Privacy Policy
Last updated: 03/10/2026
1 Data Controller
The data controller for personal data collected on TomeHero is:
499 887 453
131 Boulevard Pereire, 75017 Paris, France
2 Data Collected
We collect different categories of data depending on your use of TomeHero:
Identification Data
- Email: to create your account and contact you
- Username: publicly displayed on your contributions
- Password: stored in encrypted form (hashed)
- Profile picture: optional, if you upload one
Usage Data
- Reviews and ratings: your critiques and ratings of works
- Lists and favorites: works you follow
- Private messages: if you use the messaging feature
- Browsing history: pages visited on TomeHero
Technical Data
- IP address: for security and statistics
- Connection data: browser type, device, OS
- Cookies: see the dedicated section below
3 Purposes and Legal Bases
Your data is processed for the following purposes:
| Purpose | Legal Basis |
|---|---|
| User account management | Contract execution |
| Service provision (reviews, lists, messaging) | Contract execution |
| Sending notifications and transactional emails | Legitimate interest |
| Sending newsletters (if subscribed) | Consent |
| Audience measurement and site improvement | Consent |
| Display of personalized advertising | Consent |
4 Cookies and Trackers
TomeHero uses cookies to function properly and improve your experience.
Essential Cookies (required)
These cookies are necessary for the site to function: user session, language preferences, security CSRF token. They cannot be disabled.
Analytics Cookies
Google Analytics 4
We use Google Analytics 4 to understand how visitors use TomeHero. This data helps us improve the site. Data is anonymized and does not allow personal identification.
Internal attribution cookie (th_attribution)
When you reach TomeHero from an external link (email campaign, social network, search engine…), we store the source of your visit (UTM parameters or referring domain) in the th_attribution cookie. This cookie lasts 30 days and is only consumed if you decide to register, so we can understand how you discovered us. No data is shared with third parties. If you don't create an account, the cookie expires on its own after 30 days with no server-side trace.
Advertising Cookies
Google AdSense
Google AdSense displays advertisements on TomeHero. These cookies allow relevant ads to be displayed based on your interests.
Google Ads & Meta (Facebook/Instagram)
We use tracking pixels from Google Ads and Meta (Facebook/Instagram) for our marketing campaigns. These cookies allow us to show you TomeHero ads on other sites if you have visited our platform.
5 Data Recipients
Your data may be shared with the following recipients:
- OVH SAS (hosting provider): secure data storage in France
- Google LLC: Analytics, AdSense, Google OAuth login
- Meta Platforms Inc.: tracking pixel for remarketing
- Brevo (Sendinblue): sending transactional emails and newsletters
- Competent authorities: only upon legal request
6 Transfers Outside the European Union
Some of our service providers (Google, Meta) are located in the United States. These transfers are governed by appropriate safeguards in accordance with GDPR.
Google and Meta are certified under the EU-US Data Privacy Framework (DPF), which guarantees an adequate level of protection for your data.
Your main data (account, reviews, messages) is hosted exclusively in France at OVH.
7 Data Retention Period
We retain your data for the following periods:
| Data Type | Retention Period |
|---|---|
| Account data (email, username) | Duration of registration + 30 days after deletion |
| Contributions (reviews, ratings, lists) | Anonymized after account deletion |
| Private messages | Deleted with the account |
| Connection logs (IP, browser) | 12 months (legal requirement) |
| Analytics/advertising cookies | 13 months maximum |
8 Your Rights
Under GDPR, you have the following rights regarding your personal data:
Right of Access
You can request a copy of all data we hold about you.
Right to Rectification
You can correct your data directly in your profile or contact us.
Right to Erasure
You can delete your account. Your contributions will be anonymized (attributed to "Deleted User").
Right to Portability
You can request export of your data in a structured format.
Right to Object
You can object to the processing of your data for marketing purposes.
Right to Restriction
You can request restriction of processing of your data in certain cases.
You can also lodge a complaint with the CNIL (French Data Protection Authority): www.cnil.fr
9 Data Security
We implement appropriate technical and organizational measures to protect your data:
- HTTPS encryption of all communications
- Passwords hashed with secure algorithm (bcrypt)
- Servers hosted in France with restricted access
- Regular backups and disaster recovery plan
10 Policy Changes
We may modify this privacy policy at any time. In case of substantial changes, we will notify you by email or notification on the site.
The last update date is indicated at the top of this page. We encourage you to regularly review this policy.