Data protection & cookies policy
eldo wallet developer space (developers.eldowallet.fr). Last updated: October 13, 2026.
Welcome to the eldo wallet developer space.
eldo wallet attaches great importance to respecting the privacy of the users of its developer space, available at developers.eldowallet.fr (hereinafter the "Users" or "You").
The purpose of this personal data protection policy (personal data being hereinafter referred to as the "Data") is to inform You about how we collect, use and disclose the Data You may provide to us through the developer space: test access requests, newsletter, email sign-in and developer account, demo passes, technical support requests, public roadmap, AI assistant and audience measurement. It supplements the data protection & cookies policy of eldowallet.fr, which applies to the main website and to the eldo wallet SaaS Services Platform. eldo wallet's legal notice is available on eldowallet.fr.
We invite You to read this policy carefully before using or providing information through the developer space. The Data You provide is processed, automatically or otherwise, within the meaning of French law no. 78-17 of January 6, 1978 on information technology, data files and civil liberties, as amended (hereinafter the "French Data Protection Act") and of the General Data Protection Regulation [(EU) 2016/679 of April 27, 2016] (hereinafter the "GDPR").
The developer space contains links to websites and services operated by third parties (for example linkedin.com/company/EldoWallet, or the CNIL website). The information practices of those services are governed by their own personal data and cookies policies. eldo wallet is not responsible for their practices.
At a glance
| Processing | Data | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Test access request | Work email, first name, last name, company, role, use cases, language, consent date | Create your test account, send you your API token and sign-in link, follow up with you | Performance of your request; legitimate interest (B2B prospecting), with a consent checkbox | 3 years after the last contact |
| Developer newsletter | Email, language, consent history | Send you API news, once a month | Consent (double opt-in) | Until you unsubscribe |
| Integrations waitlist | Email, integrations wanted, language, consent date | Tell you when integration guides are published | Consent | 3 years after your last sign-up, or until you unsubscribe |
| Demo passes | First name, last name, email and what you enter in the demo (including, if you provide it, your date of birth) | Send you a real demo pass (loyalty or membership card, coupon, ticket, transit pass, boarding pass, booking) | Consent | 90 days |
| Technical support requests | Email, issue type, subject, description, related request, page, language, consent date, our team's answer | Handle your request and answer you | Performance of your request, with a consent checkbox | 3 years after the request was last updated |
| Sign-in and developer account | Email, consent date, session | Sign you in without a password (developer account, roadmap, AI assistant, demos, support) | Performance of your request | Until your account is deleted |
| Public roadmap | Votes, submitted ideas | Record your vote or idea, keep you informed of progress | Consent | Until your account is deleted |
| "Ask AI" assistant | Conversations (questions and answers), usage counters | Answer your questions, give you access to your history, improve the documentation, sales follow-up, prevent abuse, manage the monthly quota | Consent; legitimate interest (service improvement, sales follow-up, abuse prevention) | Conversations: 90 days; counters: 13 months |
| Audience measurement (Google Analytics 4) | Cookie identifier, page views, usage events, technical information | Improve the documentation | Consent, only after "Accept" | Choice and cookies: 13 months; data: 14 months maximum |
| Form protection | Hashes of the IP address and email, Cloudflare Turnstile check | Prevent automated submissions and abuse | Legitimate interest | 2 days |
Who is the data controller?
The Data is collected by eldo wallet, BESTWALLET (a French simplified joint-stock company, société par actions simplifiée, with its registered office at 9 rue des Merisiers, 68920 Wettolsheim, France, registered with the Colmar Trade and Companies Register under number 901 283 382, hereinafter "eldo wallet"), publisher of the developer space, the website and the Platform, acting as data controller in accordance with the French Data Protection Act and the GDPR.
eldo wallet has appointed a Data Protection Officer, who can be reached at: moni@orgazone.fr.
The Data is used for the purposes described below. Each form tells You which fields are mandatory. If You do not fill in those mandatory fields, we will not be able to process Your request.
Test access request
The "Request access" form (available on the documentation pages and on the /access page) gives You instant, free access to the eldo wallet test environment.
| Data collected | Work email address, first name, last name, company, role, intended use cases, preferred programming language, site language, and the date on which You ticked the consent box. We also record the status of the request, the identifier of the test account created and the number of requests made with the same address. |
| Purposes | Create Your account on the eldo wallet test environment (a test user and wallet, with Your email address as identifier and Your company name); email You Your test API token, the test environment URL and a sign-in link to the developer space; commercial follow-up of Your request (B2B prospecting). |
| Legal basis | Creating the access and sending the email respond to Your request. Commercial follow-up is based on eldo wallet's legitimate interest in developing its relationships with professionals, and You expressly accept it by ticking the box "I agree that eldo wallet uses this information to create my access and to contact me." |
| Recipients | eldo wallet's sales, product and technical teams, who receive a summary of each request. |
| Retention period | 3 years from the last contact, in line with the CNIL recommendations for business prospects, then deletion or anonymization. |
Only work email addresses are accepted. Your API token is never displayed in the browser nor stored in our database or logs: it is only sent to You by email. It is valid for 365 days. If You submit a new request with the same address, no new account is created and a new token is sent to You.
The form also creates Your developer space sign-in account (see Developer space sign-in).
Developer newsletter
The band at the bottom of every page lets You subscribe to the eldo wallet Developers newsletter (API news, once a month).
| Data collected | Email address, language, subscription status and the history of Your consent: date You ticked the box, confirmation date, and unsubscription date where applicable. |
| Purpose | Inform You by email of news about the API and the developer space. |
| Legal basis | Consent. |
| Retention period | Until You unsubscribe. Subscriptions that are never confirmed are deleted after 30 days. |
Subscription uses double opt-in: You receive a confirmation email whose link is valid for 7 days, and You are only subscribed once You have clicked it. You can unsubscribe at any time using the "unsubscribe" link included in every email. After You unsubscribe, Your address is no longer used to send the newsletter; we only keep the history of Your consent in order to respect Your choice and to be able to prove the consent obtained, within the limits prescribed by law.
Integrations waitlist
The Integrations page lets You be notified when the guides for the integrations You are interested in are published.
| Data collected | Email address, integrations chosen (and, where applicable, the name of another tool), language, consent date, number of sign-ups, date You were notified. |
| Purpose | Inform You by email when the integration guides You asked for are published. |
| Legal basis | Consent. |
| Retention period | 3 years after Your last sign-up, or until You unsubscribe. Every email contains a link to delete Your address. |
Demo passes
The "Your first loyalty card" section of the home page and the Demo page send You a real pass (loyalty card, membership card for a sector — gym, association, garage, health insurer, employee badge, sports club, store —, coupon, event or cinema ticket, transit pass, boarding pass or hotel booking), from demo wallets in the test environment branded with fictional brands, to the email address of Your account only (sign-in required).
| Data collected | First name, last name, the email address of Your account and what You enter in the demo: points, date of birth (optional) and source (home page loyalty card); sector, club, association, organisation or company, points or balance (membership card); value, code and date (coupon); entrance and category, or screen, row and seat (ticket); route, dates, times, seat, platform, trip or flight number (transit); dates, room and perks (hotel). The member number (or fictitious registration plate) and the barcode are generated at random. The pass created is kept in the demo wallet; the date of Your consent is stored with Your account. |
| Purpose | Send You the demo pass and let You add it to Apple Wallet or Google Wallet. |
| Legal basis | Consent. |
| Retention period | 90 days at most after it is sent, then the pass and related data are deleted automatically. A new pass of the same type replaces the previous one. |
Developer space sign-in
The developer account (/account), the public roadmap, the AI assistant, demo passes and support request follow-up require You to sign in. No password is needed: You enter Your email address and receive a sign-in link (or a 6-digit code). The link sent after a test access request also signs You in. The same sign-in is used for all these services.
The My account page shows You the Data we hold about You: profile and status of Your test access (never the API token, which is not kept), use cases, support requests and our answers, newsletter subscription and the dates of Your consents. You can sign out there and ask for a new token, sent by email only.
| Data collected | Email address, date of the consent given at first sign-in (account, roadmap, AI assistant or demo), and a sign-in session kept in Your browser. |
| Purpose | Authenticate You and keep You signed in. |
| Legal basis | Performance of Your sign-in request. |
| Retention period | For as long as necessary to use these services. You can ask for Your account to be deleted at any time: Your votes, ideas, assistant conversations and usage counters are then deleted with it. The session is erased from Your browser when You sign out. |
Technical support requests
The "Report a technical problem" form ("contact support" links in the documentation, footer and My account page) lets You describe a technical problem to our team. Commercial requests (pricing, demo) go through the eldowallet.fr contact form, governed by the eldowallet.fr policy.
| Data collected | Email address (Your account's when You are signed in), issue type, subject, description, related request (optional), page You write from, language, date You ticked the consent box, request status and our team's answer. When You are signed in, the request is linked to Your account. Never include an API token or a password. |
| Purpose | Handle Your request and answer You: in Your account and with a confirmation email when You are signed in, by email otherwise. |
| Legal basis | Performance of Your request; You expressly accept it by ticking the box "I agree that eldo wallet uses this information to handle my request and answer me." |
| Recipients | eldo wallet's technical and support teams, who receive each request by email. |
| Retention period | 3 years after the request was last updated. Deleting Your account also deletes Your requests. |
The form is protected like the others (limited number of submissions, and a Cloudflare Turnstile check when You are not signed in, see Bot and abuse protection).
Public roadmap: votes and ideas
The Roadmap page lets You vote for upcoming features and suggest ideas.
| Data collected | Your votes (feature concerned and date) and the ideas You submit (title, description, language, date), linked to Your sign-in account. |
| Purposes | Record Your vote or idea, and keep You informed of the progress of the feature concerned. Ideas are reviewed by the eldo wallet team and are not published. |
| Legal basis | Consent, collected at sign-in: "I agree that eldo wallet uses my email to confirm my vote and keep me informed of the progress of this feature." Your email is not used for any other marketing purpose without new consent. |
| Retention period | For as long as necessary for these services, and at the latest until Your account is deleted. You can withdraw a vote at any time. |
Only the number of votes for each feature is public: Your identity and Your individual votes are never displayed.
"Ask AI" assistant
The assistant answers Your questions using the eldo wallet documentation only. Its answers are generated by Claude, an artificial intelligence model from Anthropic, and may contain errors.
| Data sent to Anthropic | Your question, the latest messages of the conversation (4 at most), the address of the page You are viewing and the documentation excerpts relevant to the answer. Neither Your email address nor any identifier is sent to Anthropic. |
| Data kept by eldo wallet | Your conversations: each question and the assistant's answer, with its sources, the page You were viewing, the date, language, volume processed and cost; a monthly usage counter per User. They are linked to Your account (email address) and, if You requested test access, to the details of that request (company, role). |
| Purposes | Answer Your questions; let You find and continue Your conversations on all Your devices; improve the documentation and the assistant (unanswered questions, wrong answers); understand Your needs to contact and support You (product and sales follow-up); prevent abuse and manage the monthly usage quota. |
| Legal basis | Consent, collected when You sign in to the assistant, which mentions that conversations are kept and processed by Anthropic; eldo wallet's legitimate interest in improving its service, following up with prospects and customers, and preventing abuse. You can object to sales follow-up at any time (see "Your rights"). |
| Retention period | Conversations: 90 days at most, then automatic deletion. Monthly usage counters: 13 months. You can view and delete Your conversations at any time from the assistant's "History" tab. |
Anthropic acts as eldo wallet's processor. Under its terms applicable to its commercial API, Anthropic does not use this data to train its models and only keeps it for a limited period, for security and abuse prevention purposes. Do not enter personal data, secrets or API tokens in Your questions.
Audience measurement (Google Analytics 4)
With Your consent, we use Google Analytics 4 (Google Ireland Ltd / Google LLC) to measure traffic and the use of the developer space pages and tools, in order to improve the documentation.
| Data collected | Cookie identifier (_ga, _ga_*), page views (including the page language), usage events, technical information (browser, device, approximate country). |
| Events measured | Site searches (search term, 100 characters at most); clicks on "Try it" on an API example; copies of code blocks and of the install command; opening, submission and errors of the access request form; newsletter subscription; questions asked to the AI assistant (language and length only, never the text); roadmap votes and ideas (never the text of the idea). |
| Legal basis | Consent (Article 6.1.a GDPR and Article 82 of the French Data Protection Act). |
| Retention period | Your choice (accept or refuse) and the measurement cookies are kept for 13 months, after which You are asked again. Measurement data is kept for 14 months at most in Google Analytics. |
No Google script is loaded and no data is sent to Google until You click "Accept" in the consent banner. Refusing is as easy as accepting, and ignoring the banner counts as refusing. No advertising data is collected (Google's advertising signals always remain disabled), no personal data (email, name, typed text) is sent in events, and measurement is never matched with Your account.
You can change Your choice at any time with the "Cookie settings" link at the bottom of every page. If You refuse after accepting, measurement is disabled immediately and the _ga cookies are deleted.
Browser storage without consent
The developer space stores a few items in Your browser (localStorage or sessionStorage) that are strictly necessary for the service You request or purely functional. They are used neither for audience measurement nor for advertising, are not shared with third parties, and therefore do not require Your consent.
| Key | Role | Duration |
|---|---|---|
eldo-analytics-consent | Remember Your audience measurement choice, with its date | 13 months |
eldo-session-hint | Know that You are signed in (Your email, use cases and preferred language) without asking the server on every page | Until You sign out |
eldo-just-signed-in (session storage) | Recognize the page opened right after You click the sign-in link | 30 seconds |
eldo-roadmap-pending | Vote or idea waiting while You confirm Your email address, applied automatically when You come back | Deleted once applied, ignored after 24 hours |
eldo-ai-reopen | Reopen the AI assistant panel after You click the sign-in link | Deleted when the panel reopens, ignored after 24 hours |
eldo-ask-ai-chat-v1 (session storage) | Keep Your conversation with the AI assistant when You change page or language | Until You close the tab or sign out |
eldo-demo-card-draft, eldo-demo-pass-draft (session storage) | Keep what You typed in the demos while You sign in by email | Deleted once You are signed in |
eldo-my-use-cases, eldo-preferred-language | Highlight the use cases and APIs relevant to You, and open code samples in Your preferred language | Until You clear them |
eldo.roadmap.view | View selected on the Roadmap page | Until You clear it |
docusaurus.tab.* | Programming language selected in the code example tabs | Until You clear it |
theme-eldo-dev | Selected display mode (light or dark) | Until You clear it |
docusaurus.announcement.dismiss, docusaurus.announcement.id | Stop showing the announcement bar You closed | Until You clear it |
| API explorer settings (session storage) | Selected server, formats and the API token You enter to try the API from the reference | Until the tab is closed |
You can clear this information at any time in Your browser settings (site data).
Bot and abuse protection
To protect the access request and newsletter forms against automated submissions, we limit the number of requests per IP address and per email address. For this purpose we only keep hashes (non-reversible encoded values) of the IP address and email, deleted after 2 days. This measure is based on eldo wallet's legitimate interest in keeping its services secure.
When enabled, the Cloudflare Turnstile service checks that the form is filled in by a person and not a bot. The widget is only loaded once You start filling in a form; it receives Your IP address and technical information about Your browser, processed by Cloudflare for this check only.
How do we use, collect and keep your Data?
The Data collected is used exclusively to provide You with the information and services You request. The Data eldo wallet collects is processed, recorded and stored in accordance with the legal provisions in force.
We only keep your Data for as long as necessary to provide our services or within the limits prescribed by law, according to the periods stated above. At the end of that period, your Data will be deleted. We cannot delete your Data where there is a legal retention obligation, for example under accounting law, or where there is a legal ground to keep the Data, such as an ongoing contractual relationship.
Use of your Data for prospecting purposes
In accordance with applicable regulations, any prospecting by telephone, email, SMS/MMS or fax, and any transfer of Data for prospecting purposes using these means, will only be carried out with your prior consent to receive prospecting and/or to the transfer of your Data.
If You agree to receive such messages by ticking the boxes provided for this purpose on the developer space (test access request, newsletter), You may withdraw this consent at any time under the conditions set out in the section "How to exercise your rights over your Data", and in particular each prospecting email will give You the possibility to object to future messages via the "Unsubscribe" link.
eldo wallet does not sell your Data and does not transfer it to third parties for prospecting purposes.
Security, confidentiality and integrity: how is your Data protected?
eldo wallet's concern is to preserve the quality, security, confidentiality and integrity of your Data. The technical and organizational measures and security policies in place protect your Data. The people who have access to your Data are bound by the strictest confidentiality and respect your privacy. We constantly adapt our security measures to technological progress and developments.
In particular, the tables holding access requests and newsletter subscriptions cannot be accessed from the website or by other Users; confirmation and unsubscribe links are only stored as hashes; Your test API token is never stored by the developer space; and each signed-in User only has access to their own votes and counters.
Who receives your Data?
The Data provided is 100% owned by eldo wallet. Depending on the processing concerned, it is shared with the following recipients: eldo wallet's IT department and product, marketing and sales teams, in order to respond to your requests.
eldo wallet also uses the following processors, which process the Data on its behalf, on its instructions and only to the extent necessary for the service:
| Processor | Service | Data concerned | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting of the developer space server and database (email sign-in, forms, AI assistant, demos) | All Data described in this policy, except audience measurement data | European Union |
| Our email delivery provider (Amazon Web Services – Amazon SES, in Europe) | Sending transactional emails: test access, sign-in links, newsletter confirmation and delivery | Email address, email content | European Union |
| Anthropic | "Ask AI" assistant (Claude model) | Questions, conversation context, address of the page viewed | United States |
| Google Analytics 4 audience measurement, only with Your consent | Cookie identifier, page views, usage events, technical information | European Union and United States | |
| Cloudflare | Bot protection for forms (Turnstile), when enabled | IP address, technical browser information | Cloudflare global network |
The developer space pages are also served by the site's hosting provider, which processes the technical connection data (IP address, browser) needed to display them.
eldo wallet will not transfer your Data to other recipients. eldo wallet will not sell your Data. Your Data will not be disclosed to third parties unless required by applicable law.
Storage location and transfers outside the European Union
The developer space Data is stored in the European Union, on the cloud infrastructure of Amazon Web Services (AWS), in a European region. Test accounts created at Your request are hosted on the eldo wallet test environment, on the cloud infrastructure of its hosting provider Amazon Web Services (AWS).
Some Data may transit and be processed outside the European Union by certain processors, in particular Anthropic (AI assistant) and Google (audience measurement, only with Your consent), companies established in the United States. Any transfer outside the European Union is protected by appropriate legal frameworks, such as the European Commission's adequacy decision on the EU–US Data Privacy Framework for companies that participate in it, or a Data transfer agreement based on the European Commission's standard contractual clauses.
How to exercise your rights over your Data
In accordance with the French Data Protection Act and the GDPR, You may at any time object to the processing of Your Data, access it, have it rectified, or restrict its processing.
You may at any time request the erasure of your Data. You may at any time request the portability of your Data. You may also, at any time, object to the disclosure of your Data to third parties or to its use by the controller for commercial purposes, under the conditions set out above. Where processing is based on Your consent, You may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal. You have the right to give instructions regarding what happens to your Data after your death.
Your request must be sent to: contact@eldowallet.fr. You can also contact our Data Protection Officer: moni@orgazone.fr.
Some actions are also available directly on the developer space:
- Newsletter: "unsubscribe" link in every email;
- Audience measurement: "Cookie settings" link at the bottom of every page;
- Roadmap: clicking a vote again withdraws it;
- Account: the My account page shows the Data linked to Your account and lets You sign out;
- Session: sign out from My account, the roadmap or the AI assistant.
These rights may be limited, for example if You ask us to delete Data that we are required to keep under a legal obligation. You have the right to lodge a complaint with the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL), in particular on its website: www.cnil.fr.
Cookies
Cookies are data stored on a user's terminal equipment and used by the site to send information to the user's browser, allowing that browser to send information back to the originating site (for example a session identifier, a language choice or a date). For the validity period of the cookie concerned, cookies make it possible to keep state information when a browser accesses the various pages of a website or when that browser later returns to that website. Only the issuer of a cookie can read or modify the information it contains.
There are different types of cookies:
- session cookies, which disappear as soon as You leave the site;
- persistent cookies, which remain on your terminal until they expire or until You delete them using your browser's features.
On the developer space, a single cookie is set without consent, because it is strictly necessary for the service You request: devspace_session, Your sign-in session (roadmap, AI assistant, demos, "My account" page). It is only set when You sign in, holds a random identifier that the page's scripts cannot read, and expires 30 days after Your last visit or when You sign out. The only other cookies are the Google Analytics audience measurement cookies (_ga, _ga_*), only if You have accepted it. The other information stored in Your browser is described in the section "Browser storage without consent". Your choice to accept or refuse audience measurement is itself stored in Your browser for 13 months: if You clear it, the consent banner will be shown to You again.
Managing cookies
You can accept or refuse audience measurement at any time with the "Cookie settings" link at the bottom of every page.
You also have several options for deleting cookies. Although most browsers accept cookies by default, You can, if You wish, choose to accept all cookies or to reject them systematically. You can also set your browser to accept or refuse cookies on a case-by-case basis before they are installed. You can also regularly delete cookies from your terminal via your browser. Remember to configure all the browsers on your various devices (tablets, smartphones, computers).
Each browser is configured differently for managing cookies and your choices. This is described in your browser's help menu, which will tell you how to change your cookie preferences (for example for Safari, Chrome, Firefox, Edge or Opera).
Please note, however, that if you set your browser to refuse cookies or local storage, some features of the developer space (sign-in, roadmap, AI assistant) will not be available, for which we cannot be held responsible.
Changes
We may change this personal data protection and cookies policy to allow eldo wallet to comply with new practices and regulations or for other purposes. In that case, we will update the "last updated" date at the top of this policy.