Privacy policy

Controller

Bx Labs, SASU

Registered office

9 rue des Colonnes, 75002 Paris, France

Contact

contact@bxlabs.ai

We have not appointed a data protection officer. Requests relating to your data are handled at the address above. The publisher’s full identity is set out in the legal notice.

• No third-party analytics tool, no statistics handed to anyone else: the measurement described in the next section runs on our servers alone.
• No measurement script in the pages: nothing runs in your browser to count your visit.
• No advertising, no advertising tracker.
• No social media button.
• No account, no client area, no newsletter.
• No font, no image and no script loaded from a third-party server: those resources are served by the site itself.
• No automated decision-making, no profiling.
• No cookie set by this site.

These statements are verifiable: a page of this site loads without making a single request to any third-party domain. There is one exception, on one page only: the booking calendar on the home page, described below. The audience measurement adds no request of its own — it happens on our servers, before the page is sent to you.

The home page offers to book a call of 30 minutes. The calendar is provided by Cal.com. It is displayed in a frame embedded in the page and loads with the contact section it sits in: when you visit the home page, your browser therefore connects directly to that service. No other page of this site loads it.

That service receives the technical data any connection involves — IP address, date and time, browser type — and sets a cookie named __cf_bm on its own domain, issued by its infrastructure provider Cloudflare to tell bots from human visitors. That cookie is set by the calendar’s domain, not by this site’s, and we have no access to it.

That cookie is neither advertising nor analytics: the party that issues it describes it as protecting the service against bots. You can nonetheless refuse third-party cookies in your browser — the calendar will then not be displayed, and booking remains possible by email, or from the site of Cal.com.

If you book a slot, the information you enter in the calendar — name, email address, reason for the call — is processed by Cal.com, Inc., acting as a processor, and then reaches us as an invitation and a confirmation email. The details of its own processing are set out in its privacy policy, at cal.com/privacy.

You are never required to go through the calendar. An email to contact@bxlabs.ai reaches the same place, without involving any third party, and no information there is mandatory: withholding it has one consequence, we will not be able to reply to you.

This site counts its visits. It does so with no cookie, no local storage and no script running in your browser: the measurement happens on our servers, at the moment the page is served to you. Nothing is written to or read from your device — which is why article 82 of the French Data Protection Act does not apply to it, and why this site shows no consent banner.

What is recorded

• the page requested, reduced to one of the addresses this site publishes;
• the domain name you came from, when it is passed on — never the full address of the page you came from;
• your country, as the hosting provider infers it;
• your device class: desktop, mobile, tablet or robot;
• a technical fingerprint, described below.

What is never recorded

Your IP address and your browser identifier are read to compute that fingerprint, then vanish with the request: neither is passed on nor kept. The full address you are visiting, the parameters that follow it, the path of the page you came from and any location finer than your country are not recorded either.

The fingerprint, and what it cannot do

So that one person is not counted twice on the same day, your address and your browser are reduced to a fingerprint, through an irreversible computation mixed with a secret value that changes every night. That fingerprint cannot identify you, cannot recognise you the next day, and cannot follow you to another site. It is deleted at most 76 hours after being computed; what remains afterwards is counters, which tell no one apart.

Objecting to it

This site honours the privacy signal your browser can send (Global Privacy Control, or “Do Not Track”). When it is on, your visit is not measured at all: it is not counted separately, it does not exist for the measurement.

What you send us by email

• your identity, as you give it (first name, last name);
• your email address;
• the content of your message: description of the project, context, tools involved, constraints;
• any information you choose to add — company, telephone number, attachments.

What you send by booking a slot

The same categories of information, entered this time in the calendar: identity, email address, reason for the call and the slot chosen, together with the technical connection data described above. It passes through Cal.com, and then reaches us.

What the hosting provider processes

Visiting any website necessarily involves the processing of technical connection data — IP address, date and time of the request, page requested, browser type — by the hosting provider, in order to serve the pages and keep the service secure. Those logs stay with the hosting provider, which sets their retention period according to the criteria set out below; we receive no copy of them and use them for no purpose at all, audience measurement included — the measurement described above reads only your request headers and never keeps your address.

• Answering your request and discussing a project — legitimate interest (article 6.1.f GDPR). The interest pursued is being able to respond to the enquiries addressed to us and to consider working together.
• Preparing and then performing an engagement — performance of a contract or of pre-contractual steps taken at your request (article 6.1.b).
• Meeting our accounting and tax obligations — legal obligation (article 6.1.c).
• Serving the site and keeping it secure — legitimate interest (article 6.1.f), carried out by the hosting provider.
• Measuring the site’s audience — legitimate interest (article 6.1.f). The interest pursued is knowing which pages are actually read, so as to decide what to write next. The processing keeps nothing that could identify you, and you can object to it: see “How audience is measured” and “Your rights”.

No marketing is carried out from this site: no address is collected here in order to be canvassed.

• An exchange that goes no further: at most three years from the last contact coming from you, in line with the CNIL’s reference framework on managing commercial activity.
• An engagement under way: for the whole duration of the relationship, then three years from its end for the commercial exchanges.
• Accounting records and supporting documents: ten years, under article L.123-22 of the French commercial code.
• Audience measurement fingerprint: until the end of the day after next, then removed by a daily purge — at most 76 hours after it was computed. The counters left behind hold no fingerprint and can no longer tell anyone apart; they are kept to follow how the site evolves over time.
• Technical connection logs: kept by the hosting provider, on our behalf, only for as long as is necessary to serve and secure the site, according to the criteria it applies and documents. We receive and keep no copy of them.

Your data is neither sold, rented, assigned nor passed to third parties for advertising purposes. It is accessible to:

• Bx Labs, in order to handle your request;
• our email provider, acting as a processor, in order to route and store the emails;
• the site’s hosting provider, Vercel Inc., acting as a processor, for the technical connection data;
• Cal.com, Inc., acting as a processor, for the bookings made through the home page calendar — and for those alone.
• our own internal tracking tool, for the audience counters described above and nothing else. It is hosted by Convex Inc. on servers located in the European Union (Ireland), and no third party has access to it.

Cal.com, Inc. (2261 Market Street #4382, San Francisco, CA 94114, États-Unis) states that it processes data in the United States and frames transfers outside the European Economic Area through the standard contractual clauses or an adequacy mechanism such as the EU-U.S. Data Privacy Framework.

The site’s hosting provider is established in the United States; its full identity is set out in the legal notice. The resulting transfers outside the European Union are framed by the data processing addendum it publishes, and it states that it complies with the EU-U.S. Data Privacy Framework.

• the right of access to the data concerning you;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to object, for processing based on our legitimate interest. For the audience measurement, that right is exercised without writing to us: turn on your browser’s privacy signal (Global Privacy Control or “Do Not Track”), which this site honours;
• the right to data portability, for the data you provided to us under a contract or pre-contractual steps;
• the right to give directions on what happens to your data after your death.

These rights are exercised by email to contact@bxlabs.ai. We reply within one month of receiving the request (article 12.3 GDPR). Where there is reasonable doubt about the identity of the person making the request, we may ask for proof of identity.

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the French supervisory authority.

Authority

Commission nationale de l’informatique et des libertés (CNIL)

Address

Service des plaintes, 3 place de Fontenoy, 75007 Paris

Complaint online

cnil.fr/fr/plaintes

This site sets no cookie. The only cookie that can reach your browser from these pages is the booking calendar’s, described above: it is set by the domain that provides it, when the home page displays that calendar, and by no other page.

This site does, separately, write a single local storage entry (localStorage), named bxlabs-theme:

• it contains only the value light or dark;
• it is written only if you operate the theme control yourself;
• it is read back when pages load, so that the theme you chose is displayed immediately;
• it contains no identifier, is never transmitted to any server and enables no tracking.

It falls within the user-interface personalisation trackers that the CNIL lists among those not subject to consent under article 82 of the French Data Protection Act. It therefore requires no consent.

This site displays no consent banner, and that is not an oversight. Article 82 of the French Data Protection Act governs what is written to or read from your device: the audience measurement described above touches neither, since it runs on our servers, and the settings the site writes itself are interface personalisation, which the CNIL does not subject to consent. The only third-party tracker involved remains the booking calendar’s, described above, which concerns the home page alone. No other page calls any third-party domain.

You can delete this entry at any time by clearing site data in your browser; the site will then follow your system’s light or dark setting again.

The site is served over HTTPS only. The only data it collects itself are the audience counters described above, which hold nothing that could identify you; what you enter in the calendar is processed by the service that provides it, under its own technical responsibility. Email exchanges remain subject to the limits of that channel: an ordinary email is not end-to-end encrypted. We suggest you do not include sensitive information in one; tell us instead that a secure channel is needed.

This policy is updated whenever the processing described here changes — for example if the audience measurement came to keep more than it does, or if another third-party service were added alongside the booking calendar. The date of the last update appears at the top of this page; the applicable version is the one published there.