Privacy policy

1. Data controller

The controller of the personal data collected through the todai.fr website is TODAI, a SASU with share capital of €500, registered with the Paris Trade and Companies Register (RCS) under number 104 321 237, with its registered office at 61 Rue de Lyon, 75012 Paris.

For any question about your data, contact Pierre Pinon, president, at contact@todai.fr.

2. Data collected

Todai collects the data strictly necessary for its intermediation services, in the following categories:

• Identification and contact data: last name, first name, email address, phone number, job title and company where relevant.
• Professional data: LinkedIn profile, background, skills, technical stack, rate, availability, references and anything provided voluntarily as part of an application or a brief.
• Data relating to exchanges: content of submitted forms, messages, qualitative feedback and relationship history.
• Browsing data: pages viewed, performance indicators, device type and anonymized technical data (Vercel Analytics, Vercel Speed Insights).

No sensitive data within the meaning of article 9 of the GDPR (health, opinions, etc.) is knowingly collected.

3. Purposes and legal bases

• Processing your introduction request (recruitment or application). Legal basis: performance of pre-contractual measures at your request (article 6.1.b GDPR).
• Building and maintaining a network of Data & AI freelancers in order to offer you assignments. Legal basis: Todai's legitimate interest in carrying out its placement activity, balanced against your rights (article 6.1.f).
• Sending you relevant commercial communications (assignment briefs, opportunities). Legal basis: consent (article 6.1.a) or legitimate interest for B2B prospects, with the option to object at any time.
• Measuring site audience and improving the service. Legal basis: legitimate interest (anonymized audience measurement exempt from consent by the CNIL, deliberation no. 2020-091).
• Complying with our legal obligations (accounting, fraud prevention). Legal basis: legal obligation (article 6.1.c).

4. Retention periods

• Data of prospects and clients (companies): 3 years from the last active contact.
• Data of freelancers registered in the network: 3 years from the last contact, or until a deletion request.
• Data used for invoicing and accounting: 10 years (legal obligation).
• Anonymized browsing data: 25 months maximum.
• Audience measurement cookies: 13 months maximum.

5. Recipients and processors

Your data is accessible only to authorized persons within Todai. It may be passed to the following technical processors, which are involved in running the site and are bound by a contract compliant with article 28 GDPR:

• Vercel Inc. (United States): site hosting and audience measurement.
• Supabase Inc. (Singapore, storage in the European Union): database and storage of information submitted through the forms.
• Resend Inc. (United States): sending transactional emails.
• Generative AI providers (via Vercel AI Gateway): processing of brief or application content when necessary for qualification, with no use for model training.

Your data is never sold to third parties.

6. Transfers outside the European Union

Some processors are located in the United States. Transfers are governed either by the standard contractual clauses (SCCs) approved by the European Commission, or by the EU-US Data Privacy Framework where the processor participates in it. Data stored in the database is hosted on servers located in the European Union.

7. Your rights

In accordance with articles 15 to 22 of the GDPR, you have the following rights:

• Right of access to your data.
• Right to rectification.
• Right to erasure ("right to be forgotten").
• Right to restriction of processing.
• Right to data portability.
• Right to object, in particular to commercial prospecting.
• Right to withdraw your consent at any time.
• Right to set instructions on what happens to your data after your death.

To exercise these rights, write to contact@todai.fr specifying your request. You will receive a reply within one month.

If you believe your rights are not being respected, you can file a complaint with the CNIL (French data protection authority): 3 place de Fontenoy, 75007 Paris, cnil.fr.

8. Cookies

The site only uses anonymized audience measurement cookies (Vercel Analytics, Vercel Speed Insights), exempt from consent by the CNIL. No advertising cookies or commercial third-party trackers are set. You can configure your browser to block cookies at any time.

9. Security

Todai implements technical and organizational measures to protect your data: TLS encryption on all exchanges, database encrypted at rest, role-based access control, logging of sensitive access, regular backups. In the event of a data breach likely to create a risk to your rights, you will be informed in accordance with article 34 of the GDPR.

10. Changes to this policy

This policy may change to reflect changes in the business or in regulations. The date of the last update appears at the top of the page.