Last updated: 29 September 2026
Who is responsible
The data controller is Alexis Oulès (TopoLines), 100 route de Saint-Jean-de-Cornies, 34160 Saint-Drézéry, France — hello@topolines.app. Full details on the Legal notice.
What we collect
Without an account
- Map requests — the area you draw and the settings you pick, needed to trace the contours. Anonymous requests aren't linked to you.
- Audience measurement — Vercel Web Analytics and Speed Insights count page views and performance without cookies and without identifying you.
- Technical logs — our hosts keep standard server logs (IP address, request, date) for a short time for security and debugging. Errors are reported to Sentry with personal data stripped.
With an account
- Identity — the email, name and account ID given by Google or GitHub when you sign in. We never see your password.
- Usage — your credit balance, export history (area, settings, format) and saved presets.
- Acquisition — the referring site and campaign tags (utm_*) of your first visit, to know which channels bring users.
- Purchases — order IDs and the credits they added. Card and billing details are handled by Lemon Squeezy and never reach us.
Why, and on what legal basis
- Providing the service, your account and your credits — performance of the contract (GDPR art. 6.1.b).
- Security, fraud prevention, debugging, audience statistics and acquisition tracking — legitimate interest (art. 6.1.f).
- Keeping order records — legal obligation (art. 6.1.c).
We don't sell your data, don't use it for advertising and don't send marketing email without your consent.
Cookies and local storage
TopoLines sets no advertising or tracking cookies. The app keeps a few items in your browser's local storage — your sign-in token, your last map settings, the tour and "what's new" you've seen, and your first-visit source — which are strictly needed for the app to work and never leave your device except the sign-in token and source sent to our API. That's why there's no cookie banner.
Who processes it
- Vercel (USA) — website hosting and audience measurement.
- Render (servers in Frankfurt, Germany) — API hosting.
- Neon — database hosting.
- Google and GitHub — sign-in, only if you choose them.
- Lemon Squeezy (USA) — payments, as merchant of record under its own privacy policy.
- Sentry — error tracking, without personal data.
Some of these companies are based in the United States. Transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep it
- Account data — as long as your account exists. Deleting your account erases your email, name and sign-in ID immediately; export and order records are kept only in anonymised form.
- Accounting records of purchases — 10 years, as required by French law (held by Lemon Squeezy).
- Server logs — a few weeks at most, per our hosts' retention.
Your rights
You can access, correct, delete, export or restrict the processing of your data, and object to it. Two of these are self-service in the app: open the account menu and use Export my data or Delete my account. For anything else, email hello@topolines.app — we answer within one month.
If you think your rights aren't respected, you can complain to the CNIL, the French data protection authority (cnil.fr).
Changes
If this policy changes in a meaningful way, the date above is updated and signed-in users are told in the app.