Legal
Privacy & Data Protection
This policy explains how ARVEC AI uses personal data when you visit our corporate website, contact us about a professional requirement or communicate with our team.
Last updated: 19 October 2026
1. Controller and contact
ARVEC AI, a French société par actions simplifiée (SAS), registered at 1 bis rue du Printemps, 78230 Le Pecq, France, SIREN 131 186 066, is the controller for personal data processed for the purposes described here unless a separate notice states otherwise.
Questions and requests concerning your data can be sent using privacy@arvec.com.
2. When this policy applies
This policy covers the public corporate website and enquiries submitted through its contact form. A client engagement, software platform, hosted application or other dedicated service may be governed by additional contractual privacy and processing terms. Where ARVEC AI processes personal data on a client’s documented instructions, the parties’ contractual allocation of controller and processor responsibilities applies.
3. Categories of personal data
- Information you provide: your name, professional email address, organisation, selected area of interest, optional sector, country or region, type of engagement, your description, expected timing and duration, and other information you choose to send. Please do not submit passwords, confidential client documents, sensitive personal data or regulated production records through the public form.
- Communications: subsequent messages and information needed to manage a professional enquiry or relationship.
- Technical data: IP address, browser and device information and request metadata processed by the network and hosting services that deliver and protect the website, and website usage events (such as page views, clicks and errors) recorded by an analytics script supplied by the hosting platform. Cookies and similar storage are described in our Cookie Policy.
4. Purposes and lawful bases
| Purpose | Lawful basis |
|---|---|
| Responding to an enquiryAssessing your request and discussing potential services. | Legitimate interests (Art. 6(1)(f)) in responding to professional enquiries made on behalf of organisations. |
| Managing professional relationshipsMaintaining relevant correspondence with prospective and existing business contacts. | Legitimate interests (Art. 6(1)(f)) in managing business relationships. |
| Operating and securing the websiteDelivering pages, diagnosing failures, detecting abusive activity and maintaining service integrity. | Legitimate interests (Art. 6(1)(f)) in a secure, functioning website. |
| Compliance and disputesLegal, accounting, tax and record-keeping requirements; establishing or defending legal claims. | Legal obligation (Art. 6(1)(c)) where applicable, otherwise legitimate interests (Art. 6(1)(f)). |
Submitting a business enquiry does not constitute consent to unrelated marketing.
5. Required and optional information
The contact form identifies mandatory fields needed to understand and reply to your request. If you do not provide these fields, we may be unable to respond. Other information is optional. You should provide only what is relevant and lawful to share.
6. Recipients and service providers
Access is limited to authorised ARVEC AI personnel and to service providers who need information to operate the website, protect it and store enquiries, under appropriate contractual, confidentiality and security arrangements.
- Lovable Labs Incorporated (United States): website hosting and application platform, including the managed database that stores contact enquiries.
- Supabase, through Lovable Cloud: database service for contact enquiries, running on Amazon Web Services in Frankfurt, Germany.
- Cloudflare, Inc.: content delivery and protection of the website against automated abuse.
- Microsoft Ireland Operations Limited (Microsoft 365): business email used to receive and reply to enquiries, including legal@arvec.com and privacy@arvec.com.
We do not sell contact-form information to data brokers or advertisers, and we do not publish enquiry information to other website visitors.
7. Hosting location and international transfers
Enquiries submitted through the contact form are stored in a database located in Frankfurt, Germany (Amazon Web Services, eu-central-1). Our hosting provider, Lovable Labs Incorporated, is established in the United States, Cloudflare operates a global network, and Microsoft may process email data outside the EEA for some services, so personal data may be accessed or processed outside the European Economic Area. Lovable’s data processing agreement provides for the European Commission’s standard contractual clauses (Decision 2021/914) for such transfers, and Microsoft’s data protection terms for Microsoft 365 include equivalent safeguards.
Where processing involves an international transfer subject to Chapter V of the GDPR, ARVEC AI assesses the applicable mechanism and safeguards, such as an adequacy decision or approved standard contractual clauses. Details of relevant safeguards can be requested using privacy@arvec.com.
8. Retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, subject to legal requirements. Enquiries that do not lead to an active commercial relationship are normally retained for 12 months after the last substantive interaction, unless earlier deletion is appropriate or a longer period is justified for legal claims. Contractual, invoicing and statutory records may be retained for applicable legal periods.
Technical and security logs held by our hosting and delivery providers are kept for the limited periods those providers set to operate and secure the service. Database backups follow the provider’s rolling backup cycle, so deleted enquiries also leave backups when that cycle completes.
Access is limited during retention, and data is deleted or anonymised when no longer required.
9. Security
We use organisational and technical measures appropriate to the data and risks involved, including access controls, encrypted transport and restricted database permissions. No internet service can guarantee absolute security. Please do not send confidential information through the public form; contact us first to agree a suitable secure exchange method.
10. Your rights
Subject to applicable law, you may request access to your personal data, rectification, erasure, restriction, portability where applicable, and object to processing based on legitimate interests. Where consent is the basis for particular processing, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
You may exercise your rights using privacy@arvec.com. We may ask for information reasonably necessary to verify your identity, and we respond within the deadlines required by law.
You may also complain to the Commission nationale de l’informatique et des libertés (CNIL): www.cnil.fr.
11. Automated decisions and profiling
The public contact form is not used to make decisions producing legal or similarly significant effects solely through automated processing. AI methods described elsewhere on this website are examples of ARVEC AI’s professional expertise and do not mean that visitors’ personal data is used to train models or to make automated decisions about them.
12. Children and sensitive submissions
This website is intended for professional audiences and is not directed at children. Please do not submit special-category personal data, personal financial records, identity documents or client-confidential content through the enquiry form.
13. Other websites and changes
Third-party links are governed by the privacy notices of their respective operators. We may update this policy when our practices or legal requirements change, and material changes will be communicated where appropriate.