1.Data controller
Crazylink, SARL, 40 boulevard Limbert, 84000 Avignon, France, represented by Cédric Michel, managing director (gérant). Contact: contact@tocsin24.com. For the logs that a customer has collected from their sites, the customer is the data controller and Crazylink acts as processor.
2.Data collected (website and application)
- tocsin24.com website: no personal data is collected during a simple visit. The contact and partnership forms collect your name, email address, company, number of sites, platform, subject and message.
- Account: name, email address, phone number for alert SMS, password (stored as a hash), two-factor authentication secret (encrypted), notification preferences, objection to marketing contact.
- Free quick audit: the address of the audited site and its report. The report waits for you to create your account for two hours at most, then it is deleted; once linked to your account (first name, last name, email address), it joins your quick audit history, with the date and rating of each audit.
- Sign-in with Google, if you choose it: your Google account identifier, the name and email address provided by Google, and the email address at the time of linking. No Google password or access token is kept.
- Usage: IP addresses and login dates, audit log of actions.
- Billing: billing details and payment history; card data is processed by Stripe.
- Wall screens (TV app, browser): the name given to the screen, the last IP address seen and the latest refused addresses if the customer restricts access by address. The TV app reads no account, contact, location or advertising ID, and contains no advertising or analytics.
- Monitored sites: fingerprints and versions of files, extensions and patches, the site’s admin accounts (username, role, last login, never passwords), aggregated sales and sign-up figures, with no buyer names, email addresses, postal addresses or orders.
- Alert contacts: email address and name of the people a customer registers to receive a site’s alerts without an account. No alert is sent until they confirm through the link they receive; every email contains an unsubscribe link.
- Logs, if the customer turns on their collection: access and error log lines, which contain IP addresses and the pages visited.
- Built-in log, if the customer turns it on: when the server logs cannot be accessed, the Tocsin24 module records on the customer’s site the visits handled by the application (IP address, page without its sensitive parameters, status, browser), until Tocsin24 reads them.
3.Purposes
Providing the service and its alerts, managing accounts and billing, responding to requests, ensuring the security of the platform, measuring website traffic anonymously.
IP address reputation: IP addresses involved in a security incident are compared, on Tocsin24’s servers, with public reputation lists (IPsum, Spamhaus DROP) downloaded once a day. No address is sent to these services. The result adds to the incident (“address reported by 6 lists”) without opening a new one; it is based on the legitimate interest of securing the monitored site.
Follow-up of free audit accounts: Crazylink may contact the people who created an account to read a quick audit about Tocsin24. Data used: first name, last name, email address, audited sites and the latest rating of each, date of last contact. You can object at any time, without giving a reason, from My account or through the unsubscribe link in every email; your objection is kept so that it is respected.
4.Legal bases
Performance of the contract (account, service, alerts, billing); legal obligation (retention of invoices); legitimate interest (platform security, responding to requests, cookie-free audience measurement, follow-up of free audit accounts, with the right to object); for collected logs, the instructions of the customer, who is the data controller; for alert contacts, their consent, which can be withdrawn at any time through the unsubscribe link.
5.Retention periods
- Contact requests not followed up: 3 years after the last exchange.
- Account and site data: for the duration of the contract, then deleted within 30 days. An email warns you 7 days before any deletion.
- Account with no monitored site (for example an account created for the quick audit): deactivated after 45 days without a login. The password, sessions, Google link and audit details are then erased; what remains is the first name, last name, email address, creation date, audited sites with their latest rating, objection to marketing contact and date of last contact. A new audit with the same address or “Forgot password” reactivates the account. This data is anonymised 3 years after the last contact.
- Report of a quick audit awaiting account creation: 2 hours at most.
- Invoices: 10 years (accounting obligation), kept by Stripe, our payment provider.
- Raw log lines: 7 days. Hourly statistics: 13 months, with no IP address beyond 7 days.
- Built-in log, on the customer’s site: 2 days at most; erased by the module if Tocsin24 stops reading it for 48 hours.
- Probe, disk space and collection records: 90 days.
- Alert contacts: as long as the site is monitored. After an unsubscription, the address and date are kept so that no new registration is made without your consent; write to us to have them erased.
- Audit log: 1 year.
- Wall screens: as long as the screen is paired; at most the 10 latest refused addresses. Removing the screen (My account › Screens) erases this data.
- Free trial, abuse prevention: to grant only one trial per domain, we keep a SHA-256 hash of the domain name of each site that has had one, without the name itself. It is kept with no time limit, including after the account is closed.
6.Recipients and processors
The data is never sold. It is accessible to Crazylink and its processors, solely for the purposes of the service:
- Infomaniak Network SA (Switzerland): hosting of the application and data;
- Cloudflare, Inc. (United States): routing of website and application traffic and protection against attacks; traffic is decrypted on its network to be filtered, then re-encrypted to our servers in Switzerland. Application data is not stored there, only technical request logs;
- OVH (France): sending SMS, the contact@tocsin24.com mailbox and encrypted backups;
- Stripe (Ireland, United States): payment;
- Google Ireland Limited (Ireland): authentication, only if you choose “Continue with Google”; Google sends us your account identifier, your name and your email address, and receives your request to sign in to Tocsin24;
- Brevo (France): sending alert and account emails;
- Anthropic (United States): AI analysis of incidents, only if the add-on is enabled;
- browser notification services (Google, Mozilla, Apple): delivery of push notifications;
- Plausible Analytics (European Union): cookie-free audience measurement.
Transfers outside the European Union and Switzerland are covered by standard contractual clauses or an adequacy decision.
7.Hosting
The application and its data are hosted in Switzerland by Infomaniak, a country recognised by the European Commission as providing an adequate level of protection. Encrypted backups are stored in France. Website and application traffic passes through Cloudflare’s network, which protects it against attacks without storing application data.
8.Your rights
You have the right of access, rectification, erasure, restriction, objection and portability, which you can exercise by writing to contact@tocsin24.com. You will receive a reply within one month. For data contained in the logs of a monitored site, please contact the operator of that site first.
9.Contact and complaints (CNIL)
For any question: contact@tocsin24.com. You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).