Privacy Policy

1. Introduction

AXE CAPITAL SAS (operating the Lovable Web Agency website) treats the protection of your personal data as a priority. This policy explains, in accordance with Regulation (EU) 2016/679 (GDPR) and French Act no. 78-17 of 6 January 1978 as amended, how we collect, use, store, share and protect your data.

2. Data controller

Legal name: AXE CAPITAL (SAS, share capital €3,000)

SIREN: 904 636 222 — RCS Lyon — VAT FR95904636222

Registered office: 14 T Chemin de Champemin, 69390 Vourles, France

Email: bonjour@lovablewebagency.com

Phone: +33 1 89 71 92 27

Data Protection Officer (DPO): not appointed — Axe Capital is not required to appoint a DPO under article 37 GDPR. Data protection requests are handled by the President, Simon Berna, at bonjour@lovablewebagency.com.

3. Data we collect

• Identification data: first name, last name, company name
• Contact data: email, phone, postal address
• Communication data: content of messages sent through forms, email exchanges
• Transaction data: order history, amount, payment method (card details never pass through our servers — see Stripe below)
• Technical data: IP address, browser type, operating system, pages visited, time on page, referral source
• Cookie consent data: timestamp and state of your preferences

4. Purposes and legal bases

5. Retention periods

• Prospect data: 3 years from the last contact
• Client data: duration of the contractual relationship + 3 years (commercial outreach)
• Accounting records and invoices: 10 years (art. L.123-22 French Commercial Code)
• Cookie consent records: 13 months maximum (CNIL recommendation)
• Technical connection logs: 12 months maximum
• Analytics and marketing cookies: 13 months maximum

6. Recipients and processors

Your data may be processed by the following sub-processors, acting solely on our instructions and bound by GDPR-compliant data processing agreements:

• Lovable Labs AB — website hosting and CDN (Sweden — Lovable Cloud)
• Supabase Inc. — PostgreSQL database, authentication, file storage (EU region — Frankfurt)
• Resend Inc. — transactional email delivery (United States, see transfers below)
• Stripe Payments Europe Ltd. — online payment processing (Ireland, PCI-DSS Level 1 certified)
• HubSpot Inc. — CRM and marketing automation (United States, see transfers below)
• Google LLC — only with your consent: Google Analytics and related services (United States)

We never sell or rent your data to third parties.

7. Transfers outside the European Union

All application data (database, authentication, storage) is hosted in the European Union via Lovable Cloud (Supabase infrastructure, EU region — AWS Europe data centres).

Some additional sub-processors (Resend, HubSpot, Google) are established in the United States. Transfers to them are framed by:

• Certification under the EU-US Data Privacy Framework (DPF) for certified processors (notably HubSpot and Google)
• The European Commission's Standard Contractual Clauses (decision 2021/914) for the others
• Additional technical measures (TLS 1.2+ encryption in transit, encryption at rest)

8. Your rights

• Right of access to your data (art. 15 GDPR)
• Right to rectification (art. 16)
• Right to erasure (art. 17, “right to be forgotten”)
• Right to restriction of processing (art. 18)
• Right to data portability (art. 20)
• Right to object to processing (art. 21)
• Right to withdraw consent at any time (art. 7.3)
• Right to give post-mortem instructions (French Data Protection Act)

To exercise your rights: bonjour@lovablewebagency.com (answer within 1 month, extendable by 2 months for complex requests). Proof of identity may be requested in case of reasonable doubt.

9. Security

Technical and organisational measures in place: TLS 1.2+ encryption in transit, encryption at rest with Supabase and Lovable Labs AB, PostgreSQL Row-Level Security (RLS), least-privilege access control, multi-factor authentication on administrator accounts, access logging, daily backups, code reviews and regular audits.

10. Cookies

Three categories of cookies may be set:

• Essential cookies (no consent required): session, security, consent preferences
• Analytics cookies (consent required): aggregated traffic statistics
• Marketing cookies (consent required): ad personalisation, retargeting

You can change your choices at any time: Manage cookie preferences.

11. Complaints to the CNIL

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority (CNIL): www.cnil.fr — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

12. Changes

We may amend this policy at any time to reflect legal, technical or service changes. The date of the last update is shown below. Material changes will be brought to your attention through a banner or by email.