Privacy Policy

Last updated: February 19, 2026

1. Data Controller

Lovlett SAS ("the Company") is the data controller for personal data collected through the Lovlett platform ("the Service"). For any data-related inquiries, contact us at: privacy@lovlett.app

2. Data We Collect

We collect minimal personal data necessary to provide the Service:

  • Account data: Name, email address
  • Usage data: Pages visited, features used, timestamps (anonymized analytics)
  • Content data: Files you upload, comments you leave (stored to provide the Service)
  • Technical data: IP address, browser type, device type (for security and debugging)

We do not collect sensitive personal data. We do not sell your data to third parties.

3. Legal Basis for Processing

We process your personal data based on:

  • Contract performance: Processing necessary to provide the Service you signed up for (account management, file hosting, collaboration features)
  • Legitimate interest: Processing necessary for security monitoring, fraud prevention, product improvement, and customer support
  • Consent: For optional communications such as marketing emails (you can opt out at any time)

4. Data Processors

We use the following third-party processors to operate the Service:

  • Supabase (Supabase Inc.): Database hosting, authentication, file storage — servers in EU
  • Vercel (Vercel Inc.): Application hosting and CDN
  • Stripe (Stripe Inc.): Payment processing (when paid plans launch) — PCI DSS compliant
  • Resend (Resend Inc.): Transactional email delivery

All processors are contractually bound to process data only on our instructions and in compliance with applicable data protection laws.

5. Data Retention

  • Account data: Retained for the duration of your account. Deleted within 30 days of account deletion.
  • Uploaded files: Retained for the duration of the project. Deleted when you delete the project or your account.
  • Comments and feedback: Retained with the associated project. Deleted with the project.
  • Usage analytics: Anonymized data retained for up to 24 months for product improvement.
  • Billing data: Retained for the legally required period (typically 10 years under French law) for tax and accounting purposes.

6. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Request correction of inaccurate data
  • Erasure: Request deletion of your data ("right to be forgotten")
  • Portability: Request your data in a structured, machine-readable format
  • Restriction: Request that we limit processing of your data
  • Objection: Object to processing based on legitimate interest
  • Withdraw consent: Withdraw consent for optional processing at any time

To exercise any of these rights, email us at: privacy@lovlett.app. We will respond within 30 days as required by law.

7. Security Measures

We implement industry-standard security measures to protect your data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews. While we strive to protect your data, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Cookies

We use essential cookies required for the Service to function (authentication, session management). We do not use advertising or tracking cookies. Analytics data is collected in anonymized form.

9. International Data Transfers

Some of our processors may transfer data outside the European Economic Area (EEA). In such cases, we ensure adequate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

10. Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. The "Last updated" date at the top indicates when this policy was last revised.

12. Contact & Supervisory Authority

For any privacy-related questions: privacy@lovlett.app

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the French data protection authority (CNIL): www.cnil.fr