Privacy policy
Last updated: 23 octobre 2026
This English version is provided for convenience. The French version is the legally binding one; in case of any difference, the French text prevails.
1. Controller
Thomas DELION (Frolay), 4 rue Henri, 60750 Choisy-au-Bac, France. Contact for your data: support@frolay.com.
For images uploaded by a business customer that contain third-party data, the Publisher acts as that customer’s processor (see the appendix to the terms of use).
2. Data processed, purposes and legal bases
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Create and manage your account, authenticate you | E-mail, name, password (hashed, never readable) or, if you use “Continue with Google”, your Google account identifier, session cookie, date of last login | Performance of the contract | Life of the account. An inactive free account is deleted after 3 years. |
| Search for your images on the Internet and alert you | Uploaded images, fingerprints, search results, alert preferences | Performance of the contract | Until the image or the account is deleted |
| Build your evidence files | URL, copy and screenshot of the pages found, server IP addresses, public domain registration data (registrar, abuse contact) | Performance of the contract; legitimate interest in defending copyright (Art. 6(1)(f)) | Until you delete it or the account is deleted |
| Generate your letters | Identity and signature details (name, company, address, company number, phone), rates | Performance of the contract | Life of the account |
| Payment and invoicing | Stripe customer and subscription identifiers, payment history (card numbers are handled only by Stripe) | Performance of the contract; legal obligation | 10 years for accounting records (Art. L123-22 of the French Commercial Code) |
| Send your letters and reminders, track your cases | Recipient’s e-mail address, content of letters, sending dates, case history | Performance of the contract; legitimate interest in defending copyright | Until the case or the account is deleted |
| Licence payments by the sites concerned | Your Stripe Connect account identifier; for the payer: name, e-mail and billing address provided by Stripe, amount | Performance of the contract; legal obligation (accounting) | 10 years for accounting records |
| Proof of prior existence | SHA-256 fingerprint of your images (never the image), timestamp token | Performance of the contract | Until the image or the account is deleted |
| Automatic import | Address of your portfolio; for Instagram: account identifier and name, access token (read-only access to your posts) | Performance of the contract | Until the source or the account is removed |
| Public “Protected photos” page and image verification (if you enable it) | Name or company, website, number of photos, sign-up date, fingerprint and timestamp date of the images, e-mail if you choose to show it | Your consent, which you can withdraw at any time in Settings → Protection | As long as the page is enabled |
| Subscription cancellation | Date of the request and effective date, confirmation e-mail | Legal obligation (Article L215-1-1 of the French Consumer Code) | 5 years (limitation period) |
| Handling reports of illegal content | Name and e-mail (optional) of the person reporting, address of the content, explanation, IP address, decision taken | Legal obligation (Regulation (EU) 2022/2065, Article 16) | 3 years after the decision |
| Introduction to a partner lawyer | Contact details, items of the chosen case | Your consent, given for each transfer | The law firm becomes controller of its own processing |
| Show the site and write to you in your language | Language chosen or your browser’s language | Performance of the contract | Life of the account (cookie: 1 year) |
| Security and abuse prevention | IP address, technical logs, login attempt counters | Legitimate interest (service security) | 12 months maximum |
| Answer your requests | E-mail and content of the exchanges | Legitimate interest or pre-contractual measures | 3 years after the last exchange |
No automated decision producing legal effects is made about you. The “priority” of results is a sorting aid that you can ignore. Your images are never published, sold, or used to train an artificial intelligence model.
3. Recipients and processors
Your data is only accessible to the Publisher and to the providers strictly necessary:
| Provider | Role | Location |
|---|---|---|
| OVH SAS | Hosting of the site and data | France (European Union) |
| Google Cloud (Google Cloud Vision) | Reverse image search | European Union and United States |
| SerpAPI, LLC (Google Lens) | Deep image search (Pro and Agency plans) | United States |
| Stripe Payments Europe, Ltd. | Payment, subscription and invoicing | Ireland (European Union), with possible transfers to the United States |
| Timestamping authority (timestamp.digicert.com) | Trusted timestamp of the image fingerprint (no image sent) | — |
| Google Ireland Limited (sign-in with Google) | Authentication, if you choose “Continue with Google”: we only receive your name, your e-mail and an identifier | Ireland (European Union), with possible transfers to the United States |
| Meta Platforms Ireland (Instagram) | Import of your posts, if you connect your account | Ireland (European Union) |
| OVH | Sending alert e-mails | — |
When data is transferred outside the European Union, the transfer is covered by an adequacy decision (in particular the EU–US Data Privacy Framework for certified companies) or by the European Commission’s standard contractual clauses. For a deep search, the image is made available to the engine through a secret, non-indexed address.
Data may be disclosed to authorities on a lawful request. It is never sold.
4. Third-party data in evidence files
When you build a file, the Service records public information about the site using your image (page content, server IP address, public domain data). This processing is based on the legitimate interest in establishing, exercising and defending legal claims. It is limited to the pages you report. When a site pays for a licence, its billing details are collected by Stripe and shared with the author, to issue the invoice. The person concerned can exercise their rights by writing to support@frolay.com.
5. Security
Encrypted connection (HTTPS), passwords hashed with scrypt, HttpOnly session cookie, limited login attempts, application isolated on the server with restricted rights.
6. Your rights
You have the right of access, rectification, erasure, restriction, objection (for processing based on legitimate interest) and data portability. You may also set instructions for what happens to your data after your death.
- Directly in the application: Settings → Account → My data → “Download my data” (full export in JSON format) or “Delete my account” (permanent erasure and cancellation of the subscription).
- By e-mail: support@frolay.com. We reply within one month at most.
If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr), or with the data protection authority of the EU country where you live. In the United Kingdom, you can contact the ICO (ico.org.uk).
7. Cookies
The site only uses strictly necessary cookies (session, chosen language, Google sign-in security) and your browser’s local storage for display preferences. Details are in the cookie policy.
8. Changes
This policy may change. Any significant change is notified to you by e-mail or in the application.