Your data stays yours.

In short

We don’t sell your data. Ever. Not to advertisers, and not to AI services. Your emails are protected when stored. We only process them to provide the service, and we do not train AI models on them.

We host your main data in France. Your attachments are stored in the European Union. It’s your content, it stays with you, under your control.

You are free to leave whenever you want. You can export your data and delete your account in a few clicks from your interface. Once the account is deleted, your data disappears immediately from our active servers and is permanently purged from our backups within 30 days maximum.

For any questions regarding your data, you can contact us via the form at /contact/ or write to us by post at ALK Innovations, 31 avenue des Korrigans, 44300 Nantes, France.

The detailed version is available below.

Detailed version

Table of contents

1. Who is responsible for data
2. Data we process
3. Purposes and legal bases
4. Retention periods
5. Service providers and recipients
6. Google user data (Limited Use)
7. Transfers outside the European Union
8. Your rights
9. Data security
10. Cookies and trackers
11. Data relating to minors
12. Future developments (Artificial Intelligence)
13. Changes to this policy
14. Contact and complaints

1. Who is responsible for data

The company responsible for data is ALK Innovations, a SASU with a capital of €1,000, registered with the Nantes RCS under number 983 856 642, whose registered office is located at 31 avenue des Korrigans, 44300 Nantes, France (hereinafter “ALK Innovations” or “we”).

ALK Innovations publishes the Trupeo service (hereinafter “the Service”), a shared inbox intended for professionals.

The legal representative and publication director is Quentin Georget, President of ALK Innovations. He is also the point of contact for any questions relating to the protection of personal data.

2. Data we process

We collect and process the following categories of data:

• User account data: first name, last name, professional email address.
• Connected mailbox data: email address of the synced mailbox and protected technical information needed to connect that mailbox to Trupeo.
• Message content: subject, message body, senders, recipients, attachments, labels, and folders. This data is protected when stored.
• Billing data: name, billing address, VAT number, transaction history. Credit card data is processed directly by our provider Stripe; ALK Innovations does not store any payment data.
• Technical logs: IP address (for security and incident detection), connection timestamps.

3. Purposes and legal bases

4. Retention periods

• Active account: data is kept for the entire duration of the contractual relationship.
• After account deletion: deletion is immediate on production servers. Full purge of backups occurs within 30 days maximum.
• Billing data: kept for 10 years under accounting obligations (French Commercial Code).
• Security logs: kept for the minimum duration required by law or necessary for incident management.

5. Service providers and recipients

6. Google user data (Limited Use)

When you connect a Gmail mailbox to Trupeo, Trupeo accesses that mailbox through the Gmail API, with the permission you grant on the Google consent screen. Trupeo requests a single Gmail permission, gmail.modify, which lets it display your messages and apply to Gmail the actions you perform in Trupeo. Trupeo never permanently deletes your Gmail messages.

Trupeo’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In practice:

• We use Gmail data only to provide the shared inbox features you see in Trupeo: displaying, assigning, and answering your messages, and reflecting in Gmail the actions you perform in Trupeo (read/unread, archive, trash, spam).
• We do not sell Gmail data, and we do not transfer it to third parties, except to the service providers strictly necessary to operate the Service (listed in section 5), to comply with applicable law, or as part of a merger or acquisition, subject to your prior consent.
• We do not use Gmail data for advertising purposes of any kind.
• We do not use Gmail data to develop, improve, or train generalized artificial intelligence or machine learning models.
• No one at ALK Innovations reads the content of your messages, except at your explicit request to handle a support request, where necessary for security purposes such as investigating abuse, or to comply with a legal obligation.
• Disconnecting a mailbox from Trupeo deletes the messages and attachments stored for that mailbox, under the conditions described in section 4.

7. Transfers outside the European Union

Transfers of personal data to our service providers based in the United States are carried out in accordance with the GDPR. We rely on safeguards recognized by European regulation and, where necessary, on contractual clauses adopted by the European Commission.

8. Your rights

In accordance with the GDPR, you have the following rights: access, rectification, erasure, portability, restriction of processing, objection, withdrawal of consent, and definition of directives after death.

You can exercise these rights via the contact form at /contact/ (by selecting “GDPR Request”). We will respond to your request within a maximum of 30 days. You also have the right to lodge a complaint with the CNIL (https://www.cnil.fr).

9. Data security

We implement rigorous technical and organizational measures:

• Connections to Trupeo are protected.
• Protection for message bodies and attachments when stored.
• Separation and protection of each customer account space.
• Main hosting in France.
• Daily protected backups.
• Notification of data breaches within 72 hours to the CNIL and affected users in case of high risk.

10. Cookies and trackers

In line with CNIL recommendations, no non-essential cookie is dropped until you explicitly give your consent via the banner shown on your first visit.

Strictly necessary cookies (no consent required)

We use your browser’s own storage to remember your language preference and the choice you make in the consent banner. This information stays on your device and is never transmitted to third-party servers.

On pages that contain a public form (contact form, access request), we use Cloudflare Turnstile (Cloudflare, Inc.) to limit automated abuse, such as spam. This service checks that the form is being used normally, without setting an advertising tracking cookie or building a user profile. It may set a short-lived technical cookie only to prevent repeated abuse.

Audience measurement cookies (consent required)

If you accept the “Audience measurement” category, we use:

• Google Analytics 4 (Google LLC) to measure anonymized site traffic: pages viewed, traffic source, and device type. Data is deleted automatically after a maximum of 14 months.
• Microsoft Clarity (Microsoft Corporation) to understand how visitors use the site and improve its usability. Sensitive fields, such as emails, passwords, and card numbers, are automatically masked.

These tools are used only with your consent, through the consent banner.

Until you give your consent:

• No audience-measurement cookie is set on your device.
• Microsoft Clarity is not loaded.
• Google Analytics may receive very limited cookie-free information to produce global statistics. This information does not contain a persistent personal identifier. If you require a strict block on any request to Google before consent, contact us.

When you accept the “Audience measurement” category, GA4 and Clarity switch to full mode: cookies dropped, detailed events transmitted, as described above.

Marketing cookies (separate consent required)

If, and only if, you accept the “Marketing” category, we turn on Google Signals (Google LLC). What that changes in practice:

• If you are signed in to a Google account with ad personalisation enabled, your visits to trupeo.com are linked to that account. Audience measurement stops being anonymised for you.
• We get additional aggregated statistics: age bracket, gender, interests, and tracking of your journey across several devices.
• Data is sent to Google’s advertising infrastructure, on the doubleclick.net domain, and not only to the audience measurement domains.

What it does not change: Trupeo runs no advertising, exploits no advertising audience and sells no data. We use Google Signals for the statistical purpose described above and nothing else.

While you have not accepted this category, Google Signals stays inactive: the ad_storage, ad_user_data and ad_personalization signals are denied by default and advertising identifier redaction (ads_data_redaction) is on. You can change this at any time through the “Cookie preferences” link in the footer.

Managing and withdrawing your consent

You can modify or withdraw your consent at any time via the “Cookie preferences” link in the footer. Your choice is remembered for up to 13 months; beyond that, the banner will be shown again, in line with CNIL guidance.

11. Data relating to minors

Trupeo is a service for organizations. When Clients use the Service, including educational institutions, ALK Innovations processes data on behalf of the Client in accordance with Article 28 of the GDPR.

The Client warrants that it has the appropriate legal basis, including where applicable parental consent or a public-interest mission, for the personal data it imports or processes via the Service, including data concerning minors under fifteen (15) years of age. The Client undertakes to obtain and maintain, before any use of the Service, the authorization or consent required from the holders of parental authority for minors under 15, in accordance with Article 8 of the GDPR and current French legislation. Trupeo declines all responsibility for the validity of the legal basis chosen by the Client.

12. Future developments (Artificial Intelligence)

We plan to introduce artificial intelligence features, for example automatic email attribution. These features will always be optional and will be explained before use. We undertake not to train AI models on your data and not to share your content with AI providers without your explicit agreement.

13. Changes to this policy

We may update this policy. In the event of a substantial change, we will inform you 30 days in advance. Continued use of the Service after the changes take effect constitutes acceptance.

14. Contact and complaints

For any questions, use the form at /contact/ or write to us at: ALK Innovations, 31 avenue des Korrigans, 44300 Nantes, France.

This English version is provided for convenience. In case of any inconsistency, the French version prevails.