Privacy Policy
Last updated: 21 July 2026
X-Tract allows an event organiser to ask a person, by SMS, to share their geographic position in order to find them. This policy describes the data we process, why, for how long, and the rights available to you.
It concerns two categories of persons, whose situations are very different: the organiser, who holds an account and uses the service, and the located person, who receives an SMS and has neither an account nor anything to install.
This policy is available in several languages. In the event of any discrepancy between the language versions, the French version shall prevail.
1. Data controller
X-Fabric SAS, a simplified joint-stock company (société par actions simplifiée) with a share capital of 15 000 euros, whose registered office is located at 47 rue Vivienne, 75002 Paris, registered under number 842 433 252.
Contact: contact@x-tract.fr
2. Data processed
Concerning the organiser:
- Telephone number, which serves as the login identifier.
- Surname, first name and profile picture where these are provided.
- Information declared upon registration: activity profile, number of participants, frequency of events, geolocation tools already used, any previous accident, motivations and how the service was discovered.
- Email address where one is associated with the account.
- The organisation to which the organiser belongs and their role within it.
- In the case of a paid subscription, the customer and subscription identifiers assigned by our payment provider. No banking data passes through our servers or is retained by us.
Concerning the located person:
- The telephone number to which the request is sent, entered by the organiser.
- The label associated with the request by the organiser, in practice the name of the person being sought.
- The position coordinates transmitted from their telephone where they consent to this: latitude, longitude, accuracy, altitude, speed and timestamp. All positions recorded during the session are retained, and not solely the final position.
- Technical information about their device, derived from what their browser transmits: operating system, browser, whether the link was opened from a third-party application, and the status of the location permission.
- The timestamps of the progress of the request: sending, receipt, opening of the link, acceptance and transmission of the position.
We do not retain the IP address of the located person in our databases. It is necessarily seen by our hosting provider, under the conditions described in section 5.
We carry out no advertising, no advertising profiling and no resale of data.
3. Purposes and legal bases
| Processing | Legal basis |
|---|---|
| Creation and management of the account, authentication by one-time code | Performance of the contract |
| Sending of the location request by SMS | Performance of the contract concluded with the organiser |
| Collection and display of the position of the located person | Consent of the located person, obtained before any collection |
| Retention of the history of requests and its presentation in the form of a register | Legitimate interest, enabling an organiser to demonstrate the search measures implemented |
| Audience measurement and analysis of the operation of the service | Legitimate interest |
| Detection of technical errors and security, including protection against automated sending | Legitimate interest |
| Management of subscriptions and invoicing | Performance of the contract and legal accounting obligations |
The located person gives their consent by explicitly activating the position-sharing command, then by granting the permission requested by their browser. They may refuse, in which case the service does not operate. They may interrupt the sharing at any time by closing the page.
Prior to that consent, the opening of the link is recorded, as well as the type of device used. This record, which contains no position, enables the organiser to know whether their message has been seen and to understand the cases in which location fails.
4. Retention periods
Organiser account data is retained for as long as the account exists. It is deleted when the organiser deletes their account, in accordance with the procedures described in section 7.
Location requests and the associated positions are retained for as long as the organisation which issued them exists. They constitute the history of the organisation and feed into its register. They are deleted when the organisation is deleted, or at the request of the data subject under the conditions of section 7.
Accounting records relating to a subscription are retained for the period imposed by law, namely ten years.
We do not carry out automatic deletion at a fixed term. Any person may request the deletion of their data at any time.
5. Recipients and processors
Our teams access the data within the limits of what is necessary for the operation of the service. We also call upon the following providers, which act on our instructions.
| Provider | Role | Data concerned |
|---|---|---|
| Vercel | Hosting and technical logs | All requests, including IP addresses |
| Supabase | Database, authentication, storage | All service data |
| Twilio | Sending of request and invitation SMS messages | Recipient numbers and message content |
| Stripe | Collection of subscription payments | Email address, customer and subscription identifiers |
| Sentry | Detection of technical errors | Identifier and email address of the organiser, error context |
| Umami | Audience measurement, hosted on our own infrastructure | Usage events, including telephone numbers and position coordinates |
| Crisp | User support | Name and number of the organiser who opens a conversation |
| Cloudflare | Protection against automated sending upon login | IP address and technical signals from the browser |
| IGN, OpenStreetMap and other map background providers | Display of maps | Geographic areas consulted, together with the IP address of the organiser |
The database of the service is hosted in the European Union, in Germany. Certain providers are established outside the European Union; the corresponding transfers are governed by the standard contractual clauses of the European Commission.
We do not sell or transfer data to third parties. We may be required to disclose data to the competent authorities upon formal request.
6. Security
Access to the application is protected by one-time authentication. Communications are encrypted in transit. Location links are not indexed by search engines and are associated with a specific request.
Where the organiser activates offline mode, the data of their organisation, including numbers and positions, is stored on their own device so as to remain accessible without a network connection. It is their responsibility to protect access to that device.
7. Your rights
You have a right of access, rectification, erasure, objection, restriction and portability.
The organiser may delete their account from the Profile page of the application. The full procedure, including without going through the application, is described on the page dedicated to account deletion.
The located person may request the deletion of the data concerning them by writing to contact@x-tract.fr, indicating the telephone number to which the location request was sent.
Any request is handled within a maximum period of one month. Verification of identity may be requested in the event of doubt as to the author of the request. You may lodge a complaint with the CNIL, via www.cnil.fr.
8. Cookies and local storage
The application uses cookies necessary for its operation: maintaining the session, storing the current organisation, display preferences. Their lifetime is seven days at most, excluding session cookies.
The application also stores data on your device to enable offline operation: downloaded map backgrounds and a copy of the data of your organisation. This data disappears when you delete the downloaded backgrounds or the browsing data of your browser.
The position-sharing page temporarily stores the positions recorded on the device of the located person, so as not to lose them in the event of a network interruption.
We use no advertising cookies and no trackers for advertising purposes.
9. Minors
The organiser account is reserved for persons of full age.
A location request may concern a minor, in particular during sporting events open to young participants. It is then for the organiser to ensure that they are entitled to search for that person, and position sharing remains subject to a voluntary action carried out from the telephone concerned.
10. Amendment of this policy
We may amend this policy. In the event of a substantial amendment, users holding an account are informed of it.