Privacy policy

1. What we collect, and why

Only what the service needs to work. There is no analytics, no advertising, no audience measurement and no third-party tracking in either the dashboard or the player — not configured off, but absent.

Your account

Email address, and your name if you give one. Needed to sign you in, to show colleagues who they are working with, and to send you a sign-in code. Passwords, when used, are stored only as a hash by our authentication provider and are never visible to us.

Your workspace

Workspace name, who belongs to it and each person's role. This is what decides who may see and change your content.

Content you upload

The images and videos themselves, plus filename, format, size, dimensions, duration and a checksum. Stored in a private bucket; never publicly listable.

People you invite

The email address you type when inviting a colleague, and who accepted. Kept until the invitation is used or revoked, and no more than seven days.

Your screens

A device identifier and a hashed device token, plus the name you give the screen, its timezone, screen resolution, app version and the time it was last seen. This is how a screen proves it is yours and how you can tell whether it is online.

What played

Which item appeared on which screen and when, so you can confirm that what you scheduled actually ran.

Screenshots

Only when you ask a screen to take one. It shows whatever that screen was displaying, so do not request one if the screen is showing something you would not want stored. Kept in a private bucket until you delete it or the screen.

Connected accounts

If you connect Canva or Google, the account name and the access tokens needed to import your designs. Tokens are stored separately from the rest of the record and are never shown back to you or to anyone else in your workspace.

We do not collect anything from the audience in front of your screens. The player has no camera, no microphone, no people-counting, no footfall measurement and no device detection. It displays what you scheduled and reports its own health.

2. Why we are allowed to hold it

For customers in the EU, our lawful basis is the performance of our contract with you — the service cannot show your content on your screen without your content and your screen — together with our legitimate interest in keeping the service secure and working. For customers in India, we process personal data for the lawful purpose of providing the service you signed up for. We do not sell personal data and we do not use it to train models.

3. Where it is stored, and who else touches it

All customer data is stored in Ireland, in the European Union, regardless of where you are. If you are in India, this means your data is transferred out of India and stored in the EU. The DPDP Act permits that transfer, and we tell you plainly rather than leaving you to infer it.

Supabase

Database, authentication and file storage. Ireland (eu-west-1), European Union.

Vercel

Application hosting and content delivery. Global edge network; the application region is in the EU.

Resend

Sending account and invitation email. United States, under EU Standard Contractual Clauses.

These are the only parties that handle your data in the ordinary course. Each processes it on our instructions and may not use it for their own purposes.

4. Services you choose to involve

Some services are only reached because you asked for them. Until you do, no data goes near them.

Canva

You connect a Canva account to import designs. Your Canva account name, and the designs you choose to import.

Google (Slides)

You connect a Google account to import a presentation. Your Google account name, and the presentations you choose to import.

YouTube (Google)

You add a YouTube video or playlist to a playlist. The screen requests the video from Google, so Google receives the screen's IP address. Tresleche uses youtube-nocookie.com, which does not set advertising cookies before playback.

5. Cookies and what is stored on a device

The dashboard sets a cookie that keeps you signed in, and a short-lived cookie while you are connecting Canva or Google that exists only to confirm the reply came back from where the request went. Both are strictly necessary; neither is used for advertising or tracking, and there are no third-party cookies to consent to.

The player stores more, on the screen itself, because it must keep working when the network does not: its own identity, your brand colour and logo, and a cache of the media it has been told to play. That cache lives on the device and is never read by us. Clearing a screen's storage removes all of it and the screen will need pairing again.

6. How long we keep it

Your content, playlists, schedules and screens stay until you delete them or delete the workspace, which removes everything in it. Invitations expire after seven days. Records of what played, and screenshots you requested, are kept while the screen exists. If you close your account we delete your workspaces and their contents; we may keep a minimal record that an account existed where we are legally required to.

7. How it is protected

Every request is encrypted in transit. Separation between customers is enforced by the database itself rather than by application code, so a mistake in our code cannot show one customer another's content. Device and invitation tokens are stored only as hashes, so a copy of our database does not yield working credentials. Files live in private buckets reachable only through short-lived signed links.

No service is immune. If a breach affects your personal data we will tell you and the relevant authority within the time the law requires.

8. Your rights

Wherever you are, you can ask us to show you what we hold about you, correct it, delete it, or give you a copy in a portable form. Write to privacy@tresleche.com and we will answer within 30 days.

If you are in the EU, EEA or UK: you have the rights of access, rectification, erasure, restriction, data portability and objection under the GDPR, and the right to withdraw consent where we rely on it. You may also complain to your national data protection authority — in the Netherlands, the Autoriteit Persoonsgegevens.

If you are in India: under the Digital Personal Data Protection Act 2023 you have the right to access a summary of your data and how it is processed, to have it corrected, completed or erased, to nominate someone to exercise your rights if you cannot, and to have a grievance addressed. Our grievance contact is privacy@tresleche.com. If we do not resolve your complaint you may escalate it to the Data Protection Board of India.

9. Children

The service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18, and we do not profile children or use their data for advertising.

10. Changes

If we change this policy in a way that affects you, we will update the date at the top and tell account owners by email before the change takes effect. Continuing to use the service after that date means the new version applies.

11. Contact

Tresleche, the Netherlands. Write to privacy@tresleche.com about anything in this policy.