Privacy policy

Controller

Bx Labs, SASU

Registered office

9 rue des Colonnes, 75002 Paris, France

Contact

contact@bxlabs.ai

We have not appointed a data protection officer. Requests relating to your data are handled at the address above. The publisher’s full identity is set out in the legal notice.

We distinguish server-side visit counts, consent-based browsing statistics and booking requests recorded in our internal CRM.

• No advertising and no advertising trackers.
• No social-network buttons.
• No account or client area.
• Fonts and images are served by this site.
• No automated decisions producing legal effects.
• Google Analytics and the Cal.com calendar load only after permission for their respective purposes.

The home page offers a Cal.com booking calendar. It loads only after permission in the banner or through “Show the calendar”. No other page loads it. The direct link to Cal.com and email contact remain available without this permission.

Once allowed, Cal.com receives your IP address, the date, time and browser type, and sets a cookie on its own domain, named __cf_bm. Its infrastructure provider Cloudflare uses this cookie to distinguish bots from visitors. We have no access to it.

When a booking is confirmed, Cal.com sends us your name, email address, phone number if supplied, booking identifier and creation date. These create or update your contact record in Bx Labs OS, our internal CRM, and record a meeting conversion. Repeated delivery does not create duplicates. Booking does not subscribe you to marketing messages.

When available, campaign tags and the referring domain accompany the booking to help us understand how people contact us. Without permission to remember attribution, only information from the current navigation is relayed in links. An absent source remains unknown. Global Privacy Control and Do Not Track disable attribution.

Cal.com, Inc. processes the booking and the details supplied to arrange it. Its processing is described at cal.com/privacy. You can also email contact@bxlabs.ai.

This site counts its visits. It does so with no cookie, no local storage and no script running in your browser: the measurement happens on our servers, at the moment the page is served to you. Nothing is written to or read from your device — which is why article 82 of the French Data Protection Act does not apply to it. This server measurement does not depend on the consent banner, which governs the optional services.

What is recorded

• the page requested, reduced to one of the addresses this site publishes;
• the domain name you came from, when it is passed on — never the full address of the page you came from;
• your country, as the hosting provider infers it;
• your device class: desktop, mobile, tablet or robot;
• a technical fingerprint, described below.

What is never recorded

Your IP address and your browser identifier are read to compute that fingerprint, then vanish with the request: neither is passed on nor kept. The full address you are visiting, the parameters that follow it, the path of the page you came from and any location finer than your country are not recorded either.

The fingerprint, and what it cannot do

So that one person is not counted twice on the same day, your address and your browser are reduced to a fingerprint, through an irreversible computation mixed with a secret value that changes every night. That fingerprint cannot identify you, cannot recognise you the next day, and cannot follow you to another site. It is deleted at most 76 hours after being computed; what remains afterwards is counters, which tell no one apart.

Objecting to it

This site honours the privacy signal your browser can send (Global Privacy Control, or “Do Not Track”). When it is on, your visit is not measured at all: it is not counted separately, it does not exist for the measurement.

What you send us by email

• your identity, as you give it (first name, last name);
• your email address;
• the content of your message: description of the project, context, tools involved, constraints;
• any information you choose to add — company, telephone number, attachments.

What you send by booking a slot

The same categories of information, entered this time in the calendar: identity, email address, reason for the call and the slot chosen, together with the technical connection data described above. It passes through Cal.com, and then reaches us.

What you send us by subscribing to the weekly letter

The “weekly” page offers a letter sent every Monday. You subscribe by writing to us: the only data processed for that purpose is the email address you write from, together with the name your mail client passes on, if any. It is used to send you the letter and for nothing else: never sold, never passed to an advertising third party. The mailing list lives in our own mailbox, with no third-party sending service involved. You can ask to be taken off it by simply replying to any issue.

What the hosting provider processes

Visiting any website necessarily involves the processing of technical connection data — IP address, date and time of the request, page requested, browser type — by the hosting provider, in order to serve the pages and keep the service secure. Those logs stay with the hosting provider, which sets their retention period according to the criteria set out below; we receive no copy of them and use them for no purpose at all, audience measurement included — the measurement described above reads only your request headers and never keeps your address.

• Answering your request, recording your booking and its source in our CRM, and discussing a project — legitimate interest (article 6.1.f GDPR). The interest pursued is being able to respond to the enquiries addressed to us and to consider working together.
• Preparing and then performing an engagement — performance of a contract or of pre-contractual steps taken at your request (article 6.1.b).
• Meeting our accounting and tax obligations — legal obligation (article 6.1.c).
• Serving the site and keeping it secure — legitimate interest (article 6.1.f), carried out by the hosting provider.
• Measuring the site’s audience — legitimate interest (article 6.1.f). The interest pursued is knowing which pages are actually read, so as to decide what to write next. The processing keeps nothing that could identify you, and you can object to it: see “How audience is measured” and “Your rights”.
• Sending the weekly letter — consent (article 6.1.a GDPR), given by writing to us to subscribe. You can withdraw it at any time by replying to any issue, without affecting the issues already sent.

No marketing is carried out from this site: no address is collected here without its owner knowing, and a subscriber’s address is used to send the weekly letter and nothing else.

• An exchange that goes no further: at most three years from the last contact coming from you, in line with the CNIL’s reference framework on managing commercial activity.
• An engagement under way: for the whole duration of the relationship, then three years from its end for the commercial exchanges.
• A weekly letter subscriber’s address: until you withdraw your consent, by replying to any issue — the address is then removed from the mailing list.
• Accounting records and supporting documents: ten years, under article L.123-22 of the French commercial code.
• Audience measurement fingerprint: until the end of the day after next, then removed by a daily purge — at most 76 hours after it was computed. The counters left behind hold no fingerprint and can no longer tell anyone apart; they are kept to follow how the site evolves over time.
• Technical connection logs: kept by the hosting provider, on our behalf, only for as long as is necessary to serve and secure the site, according to the criteria it applies and documents. We receive and keep no copy of them.

Your data is neither sold, rented, assigned nor passed to third parties for advertising purposes. It is accessible to:

• Bx Labs, in order to handle your request;
• our email provider, acting as a processor, in order to route and store the emails;
• the site’s hosting provider, Vercel Inc., acting as a processor, for the technical connection data;
• Cal.com, Inc., acting as a processor, for the bookings made through the home page calendar — and for those alone.
• our own internal tracking tool, for the audience counters and booking contact records described above. It is hosted by Convex Inc. on servers located in the European Union (Ireland), and no third party has access to it.

Cal.com, Inc. (2261 Market Street #4382, San Francisco, CA 94114, États-Unis) states that it processes data in the United States and frames transfers outside the European Economic Area through the standard contractual clauses or an adequacy mechanism such as the EU-U.S. Data Privacy Framework.

The site’s hosting provider is established in the United States; its full identity is set out in the legal notice. The resulting transfers outside the European Union are framed by the data processing addendum it publishes, and it states that it complies with the EU-U.S. Data Privacy Framework.

• the right of access to the data concerning you;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to object, for processing based on our legitimate interest. For the audience measurement, that right is exercised without writing to us: turn on your browser’s privacy signal (Global Privacy Control or “Do Not Track”), which this site honours;
• the right to data portability, for the data you provided to us under a contract or pre-contractual steps;
• the right to give directions on what happens to your data after your death.

These rights are exercised by email to contact@bxlabs.ai. We reply within one month of receiving the request (article 12.3 GDPR). Where there is reasonable doubt about the identity of the person making the request, we may ask for proof of identity.

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the French supervisory authority.

Authority

Commission nationale de l’informatique et des libertés (CNIL)

Address

Service des plaintes, 3 place de Fontenoy, 75007 Paris

Complaint online

cnil.fr/fr/plaintes

The banner lets you reject, accept or separately choose Google Analytics, attribution memory and the Cal.com calendar. Optional services do not load before permission. “Manage cookies” in the footer lets you withdraw it at any time.

This site does, separately, write a single local storage entry (localStorage), named bxlabs-theme:

• it contains only the value light or dark;
• it is written only if you operate the theme control yourself;
• it is read back when pages load, so that the theme you chose is displayed immediately;
• it contains no identifier, is never transmitted to any server and enables no tracking.

It falls within the user-interface personalisation trackers that the CNIL lists among those not subject to consent under article 82 of the French Data Protection Act. It therefore requires no consent.

The bxlabs_consent cookie stores your choices for 180 days. With your permission, bxlabs_attribution remembers the latest known source for 30 days: campaign tags, landing-page path and referring domain. It contains no email address or advertising identifier. Withdrawal deletes it. Without permission, no attribution cookie is read or written.

You can delete this entry at any time by clearing site data in your browser; the site will then follow your system’s light or dark setting again.

Google Analytics measures page views and browsing journeys only with consent (GDPR article 6.1.a). The _ga and _ga_* cookies last at most 390 days, without automatic renewal. Advertising features and Google Signals are disabled. Names, email addresses, booking data and advertising identifiers are not sent to Google. Withdrawal stops collection and deletes these cookies.

Google Ireland Limited provides this service; processing outside the EU may occur under its data processing terms. Google statistics remain separate from our server counts: they cover consenting visitors only.

The site is served over HTTPS only. Booking notifications are authenticated by signature before any CRM write. Contact details and their source are accessible only to people authorized to handle the request. Email exchanges remain subject to the limits of that channel: an ordinary email is not end-to-end encrypted. We suggest you do not include sensitive information in one; tell us instead that a secure channel is needed.

This policy is updated whenever the processing described here changes — for example if the audience measurement came to keep more than it does, or if another third-party service were added alongside the booking calendar. The date of the last update appears at the top of this page; the applicable version is the one published there.