Privacy policy

This policy explains which personal data Tilavo processes, why, for how long, and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

1. Two distinct roles

Controller. [To be completed: company name] is the controller for processing relating to its own customers (subscribing companies) and to visitors of this website: account management, billing, support, contact form.

Processor. When a customer company's assistant talks with visitors to its website, Tilavo processes that data on behalf of and on the instructions of that company, which is the controller. A data processing agreement (Article 28 GDPR) governs this relationship.

2. Data processed

• Account: first name, last name, email address, password (stored encrypted), company, industry, website, optional business phone.
• Billing: subscribed plan, payment history and invoices. Card details are processed only by Stripe.
• Contact: name, email address, company and message sent through the form.
• On behalf of customer companies: conversations with their assistant, contact details left by their visitors, appointment requests.
• Technical data: security logs and cookies strictly necessary for logging in.

Tilavo does not request sensitive data (health, opinions, bank details, social security number). The assistant is configured not to ask for it.

3. Purposes and legal bases

• Providing the service and managing your account: performance of the contract.
• Invoicing and meeting our accounting obligations: legal obligation.
• Answering your contact requests: legitimate interest.
• Securing the service and preventing abuse: legitimate interest.
• Measuring the effectiveness of our communication (source of sign-ups): legitimate interest.

4. Artificial intelligence

The assistant's answers are generated by an artificial intelligence provider acting as Tilavo's subprocessor. Tilavo does not use your data or your visitors' data to train artificial intelligence models.

5. Retention periods

• Account data: for the duration of the subscription, then deleted or anonymised within 3 years after the end of the relationship.
• Invoices: 10 years, in accordance with the French Commercial Code.
• Customer companies' conversations and leads: for the period set by the company, and deleted at the end of the subscription.
• Contact requests: 3 years from the last exchange.
• Security logs: 12 months maximum.

6. Recipients and subprocessors

Your data is never sold. It is accessible to authorised Tilavo staff and to the following subprocessors:

• Vercel Inc.: Application hosting (United States and European Union).
• Supabase Inc.: Database, authentication and file storage (Region chosen at setup).
• OpenAI, L.L.C.: Generating the assistant's answers and searching documents (artificial intelligence) (United States).
• Anthropic PBC: Generating the assistant's answers (alternative provider) (United States).
• Stripe Payments Europe Ltd: Subscription payments and invoicing (European Union and United States).
• Resend Inc.: Sending transactional emails and notifications (United States).
• Twilio Ireland Limited: Receiving calls, speech synthesis and recognition, recap text messages (Jarvis Phone, only when enabled) (European Union and United States).

When data is transferred outside the European Union, these transfers are covered by the safeguards provided by the GDPR (adequacy decision or standard contractual clauses of the European Commission).

7. Security

Each company's data is strictly isolated from the others. Communications are encrypted, and access is logged and limited to authorised people.

8. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, as well as the right to set instructions regarding your data after your death. To exercise them, write to lenny.villarouge@gmail.com, or use the request form on the French version of this page. If you talked with a customer company's assistant, please contact that company first; we will help it answer your request.

You may also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

9. Cookies

Tilavo only uses cookies that are strictly necessary for the service (keeping you logged in, remembering your language). No advertising or audience measurement cookie is set, so no consent is required.

When you arrive through a campaign or referral link, its source (link parameters, originating site) is kept in your browser tab, without a cookie, and then saved with your account if you sign up, so that we can measure the effectiveness of our communication.