Privacy policy
Last updated: October 29, 2026
Data controller
The publisher of ToyTrust, a private individual, reachable at [email protected] for any question about your data.
Data collected and purposes
| Data | Why | Legal basis |
|---|---|---|
| Email address, username, password (stored encrypted) | Create and secure your account, send you the service emails | Performance of the contract (terms of use) |
| Inventory: sets, owned and missing parts, storage | Provide the inventory service | Performance of the contract |
| History of your searches (text and photo) and their results | Find your past searches, improve the relevance of the catalog | Legitimate interest |
| Photos sent for photo search or photo tally | Identify your toys, handle your disputes, improve the search | Performance of the contract and legitimate interest |
| Credit consumption and log of AI calls | Count credits, prevent abuse, control costs | Performance of the contract and legitimate interest |
| Browsing data: pages viewed, referrer, device and browser type, country | Measure the site's audience and improve it | Consent |
No data is sold or used for advertising.
Recipients and processors
- OVH SAS (France): hosting of the website and database.
- Cloudflare, Inc. (United States): storage and delivery of the catalog images.
- Google (Gemini API): analysis of the photos sent and content generation. Photos are sent to Google only to process the request, through the paid tier of the API, whose data is not used to train Google's models. ToyTrust itself trains no model: the search compares the photos with an index of visual fingerprints of the catalog.
- Resend, Inc. (United States): sending of the service emails (account confirmation, notifications).
- Google Ireland Limited (Google Analytics): audience measurement, if you accept it.
Transfers outside the European Union (United States) rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.
Retention periods
- Account and inventory: as long as the account exists, then deleted within 30 days of the request.
- Search history and photos sent: 3 years at most, or until the account is deleted.
- Logs of credit consumption and AI calls: 3 years.
- Audience measurement: 14 months in Google Analytics, cookies valid for 13 months at most.
Cookies
Cookies required for the website to work are exempt from consent: the session cookie, which keeps you logged in; the "remember me" cookie, which keeps you logged in for 30 days if you tick that option or sign in with Google or with the QR code of the phone, until you log out or change your password; and the record of your cookie choice in your browser.
Only with your consent, Google Analytics measures the site's audience: pages viewed, referrer, device and
browser type, country. It is loaded and sets its cookies (_ga, _ga_*) only if you
click "Accept"; refusing changes nothing in how you can use the site. Google Analytics does not log IP
addresses and no advertising feature is enabled. The cookies expire after 13 months at most.
You are asked again after 6 months. You can change your choice at any time with the "Manage cookies" link at the bottom of every page: if you refuse, the Google Analytics cookies are deleted.
Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, and to set instructions on what happens to it after your death. To exercise them, write to [email protected]; you will get an answer within one month. You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the authority of your country.
Security
Passwords are stored encrypted, exchanges go through HTTPS and access to the data is limited to the publisher.