Your data, and what Tache does with it.
Tache is an AI concierge you reach on WhatsApp. This page explains, in plain words, what data it processes, why, who with, for how long, and how you stay in control.
Version of 27 October 2026. Consent message in force: 2026-10-21.4. This is a translation; in case of any discrepancy, the French version prevails.
You reached this policy through the link to version 2026-10-21.3 quoted in the consent message. Its content is identical to the current version.
1. Data controller
The data controller is OXYGENE NUMERIQUE (trading as OXYNUM), the publisher of Tache:
- OXYGENE NUMERIQUE, French simplified joint-stock company (SAS) with a share capital of €10,000.00
- SIREN 749 947 297, head office SIRET 749 947 297 00018, 749 947 297 R.C.S. Paris
- EU VAT number: FR41749947297
- Registered office: 111 avenue Victor Hugo, 75016 Paris, France
- President: Rudy THIMOTHEE
Contact for any question or request about your data, including for the attention of the President: team@oxynum.fr. See also the legal notice.
Tache is currently in private beta: only WhatsApp numbers that have been explicitly allowed can use it. The service is not intended for anyone under 18.
2. At a glance
- A single AI provider: Mistral AI, called only through its European endpoint. The software refuses to start with any other host.
- Hosted in the European Union: servers and database at Railway, EU West region (Amsterdam).
- Nothing is kept without your consent: without consent, your conversations are erased after 24 hours and your voice notes and images are not analysed.
- Audio files and images are never stored: they are read in memory, and only their transcription or description is kept with the conversation.
- Nothing is done on your behalf without approval: sending an email or an invitation requires you to tap “Valider” (Approve).
- One exception to know about: if you connect a Google account, the connection goes through Composio, a provider located outside the European Union (see section 6).
- No advertising, no resale: your data is never sold, rented or used to target you. Tache does not train any AI model on your data.
3. Data processed
| Category | Content | Source |
|---|---|---|
| Identity and account | Phone number, WhatsApp ID, profile name, time zone, language, sign-up status | WhatsApp (Meta), your messages |
| Messages | Text of your messages and of the replies, transcription of your voice notes, description of your images, timestamps, delivery status, technical fingerprint of media files | You |
| Media | Voice notes and images: processed in memory for the time of the analysis, never saved by Tache | You |
| Proof of consent | Your decision (consent, refusal, withdrawal), the version and fingerprint of the text shown to you, your reply, the date | You |
| Connected Google accounts | Email address of the Google account, label, connection ID at Composio. Google access tokens are held by Composio, not by Tache | You, Composio |
| Google content accessed | Emails, calendar events and Drive files that Tache reads to answer your request, at the time of the request | Your Google account |
| Pending actions | Details of an action awaiting approval or that can still be undone (for example the text of an email, the guests of an event) | You, Tache |
| Action log | Name of the tool used, date, outcome, and parameter names (without their content) | Tache |
| Dedicated browser | ID of your virtual machine, pages visited and content read while completing a task online | Tache, websites visited |
Sensitive data
You may share health, fitness or financial information with Tache. It is kept beyond 24 hours only with your explicit consent, given on WhatsApp (GDPR, Article 9(2)(a)). Tache never keeps your passwords, verification codes or card numbers: they are masked before any storage and before anything is sent to the AI model.
Memory
The consent message describes a memory of your preferences, people close to you and habits. This long-term memory is not switched on yet: today, Tache remembers you only through your conversation history, within the time limits below. This policy will be updated, and your consent asked again if needed, before it is switched on.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR, Art. 6) |
|---|---|
| Replying to your messages and carrying out your requests (email, calendar, documents, online tasks) | Performance of the service you ask for (6(1)(b)) |
| Keeping history beyond 24 hours, analysing your voice notes and images | Consent (6(1)(a)), and explicit consent for sensitive data (9(2)(a)) |
| Connecting your Google accounts | Consent, given when connecting and revocable |
| Proving your consent choices | Legal obligation (6(1)(c), Article 7(1)) |
| Service security, abuse prevention, action log | Legitimate interest (6(1)(f)): protecting your accounts and the service |
5. Service providers (processors)
Tache relies on the following providers, each limited to what its task requires.
| Provider | Role | Location |
|---|---|---|
| Meta Platforms Ireland (WhatsApp Business, Cloud API) | Carrying your messages and media between WhatsApp and Tache | Under Meta's terms, with possible transfers outside the EU |
| Mistral AI (France) | Understanding and writing replies, transcribing voice notes (Voxtral), describing images | European endpoint api.eu.mistral.ai, processing in the EU |
| Railway | Hosting Tache's servers, its database and this website | EU West region (Amsterdam). Railway is a US company |
| Composio | Managing the connection to your Google accounts and running the Gmail, Google Calendar and Google Drive operations you ask for | Outside the European Union (see section 6) |
| Daytona | Providing the dedicated browser (a personal virtual machine) used for online tasks | European infrastructure (“eu” region) |
Google is not a provider of Tache: it is your own email, calendar and storage provider. Tache accesses it only with your permission, which you can withdraw from your Google account or by sending EFFACER to Tache (see section 8).
Mistral AI receives content only to generate the reply. The anonymous improvement option (model training) is turned off in Tache's Mistral console: your data is not used to train Mistral's models. Under Mistral AI's privacy policy, inputs and outputs are kept for the time needed to generate the reply, then for up to 30 rolling days for abuse detection, unless zero data retention is enabled, which is not the case here (Mistral documentation).
Technical monitoring tools (Langfuse for traces, Sentry for errors, both with personal data masking) are built into the software but are not turned on at this time. This page will be updated before either is turned on.
6. Transfers outside the European Union
The core of the service (AI, hosting, database, dedicated browser) runs in the European Union. Two situations can lead to a transfer outside the EU:
- Connecting a Google account: Composio processes, outside the EU, the operations on your emails, calendar and files that you ask Tache to perform. If you connect no account, Composio receives no data about you.
- WhatsApp: Meta may process messages outside the EU under its own terms.
Safeguards for these transfers: Composio's data processing agreement (DPA), which incorporates the European Commission's Standard Contractual Clauses (controller-to-processor module). Composio states that it holds SOC 2 Type II certification and encrypts the credentials of connected accounts at rest (AES-256-GCM) and in transit (TLS). See Composio's security documentation and its DPA.
7. Retention periods
These periods are enforced automatically: a purge job runs every hour.
| Data | Period |
|---|---|
| Messages, transcriptions and image descriptions, with your consent | 90 days |
| Messages without consent (sign-up in progress, refusal or withdrawal) | 24 hours |
| Audio files and images | Not kept (processed in memory) |
| Request to approve an action | Valid for 15 minutes, then expires |
| Pending actions and undo options | 7 days |
| Action log (without content) | 30 days |
| Dedicated browser | Paused after 10 minutes of inactivity, stopped after 7 days, destroyed after 90 days without activity |
| Connected Google accounts | Until you disconnect them or send EFFACER |
| Proof of consent | Kept even after erasure, to prove your choices: for the life of the account, then 5 years after it is closed (civil limitation period, Article 2224 of the French Civil Code) |
8. Your rights, and how to exercise them
You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent at any time, without affecting processing already carried out.
Directly on WhatsApp
Tache currently understands these commands in French only. Send them exactly as written:
- Withdraw your consent: send “retire mon consentement”. Tache stops keeping anything new and your conversations are erased after 24 hours.
- Erase everything: send EFFACER, then CONFIRMER within 10 minutes. Tache disconnects your Google accounts, destroys your dedicated browser and deletes your messages, actions and connected accounts.
- Give your consent again: send “j'accepte”.
After an erasure, Tache keeps only the proof of your consent choices, plus a minimal record (phone number, time zone) to recognise your number and respect your choices if you write again.
By email
The commands “what do you know about me”, “forget that” and “export my data”, mentioned in the consent message, are not automated yet. To get a copy of your data, correct it or exercise any other right, write to team@oxynum.fr. You will receive a reply within one month.
If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority, or with the supervisory authority of the EU country where you live.
9. Security
- Messages received from WhatsApp are authenticated by cryptographic signature before any processing.
- Each user is isolated in the database (row-level security): the software refuses to start with credentials that would bypass this isolation.
- The database is reachable only on the hosting provider's private network.
- Passwords, verification codes and card numbers are masked before storage and before being sent to the AI; phone numbers and email addresses are replaced with placeholders in what is sent to the model.
- Content from web pages, emails and documents read by Tache is treated as untrusted: it cannot trigger an action on your behalf without your approval.
- Sign-in and takeover links expire or are revoked after use.
10. This website
The tache.me website sets no cookies, uses no audience measurement tool and loads no third-party resources: fonts are hosted on the site itself. The hosting provider (Railway) records technical logs (IP address, page requested, browser) for security and to keep the service running, under the Railway terms that apply to the plan in use (log history available: 7 days on Hobby, 30 days on Pro, according to Railway's documentation).
11. Changes
This policy evolves with Tache. Any significant change, in particular adding a provider or switching on long-term memory, will be announced on WhatsApp and, where required, will come with a new request for consent. Version 2026-10-21.3, quoted in the consent message, remains available at /privacy/2026-10-21.3.