6 Avenue Neil Armstrong – 33692 MERIGNAC Cedex, France
3. Categories of Data Collected
Depending on usage, we may collect:
Account data: email address, internal identifiers
Profile and eligibility data: needed for access to surveys/activities
Reward and redemption data: wallet status, reward history, validation signals
Technical data: IP address, device type, operating system, browser
Usage and interaction data: activity on the platform
Security and fraud-prevention data: signals and logs
Consent and preference data: cookie preferences, marketing preferences
We do not knowingly collect personal data from individuals who are not legally eligible to use the Service.
4. Purposes of Data Processing
We process personal data for:
Account creation and management
Access to surveys, tests, and activities
Validation of participation and rewards attribution
Fraud detection, prevention, and investigation
Platform security and integrity
Compliance with legal/regulatory obligations
Service improvement and performance monitoring
Marketing communications (newsletters, platform updates, re-engagement), where permitted and according to user preferences
Affiliate attribution: tracking which publisher partner referred you (Google Ads, Microsoft Ads, CPX, AYET, etc.) and calculating commissions owed to acquisition partners
5. Legal Bases for Processing
Depending on the context, processing is based on:
Performance of a contract (providing the Service)
Consent (notably for certain cookies and some marketing contexts)
Legitimate interests (fraud prevention, security, service improvement)
Compliance with legal obligations
Basic advertising measurement (modeled conversions for Google Ads): when no advertising consent is given, we transmit only pseudonymous conversion signals (Google Click Identifier, pseudonymous transaction ID, country) without any personal data. Legal basis: legitimate interest in measuring the effectiveness of our acquisition channels.
Enhanced Conversions for Leads enrichment (Google Ads): if you accept advertising cookies (TCF v2.3 signals ad_user_data + ad_personalization), we enrich the conversion signal with your SHA-256 hashed email (irreversible), enabling precise cross-device attribution. Legal basis: explicit consent. You may withdraw consent at any time via the cookie banner.
Affiliate attribution to publisher partners (non-Google): for CPC/CPA publishers (CPX, AYET, etc.), we transmit pseudonymous attribution identifiers (subId1, subId2) needed to compute commissions. Legal basis: legitimate interest in managing our publisher partnership program.
Where processing is based on consent, users may withdraw consent at any time.
6. Data Sharing and Recipients
We may share personal data with trusted third parties when necessary to operate the Service, including:
Analytics tools (Google Analytics), subject to your cookie choices
Survey, research, and reward partners (eligibility, validation, redemption)
Security and fraud-prevention providers and internal systems
Google Ads (Google LLC): for sign-up conversion measurement via the Enhanced Conversions for Leads API. Data enriched with SHA-256 hashing (irreversible email hash) only with your advertising cookie consent.
Google AdSense and Google Ad Manager (Google LLC): for contextual advertising display, subject to your cookie choices.
Ad.Plus (Performance Ads LLC): advertising mediation wrapper (Prebid + Google Ad Manager), subject to your cookie choices.
Publisher partners and acquisition affiliates (CPX, AYET, etc.): transmission of pseudonymous attribution identifiers (subId1, subId2, Google Click Identifier) needed to compute commissions, without any direct personal data.
Recipients process data under contractual obligations and applicable laws.
We do not sell personal data.
7. International Data Transfers
Some providers (for example, analytics and marketing email providers) may process data outside the European Economic Area.
Where transfers occur, we implement appropriate safeguards in accordance with GDPR requirements (such as Standard Contractual Clauses and/or an adequacy decision where applicable).
8. Data Retention
We retain personal data only for as long as necessary for the purposes described in this Policy.
Key retention periods (summary):
Category
Retention
Active account data
Retained for the duration of the account
Inactive accounts
24 months without activity → deleted or anonymized after notice
Marketing data
Up to 3 years from last interaction, unless you opt out earlier
Support tickets
1 year after resolution
Security & anti-fraud logs
Up to 12 months, restricted access
Cookie consent choices
Up to 6 months, unless updated earlier
Reward/redemption history
Account lifecycle, then restricted archive for fraud prevention and legal defense
9. Data Security
We implement technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure.
No system can guarantee absolute security.
10. Your Rights
In accordance with GDPR, you have the following rights:
Right to access your personal data
Right to rectify or complete your data
Right to erasure (under conditions)
Right to restrict processing
Right to data portability
Right to object to processing (marketing, profiling)
Right regarding automated decisions – request human intervention
Requests may be submitted via our support channels and may require identity verification.
Users also have the right to lodge a complaint with a supervisory authority. In France, the supervisory authority is the CNIL (Commission Nationale de l'Informatique et des Libertés).
11. Cookies and Tracking Technologies
We use cookies and similar technologies for functionality, security, analytics, and advertising where applicable.
Users can manage preferences via our consent management interface. For more details, see our Cookie Policy.
12. Automated Eligibility and Anti-Fraud Checks
We may use automated checks based on profile and activity signals to determine eligibility for certain surveys/activities and to prevent fraud and abuse.
These checks help protect users and partners and maintain service integrity.
Users may contact support if they believe an eligibility restriction is incorrect.
13. Account Deletion and Data Erasure
Users may request deletion of their account at any time, subject to identity verification and legal obligations.
Certain data may be retained in restricted archives where required by law or necessary for fraud prevention, dispute resolution, or legal defense.
14. Changes to This Privacy Policy
We may update this Privacy Policy to reflect legal, operational, or service changes. Users are encouraged to review it regularly.