Aval · Legal
Privacy policy
This policy describes the data processed by Aval, the service that lets an AI agent ask you a question and wait for your answer. The data controller is Antoine Labbe, reachable at aval@taraxe.com. Aval shows no ads and uses no audience analytics. For the rest of taraxe.com, see the site's privacy policy.
Data processed
| Data | Purpose | Retention |
|---|---|---|
| Question, context, options, agent name, your answer, the channel you answered through, your optional comment and the dates | Asking you your agent's question and sending your answer back | As long as the account exists |
| Identifiers of connected channels (phone number, Telegram chat id…) | Reaching you through the channels you chose | Until you disconnect them, or the account is deleted |
| Email address, language, account creation date and connected apps (Claude, ChatGPT…) | Signing you in, connecting your agent, emailing you | As long as the account exists |
| Credit purchases (pack, amount, date) and remaining credits | Counting your questions, accounting | As long as the account exists, then 10 years for accounting records |
| aval_session cookie | Keeping you signed in to your account page | 1 year, extended at each visit |
| IP address, requested address, browser, country, time of the request | Technical logs to spot outages and abuse | 7 days at most |
Legal basis: performing the service you ask for (GDPR article 6.1.b) for the account, the questions and credit purchases, the publisher's accounting obligations (article 6.1.c), and its legitimate interest in the security of the service (article 6.1.f).
Your account
You sign in with your email address: from the site, you get a single-use sign-in link, valid for 30 minutes; from your AI app, a 6-digit code. The account is created at first sign-in. At sign-in, Cloudflare Turnstile analyses technical browser signals to check that you are a person (legitimate interest, article 6.1.f), for the time of the check. Cachet, the other agent service on taraxe.com, has its own account, separate from this one. Apps receive an access token, valid for 30 days and renewed until you disconnect them; the site only keeps a hash of it, as for an API key. When you open your account page, your browser keeps a cookie, aval_session, valid for one year and extended at each visit: it keeps you signed in, and is used for nothing else. A copy of this session is also kept in the browser's local storage (key aval-session), to sign you in with one click when you connect an app. The “Sign out” button deletes both.
Questions
When your agent asks you a question with Aval, the site keeps the question, its context, the options, the name the agent gives itself, your answer, the channel you answered through, your optional comment and the dates. Questions stay visible on your account page as long as the account exists.
Notification channels
Aval sends you each question by email (sent by Resend) and, if you connected them, through Telegram, WhatsApp (Meta) or iMessage (Sendblue). Each of these services receives the text of the question to show it to you. A channel is connected with a code you send yourself from your phone, and disconnected from your account page.
Recipients and transfers
Data is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, United States, phone +1 650 319 8930, and may be stored outside the European Union; this transfer relies on Cloudflare's certification under the EU-US Data Privacy Framework. Email and the channels you connect yourself pass the question outside the European Union: email through Resend, Inc. (United States), Telegram (Telegram FZ-LLC, United Arab Emirates), WhatsApp (Meta Platforms, Inc., United States) and iMessage through Sendblue, Inc. (United States). These transfers are necessary for the service you ask for (GDPR article 49.1.b). Credit purchases go through Stripe (Stripe Payments Europe, Ltd., Ireland), under its privacy policy: card details stay with Stripe. No data is sold or passed on to other third parties.
Your rights
You can ask to access, correct or delete your data, or to delete your account, by writing to aval@taraxe.com. Answer within 30 days. You can also file a complaint with the CNIL, the French data protection authority (cnil.fr).