in clear text, decrypted only by the server at the moment a lead is sent, and erased as soon as you remove them or your account is deleted. They are used only to create or update the contacts your quizzes capture, apply your tags and, if you chose to, enroll them in a course or community. They are never used to delete a contact, or to change your pages, funnels, courses, campaigns or automations;
• passwords never stored in clear text, and passwordless sign-in offered through a single-use link.

No system is infallible. Should a data breach be likely to result in a high risk to your rights, you will be informed and the supervisory authority notified within the time limits set by the regulation.

12. Signing in with Google and Google user data

Tiquiz offers a “Continue with Google” sign-in. It is optional: an account can be created and used entirely with an email address and a password, without ever going through Google.

This section describes precisely how Tiquiz accesses, uses, stores, protects, shares and retains Google user data.

What we access. When you choose “Continue with Google”, Google sends us three pieces of information, and only three:

• your email address, which identifies your Tiquiz account;
• your display name, used to address you in the interface;
• the unique identifier of your Google account, which lets us recognise you on later sign-ins.

We request only the openid, email and profile scopes. Tiquiz neither requests nor obtains any other access to your Google account: no Gmail, no Drive, no Calendar, no Contacts, no Photos, no YouTube, and no write, delete or publish permission. No Google password is ever sent to us, and we store none.

How we use it. These three items are used solely to create your Tiquiz account, open your session, recognise you on later sign-ins, and send you messages related to your account (confirmation, security, billing, answers to support requests). They are used for nothing else.

How we store and protect it. It is stored in the Tiquiz database, with the hosting providers listed in section 7, encrypted in transit and at rest, behind strict access control and access logging (section 11). Any transfer outside the European Union is covered as described in section 8.

Who we share it with. This data is never sold, rented, traded or handed over to anyone. It is not used for advertising, not passed to data brokers, and not used to train, improve or personalise artificial intelligence models. Only the processors strictly required to run the service have access to it, those listed in section 7, each bound by contract to the same obligations.

How long we keep it, and how to delete it. It is kept for the lifetime of your account, according to the periods in section 9, and deleted with it. You can request deletion of your account and of this data at any time under section 10: we answer within one month.

How to revoke our access. You can revoke Tiquiz's access to your Google account at any time at myaccount.google.com/permissions. Your Tiquiz account keeps working: you then sign in with your email address and a password.

Limited Use. Tiquiz's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

13. Cookies and trackers

Three families of cookies exist on our domains, and only the first is set without your agreement.

• Strictly necessary cookies: keeping your session, security, remembering your language, order basket. Without them the service does not work. They are exempt from consent.
• Audience measurement cookies: Google Analytics, set only after you accept, and refusable with no consequence on your use of the service.
• Affiliate cookie: when you arrive through an affiliate link, a cookie keeps that link for one year so the sale can be credited. It holds no personal data, only the affiliate's public code.

You can change or withdraw your choice at any time from the cookie banner, and delete cookies already set from your browser settings. An audience measurement cookie lives no longer than 13 months.

14. Minors

Tiquiz is reserved for adults. If a minor has sent us data, contact hello@tipote.com for deletion.

15. Changes

This policy may evolve. In case of material change, users are informed. Please check this page regularly.

16. Contact

ETHILIFE, 377 Tertre Avenue Grassion Cibrand, 34130 Mauguio, France, hello@tipote.com.

Supervisory authority: CNIL (www.cnil.fr).