Privacy Policy

The controller for the personal data collected on the valrylabs.com website is:

• VALRY LABS (Studio (en cours d'immatriculation), share capital Non applicable (entité en cours de constitution))
• Registered office: Paris, Paris (75000), France
• Email: hello@valrylabs.com
• DPO / GDPR contact: privacy@valrylabs.com

The website collects the following categories of data:

• Navigation data: pages visited, duration, traffic source, device type, browser (via Plausible, privacy-first analytics, no cookies, no cross-site tracking).
• Contact form data: name, professional email, company, service of interest, budget, message, consent (processed only to respond to the request).
• Newsletter data: email (on explicit consent, one-click unsubscribe).
• Technical data: error and security logs (no PII, anonymised IP, strictly necessary session cookies).

In accordance with Article 6 of the GDPR, the processing is based on the following lawful bases:

• Legitimate interest (art. 6.1.f): aggregate traffic analytics, site security, error logging.
• Consent (art. 6.1.a): newsletter, non-essential cookies (via a CMP banner when applicable).
• Performance of a contract or pre-contractual measures (art. 6.1.b): contact form (to answer a commercial request).
• Legal obligation (art. 6.1.c): retention of connection logs (1 year, anonymised IP), fraud prevention.

• Respond to contact and quote requests.
• Send the newsletter (on explicit subscription).
• Measure traffic and improve the site (Plausible, privacy-first).
• Secure the site against attacks (rate limiting, anomaly detection).
• Comply with legal obligations (log retention).

• Contact data (form): 3 years after last contact, or until consent is withdrawn.
• Newsletter: until unsubscribe (one click in every email).
• Connection logs: 12 months (under article 1.II.2° of French decree 2021-1363).
• Client data (post-contract): 10 years for accounting obligations, 5 years for the contract and proof thereof.
• Job applications: maximum 2 years (French Labour Code).

The data is accessible to:

• Authorised VALRY LABS staff (sales, technical), under a confidentiality undertaking.
• Technical sub-processors: hosting (OVHcloud), analytics (Plausible, aggregated data without PII), email (Resend), error monitoring (Sentry, anonymised data).
• Authorities, on legal requisition.

No data is sold or transferred to third parties for commercial purposes. No transfer outside the EU/EEA is carried out without appropriate safeguards (standard contractual clauses, adequacy decisions).

You have the following rights over your data:

• Right of access (art. 15): obtain a copy of your data.
• Right to rectification (art. 16): correct inaccurate data.
• Right to erasure (art. 17): request deletion, subject to legal obligations.
• Right to restriction (art. 18): temporarily freeze processing.
• Right to data portability (art. 20): receive your data in a structured format.
• Right to object (art. 21): for legitimate reasons, or for direct marketing.
• Right to withdraw your consent at any time, without affecting the lawfulness of past processing.
• Right to lodge a complaint with the CNIL (www.cnil.fr/fr/plaintes).

To exercise these rights, write to privacy@valrylabs.com with proof of identity. Response within 1 month (GDPR deadline), extended to 3 months for complex requests.

VALRY LABS implements the technical and organisational measures appropriate under Article 32 of the GDPR: TLS encryption in transit, encryption at rest, access segmentation, MFA, logging, encrypted backups, security audits, incident response plan, team training.

The use of cookies is described in our cookies policy.

The website is not intended for persons under 15 and does not knowingly collect data relating to them. If you believe a minor has provided data, please contact us so it can be deleted.

This policy may be amended. The date at the top of the document is updated on every change. Material changes are notified by email to newsletter subscribers.