Updated 13 October 2026
Privacy policy
Data controller
Eclozion, SASU, SIREN 108 015 793, 47 rue Vivienne, 75002 Paris, France, is the data controller for TadaaGift. Contact: contact@eclozion.fr.
Data used
We process guest/account identifiers, session and installation identifiers, optional email or Apple/Google identity, calendar titles and From/For names, published photos/GIFs/messages or external media references, invitations, opening history, voluntary hearts and settings. Connection/security data may include IP addresses. When purchases are available, store transaction identifiers, product, amount/currency and calendar rights are processed; card details stay with Apple or Google.
Purposes and legal bases
Creation, private sharing, opening, account recovery and widgets serve to perform the service you request. Access protection and incident diagnosis serve our legitimate interest in keeping the service secure. Legal obligations form a separate basis when applicable. Phone permissions authorize technical access and do not replace advertising consent.
Photos and private access
Unpublished photographs stay on your device until you explicitly choose publication. Uploads can start before final publication completes. Published content is stored to deliver the gift. Recipients and widgets do not receive future or unrevealed media. Copies you export to a photo library, and content sent through your chosen sharing services, remain outside TadaaGift's deletion control.
Product measurement
PostHog receives limited usage events from the app and server, such as screens, creation, publication and technical outcomes, with a persistent pseudonymous identifier. After verified optional sign-in, it may be linked to the account UUID. These data are pseudonymous, not anonymous. Photos, messages and email addresses are excluded from these events; precise GeoIP enrichment and session replay are disabled. Product improvement is pursued under our legitimate interest; you can contact us to object. This statement does not claim an exemption from consent rules for device trackers.
External services and advertising
Cloudflare processes hosting and security data; Better Auth is authentication software operated on our infrastructure, and Resend receives sign-in email data. AppsFlyer advertising attribution starts only after the separate measurement choice and, on iOS, Tracking permission. It can process attribution/campaign, device/network and permitted advertising-identifier data. OneSignal remote notifications depend on your notification choice and use a technical push identity, without calendar photos/messages/names in the payload. KLIPY receives GIF searches and connection data such as IP addresses when you search or display its content. Opening an external video connects to YouTube/Google and its own processing. AdMob advertising, when enabled, requires the applicable consent process; public TadaaGift advertising is currently disabled. At launch, if advertising campaign partners are enabled, the attribution data described above may be shared with those partners subject to the required consent and, on iOS, Tracking authorization. No such partner is enabled at present.
Retention and deletion
Local drafts remain until you delete them. Published calendars and access rights remain while needed to provide the service, until deletion. Deletion immediately revokes access. Removed uploaded media remains inaccessible in private storage for eight days before scheduled cleanup; the current D1 recovery window is seven days. Technical, fraud-prevention, transaction replay-protection and legally required records can be retained where needed for those purposes; no fixed deletion deadline is promised for them. Provider measurement/log retention depends on the relevant service settings and purpose; contact us for details.
Your rights
You may request access, rectification, erasure, portability and restriction and, depending on the processing, object or withdraw consent. Write to contact@eclozion.fr, mentioning TadaaGift. We respond within the statutory time limits, normally one month, and may request proportionate verification of your identity. You may lodge a complaint with the CNIL: cnil.fr.
Children
Do not publish a minor's personal data or image without the necessary rights and permissions. The service is not designed to profile children for advertising. Contact us about a child's data or a deletion request.
Providers and international processing
Some providers operate globally and may process data outside the European Economic Area, including in the United States. The service is not restricted to EU-only hosting. Applicable provider contracts and transfer mechanisms depend on the service used; contact us for information about the safeguards relevant to your data. The provider privacy notices linked below describe their processing.