Personal data
Privacy Policy
Effective 23 September 2026 · Version française. The French version prevails in case of discrepancy.
1. Data controller
The data controller is Thomas Royer, entrepreneur individuel (EI), registered in France under SIREN 106 081 300, which operates the Etolys service.
For any question about your data: business@etolys.fr.
2. Scope
This policy applies to:
- the website https://etolys.fr;
- the “Local Review Kit” service (audit, NFC and QR code displays, installation and follow-up);
- the monitoring dashboard, a web application that lets a business view its Google Business Profile data after connecting its Google account.
Our services are intended for businesses. They are not directed at minors.
3. Data we process
3.1 Website visits
The website sets no cookies, uses no analytics tool and loads no external resources (fonts, scripts, videos). Our server records technical logs (IP address, date and time, requested page, browser) needed for security and proper operation.
Legal basis: our legitimate interest in securing the website.
3.2 Business contacts and customers
When you contact us, when we contact you in a professional capacity or when you become a customer, we process: business name, contact person’s name and role, business contact details (phone, email, address), history of exchanges, quotes, invoices and information needed for installation.
Legal bases: our legitimate interest in contacting businesses about an offer related to their activity, performance of a contract or pre-contractual steps, and our accounting obligations. You can object to marketing contact at any time: your request is added to an opt-out list so that you are not contacted again.
3.3 Dashboard and Google user data
If you connect your Google account to the dashboard, you allow us, through Google’s consent screen, to receive the following data:
| Google permission | Data received | Purpose |
|---|---|---|
openid, email, profile |
Google account ID, name, email address and profile picture. | Identify you, secure your session and contact you about the service. |
https://www.googleapis.com/auth/business.manage |
Accessible Business Profile accounts; locations (name, address, phone, website, categories, opening hours, service area); reviews (text, rating, date, any reply, reviewer’s public display name and photo); performance metrics (views, calls, direction requests, clicks, bookings, messages, menu views); search terms that showed the profile. | Display your dashboard and, if you ask us to, prepare your follow-up report. |
Google also issues access and refresh tokens used to call the APIs on your behalf. They are stored securely and never shared with third parties.
The business.manage permission is the only one Google offers for the Business Profile APIs; technically, it would allow a profile to be edited. Etolys uses it for reading only and does not change your profile.
Reviews include the public display name and photo of their authors. We only use them to show the review in the dashboard of the business concerned: we build no profile of these people, do not contact them and do not link them to any other data.
Legal basis: performance of the service you request by connecting your account. You can withdraw your authorisation at any time (see section 8).
3.4 NFC and QR code scans
When a display points to a redirect link provided by Etolys, we record for each scan the display ID, date and time, and minimal technical information (device or browser type). We do not try to identify the person scanning and never link a scan to a review or its author.
Legal basis: the legitimate interest of the client business and our own in measuring how the displays are used.
4. Use of Google user data
Data received from Google APIs is used exclusively to provide the visible features of the dashboard to the business that authorised it. In particular, Etolys:
- does not sell or rent this data;
- does not use it for advertising, retargeting or resale to data brokers;
- does not transfer it to any third party, except technical providers strictly necessary to run the service (section 5), to comply with the law, or as part of a merger or acquisition with prior notice to users;
- does not use it to develop, improve or train generalised artificial intelligence or machine learning models;
- does not use it to determine the creditworthiness of any person or business;
- does not change your profile. If a write action is ever offered (for example posting a reply to a review), it will only be performed after your explicit prior approval, and you will be notified of every change within 48 hours.
Our staff do not read your Google data unless you explicitly ask us to (for example to prepare your report or handle a support request), it is necessary for security purposes (investigating abuse) or to comply with applicable law.
Etolys’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Google’s own processing of data is governed by the Google Privacy Policy.
5. Recipients
Your data is accessible only to the people at Thomas Royer who need it to provide the service. We rely on the following categories of providers, bound by confidentiality and security commitments:
- our hosting provider, Scaleway SAS, for the website and the dashboard;
- our business email provider, for our email exchanges;
- where applicable, our accountant, for billing data only.
We do not sell any personal data.
6. Security and location
The website and the dashboard are only served over HTTPS. Google access tokens are encrypted when stored, server access is restricted and each business’s data is isolated.
Hosting country of our servers: the Netherlands (Amsterdam, European Union). Business Profile data comes from Google, which processes it under its own rules, including outside the European Union.
7. Retention periods
| Data | Period |
|---|---|
| Content received from the Google Business Profile APIs (locations, reviews, metrics, searches) | No more than 30 days, only to display the dashboard, then deleted or refreshed |
| Google access tokens and identity of the connected account | Until you disconnect from the service or withdraw authorisation, then deleted within 7 business days |
| Display scans | 13 months |
| Server technical logs | 6 months maximum |
| Marketing contact data | 3 years from your last contact with us |
| Customer data | Duration of the business relationship, then 3 years; accounting records: 10 years |
8. Revoking access and deleting your data
You can end Etolys’s access to your Google account at any time:
- from your Google Account permissions page, by removing the access granted to Etolys;
- or by emailing business@etolys.fr with the subject “Delete my data”.
In both cases we revoke the tokens, stop calling Google APIs for your account and delete your Google data within 7 business days. On written request, we also delete the other data we hold about you, except data we are legally required to keep, and confirm the deletion by email.
Removing Etolys’s access does not change or delete anything on your Google profile, over which you keep exclusive control.
9. Your rights
Under the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the right to access, rectify, erase, restrict, port and object to the processing of your data, to withdraw your consent at any time and to set instructions regarding your data after your death.
To exercise these rights, email business@etolys.fr. We reply within one month. If we have reasonable doubts about your identity, we may ask for proof.
You may also lodge a complaint with the French data protection authority, the CNIL.
11. Changes
We update this policy when our practices change and show the effective date at the top of the page. Before any new use of Google user data, we notify dashboard users and ask for their consent.
12. Contact
Thomas Royer, France
business@etolys.fr