Privacy policy
Todis processes two clearly distinct categories of data: our own customers' (the businesses using the API), and the end users' whose identity is verified on those customers' behalf. This page covers both.
Data controller
Kohex (see legal notice) is the controller for the data described here. For any question or to exercise your rights: contact@todis.eu.
Our customers' data (the businesses using Todis)
At signup, we collect the email address (to deliver the license token), the contact's first and last name, and, if you provide them, your company name and intra-EU VAT number. Payment itself is processed directly by Stripe: we never see or store your bank details. We then retain, for the duration of the contractual relationship, your Stripe customer ID and consumed request volume, needed for billing and support.
End users' data (hosted mode)
When one of our customers uses the hosted offering, the proof presented by an end user's digital identity wallet transits through our servers strictly for the duration of verification: it is never stored on disk, never logged, never reused for any other purpose, and is cleared from memory once the response has been returned to our customer (a few seconds to a few minutes depending on the request type). We only pass our customer the information they explicitly requested, thanks to the selective disclosure built into the wallet format. With self-hosting (Premium plan), none of this data ever transits through our servers.
Purposes and legal bases
Providing the subscribed service and related billing (performance of a contract, GDPR Article 6.1.b); security and abuse prevention, notably per-customer rate limiting (legitimate interest, Article 6.1.f); compliance with our accounting and tax obligations (legal obligation, Article 6.1.c).
Processors and recipients
Stripe (payment and billing): a US company, transfers governed by the European Commission's standard contractual clauses. Scaleway (infrastructure hosting and transactional email delivery): a French company, data hosted in France. Website traffic statistics (GoatCounter) are self-hosted on our own infrastructure, without cookies and without sharing with any third party: no third-party analytics tool (Google Analytics or equivalent) is used.
Retention period
Billing data is kept for the period required by our accounting obligations (10 years). Customer account data is kept for the duration of the contractual relationship, then deleted or archived as required by law. As stated above, identity proofs verified in hosted mode are never retained beyond the verification itself.
Your rights
Under the GDPR, you have the right to access, rectify, erase, restrict, object to, and port your personal data. To exercise these rights, write to contact@todis.eu. You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or your own national supervisory authority.