Privacy policy
Last updated: 22 Jun 2026
Applies to: https://keyzig.com and related services (the "Service").
Data Controller: Shape FS SAS, 140 avenue de Suffren, 75015 Paris, France ("Keyzig", "we").
Contact for privacy matters: [email protected]
1) What Keyzig is
Keyzig provides a privacy-first QR tag and messaging bridge that lets people contact an item's owner without revealing the owner's identity. Messages are collected through a scan page and forwarded to you by email, SMS, or WhatsApp.
2) The personal data we collect
We collect only what is necessary to operate the Service:
Identification & contact (provided by you)
- Email address (for activation and message forwarding)
- Phone number (optional; for SMS/WhatsApp forwarding)
Communication data (provided by the sender/finder)
- Message content submitted via the scan page (free-text messages)
Technical & security data (collected automatically)
- IP address, device/browser information, timestamps, event logs
- reCAPTCHA tokens and associated signals (to prevent abuse)
Payments (handled by Stripe)
- Transaction metadata (amount, currency, status, non-card identifiers)
- We do not store card numbers or sensitive payment instrument data.
Service metadata
- Tag/keyzig activation status and timestamps, last scan information
We do not sell personal data and we do not build advertising profiles.
3) Purposes & lawful bases (GDPR Art. 6)
| Purpose | Example | Lawful basis |
|---|---|---|
| Provide keyzig/tag service | Activate tag and deliver messages from finders | Contract (Art. 6(1)(b)) |
| Security & abuse prevention | reCAPTCHA, IP logs to detect fraud | Legitimate interests (Art. 6(1)(f)) |
| Compliance with legal obligations | Retain invoice records as required by French law | Legal obligation (Art. 6(1)(c)) |
| Payment processing | Charge for credits or subscription | Contract (Art. 6(1)(b)) |
| Support & communications | Answer user questions, send emails | Legitimate interests (Art. 6(1)(f)) |
4) Processors & third parties we use
We carefully select processors and sign data-processing agreements with them.
- Hosting & email: OVH for site hosting and outbound email.
- Database: a self-hosted PostgreSQL database (Supabase open-source stack) running on our own OVH infrastructure. We do not share your data with Supabase Inc.
- Messaging: Twilio to deliver SMS and WhatsApp notifications to you.
- Payments: Stripe to process payments and manage billing events.
- Security: Google reCAPTCHA to protect forms from bots/abuse.
Some of these providers may process data outside the EEA. Where they do, transfers are protected by European Commission Standard Contractual Clauses (SCCs) and supplemental measures as required.
5) Google reCAPTCHA
We use Google reCAPTCHA (v3) to detect abusive traffic on forms. This may collect device and interaction data (e.g., IP address, cookies, mouse movements) as described in Google’s policies. Use of reCAPTCHA is subject to Google’s Privacy Policy and Terms of Service.
- Privacy: https://policies.google.com/privacy
- Terms: https://policies.google.com/terms
6) Data retention
We keep data only for as long as needed for the stated purposes:
- Tag activation & owner contact details: for as long as your keyzig/tag is active (and for a short grace period if you deactivate, to handle pending messages).
- Message content: retained while the keyzig is active; you can delete messages or deactivate the keyzig to end future retention.
- Technical logs: 1 month (security and troubleshooting).
- Payment records: processed by Stripe; we retain essential invoice metadata as required by French law (up to 10 years for accounting files). No card data is stored by Keyzig.
- Cookies: see Cookie section below.
When data is no longer needed, we delete or irreversibly anonymize it.
7) Cookies & similar technologies
We use only what is necessary to run a secure service. We do not use any analytics or advertising cookies, so no cookie consent banner is required at this time.
Strictly necessary / functional
- Session (maintain sign-in, CSRF protection)
- Security (reCAPTCHA; bot detection cookies)
Analytics / marketing
None active by default.
If you enable analytics later (e.g., Plausible or Google Analytics), those cookies will be opt-in via a consent banner.
Cookie lifetimes
- Session: Up to 30 days
- reCAPTCHA: per Google’s policy
We’ll update this section and your banner text if you enable analytics or change lifetimes.
8) International data transfers
Where processors transfer personal data outside the EEA/UK (e.g., to the US), we rely on a valid transfer mechanism such as SCCs and implement appropriate safeguards (encryption in transit/at rest, access controls, data minimization).
9) Security
We apply technical and organizational measures including: TLS encryption in transit, encrypted databases at rest (where supported by providers), least-privilege access, audit logs, rate-limiting, and automated abuse detection (reCAPTCHA). No method is 100% secure, but we continually improve protections.
10) Your rights (GDPR Articles 15 to 22)
You have the following rights, subject to conditions and applicable law:
- Access to your personal data
- Rectification of inaccurate data
- Erasure ("right to be forgotten")
- Restriction of processing
- Portability of data you provided to us
- Objection to processing based on legitimate interests
- Withdrawal of consent (where processing relies on consent)
To exercise your rights, email [email protected] from the address linked to your keyzig/tag. We may request information to confirm your identity. We will respond within one month (extendable in complex cases).
You may also lodge a complaint with CNIL (https://www.cnil.fr).
11) Children
Keyzig is not directed to children under 13 (or the age defined by local law). If you believe a child has provided personal data, contact us to remove it.
12) Payments
Payments are processed by Stripe. Keyzig does not store card numbers or CVCs. Stripe acts as a processor/payment service provider and may process personal data in accordance with its own privacy notices and regulatory obligations.
13) Twilio, WhatsApp & email delivery
When you opt to receive messages via SMS or WhatsApp, Keyzig sends the message content and your destination number to Twilio to deliver the notification. For email forwarding, we use our hosting provider’s outbound email infrastructure. We minimize payloads to what’s necessary for delivery.
14) Supabase (database & storage)
Our application database runs on a self-hosted instance of the Supabase open-source stack (PostgreSQL), deployed on our own OVH infrastructure within the EU. Data is not shared with Supabase Inc.; we apply least-privilege access to service credentials.
15) Legal bases for “legitimate interests”
For security (reCAPTCHA, logs), service operation, and improvement, we rely on legitimate interests balanced against your rights and expectations. You can object at any time (see “Your rights”).
16) Changes to this policy
We may update this policy to reflect service or regulatory changes. We’ll post the updated date at the top and, when material, provide a prominent notice.
17) Contact
Data Controller: Shape FS SAS
Address: 140 avenue de Suffren, 75015 Paris, France
Email: [email protected]