Privacy notice

Who we are

LORNE VALE, trading as Lorne & Vale, is a French SAS registered with the Strasbourg Trade and Companies Register under number 107 702 185. Its registered office is at 30 Chemin des Friches, 67500 Haguenau, France. Privacy contact: contact@lornevale.com.

This website

lornevale.com sets no cookies, uses no analytics and loads no third-party content. Our host keeps technical logs (such as IP addresses and timestamps) to deliver and secure the site, for the period given below. The booking form sends your request to our team by email, through our host Vercel and our email provider Resend (see Service providers), and nothing is stored on the site. Resend keeps a copy of each email for 30 days. If the form cannot send, it opens your own email app with the message ready for you to send. When you write to us, we use your message only to reply and to set up your service, on the basis of the steps you ask us to take before a contract.

Roles on the platform

• For your account and your use of the platform, Lorne & Vale is the data controller.
• For the content your company puts in its workspace (requests, emails, documents and the details of the people involved), your company is the controller. Lorne & Vale processes that content only on its instructions.

If your data is in a customer’s workspace, contact that company first. We will help it answer you.

Data we process

• Account: your name, work email, password (stored only as a hash), company, role, and sign-in and security events. They are used to create and secure your account and to provide the service, under our contract with you.
• Workspace content: requests, messages that reach your request page or inbound address, emails sent on your behalf, documents, approvals and decisions. They are used only to carry out the work your company asks for.
• Billing: when your company subscribes online, the buyer’s name and work email, the company, its billing address and VAT number, the plan chosen and the payments. Card details are entered on the page of our payment provider Stripe and never reach us. They are used to take payment and issue invoices, under our contract and to meet our accounting obligations. Stripe also processes them as a controller for its own legal obligations and fraud prevention, under its own privacy policy.
• Technical data: IP address, browser, timestamps and errors, kept for security and troubleshooting on the basis of our legitimate interest in running a secure service.

The platform only stores what it needs to keep you signed in and to remember your language and display settings. It uses no advertising or analytics cookies, and we do not sell personal data.

Text analysis

To prepare work, text is sent to OpenAI through its API. Direct contact details and detected names are replaced with tokens before the text leaves our systems. Detection can miss a name, so this reduces exposure without making content anonymous. The platform takes no decision with legal or similarly significant effects on you. Commitments require a person’s approval.

Service providers

We rely on a small number of providers, listed with their role and location on the service providers page. Some of them are in the United States. Transfers rely on an adequacy decision, including the EU-US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.

Retention

• Account and workspace data: while your company’s account is open.
• Close the company in its settings and its data is erased from the platform within minutes. If you ask us by email, or when a contract ends, we do it within one week at the latest. Our backups (7 days at most) and our providers’ logs (30 days at most) then expire on their own. All that stays is what the law requires us to keep and the signed record below.
• Raw copies of emails received for your workspace: 30 days after they arrive, or sooner if the account is erased.
• The signed record of actions: 6 years after each entry, including after an account is closed, to establish, exercise or defend legal claims.
• Database backups: 7 days at most.
• Invoices and payment records: 10 years, as French accounting law requires.
• Messages you send us: 3 years after our last exchange, or up to 5 years after the end of a contract they concern.
• Our providers’ logs: 1 hour at our host Vercel on our current plan, 1 day on its Pro plan; up to 30 days for OpenAI’s abuse-monitoring logs and for the copies of emails kept by our email provider Resend.

Your rights

You can ask for access to your data, its correction or deletion, restriction of its processing or its portability, and you can object to processing based on our legitimate interest. Write to contact@lornevale.com: we reply within 24 hours, erase within one week at the latest (within minutes if you close the company in its settings), and act on any other request within one month at the latest. You can also complain to the CNIL (cnil.fr).

Changes

We update this page and its date when our practices change, and tell account holders by email about significant changes. How the data is protected is described on the security page.