Teewal privacy policy

Version of 7 November 2026. It describes what the application actually does on that date, and what is planned (marked “soon”).

1. In short

• Teewal is responsible for your data. European law (GDPR) applies, even when data is processed in Africa.
• We collect the minimum needed to carry out your job and keep the proof.
• Your contact details stay protected: the partner only sees the job.
• Each agent has an agent number (for example TW-A-7KQ4M2). Teewal only ever shows clients, their relatives and recipients this number, never the agent's name, photo, phone or email. Names written in the messages exchanged are not filtered. Only Teewal can link this number to the person.
• Teewal does not ask you for any health data; do not write any in discussions. For an appointment, Teewal only sells the accompaniment; any care and its booking take place with a third party (platform or clinic), which sends us nothing.
• Partners' identity documents are processed in Africa and deleted after the check. Teewal only keeps the result.
• No automated decisions: a person in the team decides.
• The Teewal Assistant is an automated assistant that runs on our own servers, in the European Union. It uses no external artificial intelligence service: your messages are sent to no other company. It does not keep your conversations after the end of your visit (unless you ask to speak to a person).
• Teewal local operators, bound to Teewal by contract, carry out checks on site and may receive and then hand over original documents, under seal, for 72 hours at most.
• No advertising, no sale of data, no advertising trackers.

2. Who is responsible

Data controller: Hakkilo SAS, which operates the Teewal brand, an SAS (société par actions simplifiée, a French simplified joint-stock company), registered office 122 rue Amelot, 75011 Paris, SIREN 131 536 047. Details in the Legal notice. Privacy contact: [email protected]. Data protection contact person: they answer at the privacy address above. At launch, the volume of identity data processed remains limited, and Teewal does not ask for health data: appointing a data protection officer (DPO) does not yet appear to be mandatory (GDPR, art. 37.1.c: processing “on a large scale”). Teewal will review this every year and as soon as the volume increases.

Teewal is the data controller for all the data described here, including data processed in Africa by its processors (GDPR, art. 3.1).

3. The people concerned

Clients · members of a family file · relatives accompanied or visited · referred friends · partners (agents, professionals) · Teewal local operators · partners' references · people who hand over or receive an original document · people met on site · visitors to the website and the demo.

4. What we do with your data, and why it is allowed

No advertising profiling. No sale or rental of your data.

Signing in with Google, Apple or Facebook (optional). You can always sign in with a simple link received by email. If you prefer “Continue with Google”, “Continue with Apple” or “Continue with Facebook”:

• Purpose: creating your account and signing you in without a password (purpose 1 above; contract, art. 6.1.b).
• What we receive: your account identifier with that provider, your email address and whether the address is verified, your first name. Nothing else: no photo, no friends list, no contacts, no posts. The access token given by the provider is used only once, during sign-in, and is never kept.
• Apple: you can hide your address; we then receive a private relay address that forwards our emails. Apple only sends your first name at the first sign-in.
• Facebook, or any address that the provider does not host itself (for example a work address used with Google or Apple): we first send you a link to confirm your address; the account is only opened or linked after this link. If someone had opened an account at your address in this way, their sign-in methods are removed as soon as you confirm the address, and we tell you.
• Existing account: if the verified address matches a Teewal account, nothing is linked without your agreement, confirmed by a link sent to that address.
• Your choices: in “My sign-in methods”, you link or unlink each provider at any time (you always keep at least one way to sign in). Unlinking erases the identifier on our side.
• Only the provider you choose is contacted, at the moment you click. It processes your sign-in under its own policy (Google LLC / Google Ireland Limited; Apple Inc. / Apple Distribution International; Meta Platforms Ireland Limited), as controller of its own processing.
• Teewal team accounts sign in by email link (social sign-in is only open to them through an internal setting).

5. Health appointments: Teewal knows nothing about them

Teewal does not ask you for any health data; do not write any in discussions. For an appointment, whether administrative, banking, family or medical, Teewal only sells accompaniment by an agent: they come to collect your relative, accompany them and bring them back.

• We record neither the type nor the place of the appointment, nor the name of a professional. The agent receives the destination by phone.
• The proof is limited to: “Accompaniment completed: left home at such time, returned at such time”. No place of arrival, no photo of the place.
• To book a medical appointment, Teewal displays a simple link to an appointment platform of the country or a list of clinics. The link contains no data about you or your relative, and we record neither the click nor your choice. The platform or clinic is solely responsible for the booking, the care and the medical data; you pay it directly.
• Date reminders: only “Appointment”, with no further detail.
• On an accompaniment job, words that reveal care are masked before being stored. On other jobs, discussions are not filtered: if you still write health information there, it follows the duration of the discussion (§ 9), and you can ask us to remove it at the privacy address.
• The Teewal Assistant refuses medical information: if it recognises health information in a message, it asks you not to write it, does not carry it over into any form or report, and masks it if the conversation is passed on to a person in the team.

5 bis. The Teewal Assistant

What it is. An automated assistant: a program, not a person. It relies on a base of answers written by Teewal from the content of the platform, and on a small language-understanding model (an open-source artificial intelligence program) that is used only to recognise what your question is about. The whole system runs on our servers, in the European Union (Netherlands).

What it does not do.

• It sends your messages to no other company: no external artificial intelligence service (neither OpenAI nor any other). There is therefore no transfer and no processor specific to the Assistant, apart from our host (§ 7.3).
• It is not used to train an artificial intelligence model.
• It makes no decision about you: it does not set prices (only the quote issued by Teewal is binding), does not accept or refuse a request, does not rate partners and does not choose who carries out a job.
• It does not write the report in place of the partner: it presents them with a list of points to check (checklist); the partner ticks and writes their findings themselves, then signs.
• When a question falls outside its scope, it says so and offers you the chance to speak to a person.

Retention. The conversation is kept only for the duration of your session (24 hours at most), then it is erased. Only anonymous counters remain (row 20 of § 4). Exceptions:

• if you choose “Speak to a person”, the conversation (with health information masked) is passed on to the team and kept as an exchange with customer service (§ 9);
• what you send yourself (a request, a submitted form, a signed report) follows the retention period of the request or the job.

6. Partner identity verification

This part concerns agents. It does not concern clients.

6.1 Why. To protect client families and the people visited, prevent fraud and identity theft, and comply with asset-freezing measures.

6.2 The steps.

1. Versioned agreement and declaration: trade, country, type of document, declaration of a prominent public function (politically exposed person, PEP).
2. Phone and email.
3. Trade documents (professional verification): for a surveyor, a notary or another regulated profession, registration with the professional Order or Chamber, diploma; for a driver, driving licence, vehicle registration document, insurance.
4. Two references (outside the family), called by the team.
5. Proof that the identity document is yours, at your choice:
   • video call with the team, never recorded;
   • or meeting with a confirmed agent (they only see your first name, the initial of your surname and your neighbourhood; they take a photo of the place, with no face or identity document);
   • soon, and always optional: a selfie with a movement challenge (see 6.5).
6. Screening against the official sanctions lists.
7. Decision by a person in the team.

6.3 Place of processing and what we keep.

• At present, the application neither receives nor keeps any image of an identity document, nor any document number.
• When the “Teewal Vérif” service opens, your documents will go directly from your phone to this service hosted in Africa. They will be read in memory as far as possible. If a person needs to review them, they are kept encrypted in the same region, then deleted upon the decision, or at the latest 72 hours after upload. Each deletion is recorded in a log.
• Teewal only keeps the result: status, date, reason, score, signals (valid / to be confirmed), expiry date of the document, and “duplicate yes / no”. The only exception, described below: an encrypted fingerprint of the document number, kept in Africa, used only to prevent the same document from being used for two accounts.
• To detect that the same document is being used for two accounts, the African service keeps a secret-key fingerprint of the document number (HMAC). Without the key, the number cannot be recovered. It is nevertheless pseudonymised personal data, kept only to combat fraud. It is kept for the duration of the relationship and 1 year afterwards, or 5 years after a refusal for fraud.

6.4 Legal bases.

6.5 Biometrics (soon, optional).

• If you choose the selfie, a program compares your face with the one on the identity document and checks that you are actually present. This is biometric data (art. 9).
• We ask for your express and separate consent, which you can withdraw at any time.
• You can always choose the video call or the meeting instead, without losing time or access to jobs.
• Face templates are never stored: they are calculated, compared, then erased from memory.
• The program never refuses on its own: it assists the person reviewing.

6.6 Screening against sanctions lists. Your name is compared every day with the official lists: UN, European Union, OFAC (United States) and the national register of asset freezes of the DG Trésor (French Treasury). A similarity only gives a “possible match, to be confirmed”; we keep the score and the public reference of the list entry, not your date of birth. A match is only confirmed by two different people in the team; it results in the account being frozen.

6.7 Human decision and appeal. No refusal is automatic. A refusal or a confirmed sanction requires two reviewers and a reason. You may present your point of view and contest it within 30 days by replying to the decision message (GDPR, art. 22).

6.8 Informing references. The people you give as references receive a message before the call. Their name and phone number are erased 30 days after the decision.

7. Who receives your data

7.1 Within Teewal. Only the people who need it, with logged access. Verification reviewers have separate rights.

7.1 bis Agent number. Teewal gives every agent, operator or professional who carries out tasks a unique number (for example TW-A-7KQ4M2). The number is drawn at random: it does not come from the name, the email or the phone. It is pseudonymised data: only Teewal can link the number to the person. Head office does so only when needed (complaint, safety, accounting, request from an authority), and every search is written to the audit log. Country staff see an agent's name only for the jobs of their country. The agent's name appears only where the law requires it: their self-billing invoices (with their number), which the client never receives, the author's statement an agent signs electronically, which carries their name like any electronic signature, and the power of attorney a client signs: it names the person who will act on their behalf, that is the agent (their legal name, as verified by Teewal on their identity document, and their agent number) or the partner firm doing the job (its company name, profession and representative). This name appears only in the text of the power of attorney (the screen where the client reads it, the frozen PDF, then the signed PDF); it appears neither on the public verification page nor in the evidence log.

7.2 Between users (“minimum needed”).

• The partner sees the job: place, purpose, person to meet. Not your full name, nor your phone number, nor your budget, nor your other property. Your name appears only when the law requires it (power of attorney, official report (constat)).
• Teewal shows you about the partner: their agent number (“Agent TW-A-7KQ4M2”), trade, rating and “verified” status. Teewal never displays their name, photo, phone or email, whether in the application, on the shared link or on a delivery tracking page. Names written in the messages exchanged are not filtered. Exceptions: the statement they sign electronically carries their name, and the power of attorney you sign names them, or their firm (article 7.1 bis).
• Members of the family file: see the Terms of use, article 11.

7.1 ter Electronic signature. Report statements (and, once opened, powers of attorney) are signed with Teewal's own signing tool, without any outside provider. The document is frozen before signing and its fingerprint recorded; the person signs from their account (drawn signature or typed name), then confirms with a 6-digit code received by email (sent by our email provider, kept only in encrypted form, valid for 10 minutes). Teewal keeps an evidence log: the time, the account identifier, an encrypted fingerprint of the IP address (never the address itself), the browser used, the document fingerprint and the method; no name, no code. The signed PDF, sealed by Teewal, carries the signature and an evidence page. The public verification page shows only the type of document, the signing date and the code, never a name. Revoking a power of attorney: the client can revoke, at any time and from their account, a power of attorney they signed. Teewal then records the server's date and time on the power of attorney and adds a “revocation” event to the evidence log (account identifier, encrypted fingerprint of the IP address, browser; no name, no reason). The signed PDF is not changed; the public verification page shows that it is revoked and since when. The agent and the Teewal team following the job are told. This is a simple electronic signature.

7.2 bis Original documents. When a job includes receiving and handing over an original, the local operator who holds it sees the type of document and the names of the people who hand it over and receive it. They never photograph the content of the document; only the closed envelope and its seal are photographed, in the application. The person receiving the document is identified by a handover code and by showing their identity document, without any photo or copy of that document.

7.3 Processors (they act on our instructions, under a contract that complies with article 28 of the GDPR):

7.4 Payment providers (controllers of their own processing for fraud prevention and their legal obligations):

• Stripe (Stripe Payments Europe, Limited, Ireland) for bank cards;
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg).

They receive your payment data directly. Please read their policies.

7.5 WhatsApp (Meta) if you contact us through this channel.

7.5 bis Sign-in providers (Google, Apple, Meta for Facebook), only if you choose to sign in with them: you identify yourself with them; Teewal only sends them the Teewal application identifier, the return address and the sign-in code to be exchanged. No job data is sent to them.

7.5 ter Notification services, only if you turn notifications on: your browser's service (Web Push), Apple (Apple Push Notification service) for the iPhone app, Google (Firebase Cloud Messaging) for the Android app. They receive the device token, a neutral title and text, and the page to open. No name, no place, no conversation content. Apple and Google process these sendings under their own policies.

7.6 Authorities. Only when the law requires it (courts, tax authorities, asset-freezing authorities).

7.7 Partner professionals. A notary, a lawyer or a commissaire de justice (French judicial officer) involved in your job receives what is necessary for the act (acte, the legal document they draw up). They are then the controller of their own processing.

8. Transfers outside the European Union

Some data is processed outside the EU:

• in the United States, by our hosts and technical providers, by the sign-in provider you choose and, if you turn on the app's notifications, by your phone's notification service (Google, Apple, Meta: companies certified under the EU–US framework); these transfers are covered by the European Commission's standard contractual clauses (Decision (EU) 2021/914) or by the EU–US Data Privacy Framework (adequacy decision (EU) 2023/1795) where the provider is certified under it;
• no transfer for the Teewal Assistant: it runs on our servers in the European Union and sends nothing to any other provider;
• in Africa, by the host of “Teewal Vérif”, by Teewal local operators and by the partners who carry out your job (the partner receives, in the country of the job, what is necessary for the task). These transfers are covered by the European Commission's standard contractual clauses (Decision (EU) 2021/914; module 2 with the host of “Teewal Vérif”, with each partner and with each operator, included in their contract) and by a transfer impact assessment. The derogations in article 49 of the GDPR (for example the performance of the contract you requested) are used only in addition, for occasional transfers.

You can obtain a copy of the safeguards by writing to [email protected].

9. How long we keep your data

10. Security

Encryption of exchanges (HTTPS, HSTS), protected session cookies, sign-in links with limited use and never stored, files served only if their fingerprint matches, payments confirmed only by Stripe or PayPal, internal access limited and logged, append-only and chained audit log for verification; electronically signed documents sealed by Teewal, append-only and chained signature evidence. Verification service: per-file encryption, keys kept in the region, no backup of images.

In the event of a data breach presenting a risk, we notify the CNIL within 72 hours and, if the risk is high, the people concerned (GDPR, art. 33 and 34).

11. Your rights

You can:

• access your data and obtain a copy;
• have it rectified;
• request its erasure (unless we must keep it, for example for accounting or fraud prevention);
• request restriction of processing;
• object to processing based on our legitimate interest;
• receive your data in a reusable format (portability);
• withdraw your consent at any time (biometrics), without affecting what was done before;
• not be subject to a decision based solely on automated processing, obtain human intervention, give your point of view and contest the decision;
• give directives on what happens to your data after your death (law no. 78-17, art. 85). Without a directive, on your death, your legal heirs can only exercise the rights provided for by law (for example having your account closed), and your vault is erased according to the periods in § 9.

How. Write to [email protected] (data protection contact person). We reply within one month (which may be extended by two months if the request is complex; we will let you know). We may ask you to prove your identity if we are in doubt.

Complaint. You can refer the matter to the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 · www.cnil.fr) or to the data protection authority of your country.

12. African data protection laws

Teewal works in several African countries. Their laws apply in addition to the GDPR for processing carried out locally or concerning their residents. Before opening in each country, Teewal completes the required formalities. Indicative list:

You can also exercise your rights before the authority of your country.

13. People met on site

During a job, a partner may meet other people (a relative, a seller, an administrative officer). Rules:

• no photo of a person without their consent; never a photo of a sick person;
• job photos show places and objects, not faces;
• the person may ask the partner for information about Teewal and exercise their rights at [email protected].

14. Minors

Teewal is reserved for people aged 18 and over. A job may concern a minor (for example visiting the child of a relative): it is carried out with the consent of their legal representative, and with no photo of the child.

15. Changes

We will notify you of any significant change by email or in the application. Date of last update: 26 October 2026.