Privacy
Privacy Policy
Last updated: 7 October 2026.
This policy explains what personal data we process, why, with whom, for how long, and how to exercise your rights. It covers the tipper.fr website, the Tipper app, the order tracking page (app.tipper.fr), the Tipper Comptoir merchant space (comptoir.tipper.fr) and our exchanges with you, in accordance with the GDPR and the French Data Protection Act (loi Informatique et Libertés).
The essentials
- Who: CGA FR, which operates the Tipper brand, in Paris. One address for your data: contact@tipper.fr.
- Why: to put in touch neighbours who bring back groceries on their way, merchants and their customers, and to make sure every handover goes well.
- Your location: it is read only while the app is open, never in the background. It is kept only if a discrepancy needs to be checked.
- Your face: we check that your profile photo does show a face. We never compare it with your identity document and create no biometric data.
- Where: your data is hosted in the European Union (Paris, with a backup copy in Ireland). The few service providers located in the United States are covered by safeguards.
- Never sold: we do not sell your data. There is no advertising tool and no third-party audience measurement in the app.
- A human decides: some checks are automatic. No sign-up is refused and no account is deactivated without a member of the team, except for deleting an account left without sign-in for 3 years, announced by email 30 days beforehand. You can ask for a person to review a decision.
- Your choices: you delete your account from the app, with 30 days to change your mind. You get a copy of your data on request. We reply within one month.
1. Who is responsible for your data
Cédric Galichon EI, sole trader (entrepreneur individuel) trading as CGA FR, operating the "Tipper" brand, 4 square Gabriel Fauré, 75017 Paris, France (SIREN 933 469 017). Contact: contact@tipper.fr.
Tipper is a platform that puts people in touch: private individuals, the Tippers, bring back a neighbour's groceries on a trip they are already making, sharing the costs.
2. If you are a Tipper
| What we process | Detail |
|---|---|
| Account and sign-in | Email address: you sign in only through a link sent by email. Phone number, optional. Date of last sign-in, number of sign-ins, days of activity. |
| Identity and documents | First and last name. Identity card, passport or residence permit. Depending on how you travel: driving licence, vehicle registration (carte grise), insurance certificate and vehicle information. Information read automatically from these documents (name, date of birth, number, expiry date). |
| Profile photo | A selfie you take in the app. It is required to sign up: the merchant of an order attached to your trip sees your photo, with your first name and the initial of your last name (see "What others see about you"). |
| Home, trips, preferences | The location of your home, which you place on the map yourself, and your radius. The trips you declare (start, destination, days, times, accepted detour). Your capacity (weight, volume). |
| Location | See below. |
| Completed trips | Slots booked, orders attached, steps completed and times. Photos taken at pickup, at handover or when the handover is not possible. Label scans. Answers to the end-of-trip questionnaire. Reports about how the trip went (see section 11). |
| Expense contribution | Amounts pending, available and paid out, and tips received. Your payout account is opened with Stripe, which itself collects the information needed for its own checks (bank details, date of birth, address) and processes it under its own responsibility. To open this account, we send Stripe your first and last name, email and, if provided, your phone number. |
| Notifications | If you allow them: your device's notification identifier. |
| Use of the app | The screens viewed, with the date. |
| Support and follow-up | Your help requests, our exchanges and attached photos. Internal notes and labels added to your file by the team. |
As soon as an identity document is approved, its number is replaced by an irreversible cryptographic fingerprint. It is used only to prevent the same identity from opening several accounts. The other information read from the document is then erased. The images of supporting documents are deleted 6 months after your account is activated. The information from the driving licence and the vehicle registration is kept, because it describes your vehicle.
Your location
The app reads your location only if you allow it, and only while it is open on screen. It is used to:
- show you nearby trips;
- help you place your home;
- confirm your arrival during a booked trip.
When you arrive at the pickup point, your location is compared with the shop's address. It is kept only in three cases, where it is attached to a report for the team, for 12 months:
- you indicate that you cannot confirm your location;
- the gap exceeds 500 metres;
- you arrive after the planned time.
Without permission, the app asks you for a photo instead.
Face ID
Unlocking happens entirely on your phone. We receive only the result (unlocked or not), never your face or any biometric data.
What others see about you
| Who | What they see | When |
|---|---|---|
| The merchant | Your first name, the initial of your last name and your profile photo (if it has been approved). Never your full name, your phone number or your email. | For one of their orders, attached to your trip |
| The recipient | The steps of the order, without your name, your photo or your location | During the order |
| The Tipper team | Your file, with access rights limited to what each person needs | As long as the account exists |
Unless marked optional, this information is needed to open and use a Tipper account: without it, we cannot activate your account.
3. If you receive groceries brought by a Tipper
The merchant you ordered from sends us what is needed for your groceries to reach you:
- your name and address;
- where relevant: floor, door code, name on the intercom, handover instructions;
- your phone number;
- your email, if the merchant chooses to.
What the Tipper sees, and when
- before booking, only the town and an approximate point (to within about 100 metres);
- once the order is attached to their trip, the address;
- at handover, the name, the instructions and the phone number;
- they receive this information only to carry out this order.
Tracking
If the merchant gave us your email, we write to you at each step. The tracking page shows the steps, without the Tipper's location. From this page, you can:
- give a rating and a comment;
- leave an optional tip, paid on a secure Stripe page (we never see your bank card);
- write to us.
Your ratings are never used for any decision about a Tipper.
The Tipper may photograph the handover or, if you are away, the place where the groceries were left. The merchant may give you a handover code to pass on to the Tipper.
Your tracking information (email, rating, comment, tip) is deleted 12 months after the order. For an order published in Tipper Comptoir, your name, address, phone number, email and instructions are erased from the order 12 months after it.
4. If you are a partner merchant
We process the business contact details of your staff (name, email, phone number), the address of your pickup points and your billing information. Invoices are issued and paid through Stripe.
With Tipper Comptoir, we also process:
- for each user: their email, display name, role and sign-in logs (sign-in with a code and a link sent by email);
- shops: name, phone number, SIRET, address, logo;
- the orders you publish and your customer address book, with the information described in section 3;
- proof of your acceptance of the terms (date, version, IP address, browser) and the history of changes to the account;
- your wallet: top-ups paid through Stripe Checkout and, if you choose, a card saved with Stripe for automatic top-ups;
- the devices on which you turn on notifications.
For your customers' data, you remain responsible for collecting it and informing them. We use it solely to carry out the orders you publish and to keep your customers informed. The recipient's information is erased from each order 12 months after it; an address-book entry is erased after 24 months without an order, or at most 30 days after you delete it.
If you import customers from your phone or a file, the file is read on your device: only the contacts you tick are sent to us, to check numbers and addresses before adding them.
Comptoir contains no audience measurement or advertising tool.
5. If you visit the website or write to us
Forms (contact, information request, waitlist)
We process:
- your name, your email, your phone number (optional);
- your organisation or business, your town and your message;
- for a shop, your shop's type and address;
- the page you wrote to us from;
- the date of your consent and the type of browser used.
We send you an acknowledgement of receipt. This data is used to reply to you and, if you wish, to let you know about the launch. It is reserved for the Tipper team and our service providers (section 8). It is anonymised after 18 months without activity. If you asked to be told about the launch, your e-mail is kept for that purpose until you unsubscribe.
Protection against bots
Cloudflare Turnstile receives your IP address and technical information about your browser. We also briefly count submissions per IP address to limit abuse.
Audience measurement
The website uses Google Analytics 4, loaded through Google Tag Manager, only if you accept it in the banner. Until you have accepted, Google Tag Manager is not loaded and no data is sent to Google. The details are in our cookie policy.
6. Why we process your data
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Create and manage a Tipper account, sign you in | Account, sign-in | Contract, Art. 6(1)(b) | Life of the account |
| Check identity and documents, prevent duplicate accounts and fraud | Identity, documents, fingerprint | Legitimate interest (safety of the matching service), Art. 6(1)(f) | See section 10 |
| Offer you compatible trips | Home, trips, preferences | Contract, Art. 6(1)(b) | Life of the account |
| Read your phone's location | Location | Phone permission (Art. 82 of the French Data Protection Act), then contract, Art. 6(1)(b) | Not kept, except in a report (12 months) |
| Follow how a trip goes, prove the handover, handle a dispute | Steps, photos, reports | Contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f) | Steps and reports: as long as the account exists; photos: 12 months; coordinates of a report: 12 months |
| Settle the expense contribution, keep the accounts | Balance, payouts, invoices | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) | 10 years |
| Show your profile photo to the merchant of an order | Photo, first name, initial | Contract, Art. 6(1)(b) | Life of the account |
| Send you notifications | Device identifier | Phone permission; contract, Art. 6(1)(b) | Until they are turned off or the account is deleted |
| Emails about the account and trips; information about the service | Contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f) (you can unsubscribe from information emails) | Life of the account | |
| Promotional communications | Consent, Art. 6(1)(a) | Until withdrawn | |
| Improve the app | Screens viewed | Legitimate interest, Art. 6(1)(f) | 180 days |
| Answer help requests | Messages, attachments | Contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f) | 12 months after the account is deleted |
| Keep the recipient informed, collect their feedback, allow a tip | Email, steps, rating, tip | Legitimate interest, Art. 6(1)(f); contract for the tip, Art. 6(1)(b) | 12 months after the order |
| Provide Tipper Comptoir, prove acceptance of its terms | Accounts, shops, orders, address book; date, IP and browser of the acceptance | Contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f) (proof) | Recipient information on an order: 12 months after the order. Order drafts: 7 days after the last change. Address book: 24 months without an order. Everything else: as long as the merchant account exists |
| Reply to website forms | Form | Consent, Art. 6(1)(a) | 18 months without activity, then anonymised |
| Protect the forms and the API | IP, technical data | Legitimate interest, Art. 6(1)(f) | A few hours |
| Measure website audience | Measurement cookies | Consent (Art. 82 of the French Data Protection Act) | See the cookie policy |
| Prove that a deletion was carried out | Record of the request | Legal obligation of accountability, Art. 5(2) and 6(1)(c) | As long as needed to prove the deletion |
7. Who receives your data
- The Tipper team, with named access limited to what each person needs.
- The merchants, recipients and Tippers linked to an order, for the information described in sections 2 and 3 only.
- Our service providers (section 8).
- The authorities, when the law requires it.
When you open a route in Apple Maps, Google Maps or Waze, the chosen app processes the data under its own policy. We do not sell your data.
8. Our service providers
| Entity | Role | Country |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosting of the servers, database and files; sign-in; sending and receiving emails; automatic reading of documents (Textract) | France (Paris); Ireland for backups and receiving emails |
| Amazon Web Services (Rekognition) | Detecting that a single clear face is present on the profile photo, with no comparison and no biometric template | Ireland |
| Amazon Web Services (Amazon Location, Esri data) | Route calculation and locating shop addresses | Ireland |
| Stripe | Tippers' payout account (a separate controller for its own checks), merchant invoicing and wallet, tips | Ireland and United States |
| Expo (650 Industries, Inc.) | Routing of app notifications; app updates | United States |
| Apple | Notifications on iPhone; Comptoir web notifications in Safari; app map tiles (Apple Maps) | United States |
| Google, Mozilla, Microsoft | Comptoir web notifications, depending on your browser; their content is end-to-end encrypted | United States |
| Institut national de l'information géographique et forestière (IGN, the French national mapping agency) | Address suggestions and checks in Comptoir (typing and customer import) | France |
| Cloudflare (Turnstile) | Protection of the website forms against bots | Worldwide, including the United States |
| Website audience measurement, only if you accept it | European Union and United States | |
| Anthropic | Artificial intelligence assistant used by the team, which may read personal data during internal work (for example handling a contact request or diagnosing an error); help with answering help requests, once this function is turned on | United States |
| Google Ireland Limited (Google Workspace) | Team mailbox: receives the emails sent to contact@tipper.fr and our other addresses, and the website form notifications | European Union and United States |
The matching engine runs on our servers, hosted by Amazon Web Services in Paris.
9. Transfers outside the European Union
Some service providers may process data in the United States. These transfers are covered by:
- the EU–US Data Privacy Framework, where the provider has joined it;
- otherwise, the European Commission's standard contractual clauses.
You can ask us for a copy of these safeguards.
10. How long we keep your data
| Data | Retention |
|---|---|
| Tipper account (profile, home, trips, preferences, documents, photo) | As long as the account exists, and at most 3 years without a sign-in (warning email 30 days before deletion) |
| Images of supporting documents | 6 months after the account is activated (for a document sent later: 6 months after it was sent). If the account is not activated: until the account is deleted |
| Identity document number | Replaced by a fingerprint on approval; the fingerprint is erased with the account |
| Proof that your identity was checked (document types, date), without the documents | 5 years after the account is deleted, so that it can be produced in a dispute (legitimate interest) |
| Photos taken during a trip | 12 months, or less if the account is deleted earlier |
| Coordinates attached to a report | 12 months |
| Screens viewed | 180 days |
| Help history | 12 months after the account is deleted |
| Expense contributions, payouts, invoices, merchant wallet | 10 years |
| Record of your deletion request | As long as needed to prove that the deletion was carried out |
| Recipient tracking data (email, rating, comment, tip) | 12 months after the order |
| Recipient information on a Comptoir order (name, address, phone number, email, instructions) | 12 months after the order |
| Comptoir order drafts (recipient, address, instructions) | 7 days after the last change |
| Comptoir address book | 24 months without an order, or as soon as the merchant deletes it (within 30 days) |
| Website forms | 18 months without activity, then anonymised |
| Comptoir sign-in codes | 10 minutes |
| Anti-abuse counters | A few hours |
| Technical backups | About 3 weeks |
Deleting your Tipper account
In the app, open your profile, then "Supprimer mon compte" (Delete my account). Deletion takes place no earlier than 30 days after the request, and you can cancel it until then. In the meantime:
- slots that can still be cancelled free of charge are released;
- the others remain in your name;
- we request the payout of what is owed to you.
On the scheduled date, your sign-in is deactivated. Your data is erased from our systems, from our matching engine and from our messaging, and your name is removed from the merchants' orders. Your Stripe payout account is closed. Only the following remain, for the periods in the table above: the accounting entries and the proof of verification, in a form that no longer identifies you directly; your help-request history; the record of your deletion request. Technical backups expire on their own in about 3 weeks.
Inactive accounts
A Tipper account with no sign-in at all for 3 years is deleted in the same way. We warn you by email 30 days beforehand; simply sign in to the app to keep it.
11. Automated decisions
Some steps are automatic so that they are fast. Here they are, and what they decide.
| Step | What is automatic | Human involvement |
|---|---|---|
| Offers you see | The slots shown are calculated from your home and radius, the days and times of your trips (to within one hour) and the detour you accept. When you book, the orders in the slot are attached to your trip; you accept this when booking. The amount of the contribution depends on the order (distance, shop), not on your profile. | You remain free to book or not. |
| Documents | Automatic reading (Textract). A document recognised with high confidence is approved automatically. An expired document is refused, and you provide a valid one. | All other documents are checked by the team. |
| Duplicate identity | The fingerprint of the number is compared with those of existing accounts. | If there is a match, the file goes to human review; nothing is refused automatically. |
| Profile photo | Detection that a face is present (Rekognition DetectFaces). A photo with no face or with several faces is refused, and you take it again. A clear photo is approved automatically. | Other photos are checked by the team. No comparison with your identity document, no biometric template. |
| Progress of the sign-up | Automatic move to the next step when all documents are approved. Return to "documents to provide" if a document is needed again. | Activating or refusing an account is always decided by the team. |
| Contribution put on hold | If a trip ends with an open report (location not confirmed, or handover without the recipient's code), the amounts become available 48 hours after the end of the trip instead of immediately. They are released automatically. | Any withholding or correction is decided by a person, who contacts you. |
| Location gap | On arrival at the pickup point, a gap of more than 500 m from the shop's address creates a report. The step remains validated. | The report is reviewed by the team. |
| Recipients' ratings | None. | They are never used for any decision about you. |
| Inactive account | An account with no sign-in for 3 years receives a warning email, then is deleted 30 days later if there has been no sign-in. | Signing in is enough to avoid it; you can also write to us. |
This processing does not, on its own, produce any decision with a legal effect or a similarly significant effect within the meaning of Article 22 of the GDPR. You can at any time ask for a person to review a decision, give your point of view or contest it: write to contact@tipper.fr.
12. Security
- Hosting in private environments in the European Union; encrypted exchanges.
- Documents and photos never public, opened only through temporary links.
- Named, limited team access; sensitive actions logged.
- Sign-in information kept in your phone's secure storage.
- No open-tracking pixel in our emails.
In the event of a data breach presenting a risk to you, we notify the CNIL within 72 hours and, if the risk is high, we inform you directly.
13. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability. You can withdraw your consent at any time, ask for a human review of an automated decision (section 11) and set instructions for what happens to your data after your death.
How to exercise them:
- Delete your Tipper account: in the app ("Supprimer mon compte").
- Get a copy of your data: write to us. We send it to you in a structured, machine-readable format.
- Merchants, recipients, prospects, and any other right: write to contact@tipper.fr.
- Emails: every non-essential message contains a link to manage your preferences.
We reply within one month, which may be extended by two months if the request is complex; we will tell you if so. We may ask you to confirm your identity, for example by writing from your account's email address.
If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07).
14. Cookies
The details of the website's cookies, and how to change your mind at any time, are in our cookie policy. The app and Tipper Comptoir use only the storage needed to keep you signed in.
15. Changes
We may update this policy. In the event of a significant change, we will let you know in the app, in Comptoir or by email before it applies. The date of the last update is shown at the top of this page.