Privacy policy

Who is responsible for your data?

The data controller is BY 9 AGENCY, SASU, SIREN 989 597 950, RCS Lorient, 9 rue Flora Tristan, 56100 Lorient, France. For any question about your data: contact@by9agency.com.

What happens when you contact us?

The site has no active form. Contact buttons open your email app (address contact@by9agency.com) or your phone (+33 7 66 51 71 81). Nothing is sent or stored by the site itself.

If you email or call us, we receive the information you choose to share, for example your name, email address or phone number and the content of your message. Purpose: replying to your business inquiry.

Legal basis: as a rule, our legitimate interest in replying to business inquiries, including when you write on behalf of your employer. If you contact us in your own name with a view to entering into a contract with BY 9 yourself, the legal basis is pre-contractual steps taken at your request.

Emails are handled in BY 9’s mailbox: [À COMPLÉTER : mailbox provider for contact@by9agency.com and processing location]. They are reviewed manually and deleted no later than 12 months after the last meaningful exchange if no customer relationship follows, unless the law requires keeping them or a dispute is ongoing. The mailbox does not delete anything automatically.

What does the example in the Demo section do?

The triage example is a local simulation with fictional data. It runs entirely in your browser with fixed rules: no AI model is called, no data leaves the page, nothing is stored and no action is taken in any tool.

Which features are suspended?

The contact form and the voice demo assistant are temporarily turned off: the site no longer offers them and refuses the corresponding requests. These features collect no new data.

Data collected while they were active remains subject to the automatic deletions already in place: contact requests are erased from the database (Lovable Cloud, Europe region, Ireland) 90 to 91 days after submission, anti-abuse IP fingerprints 48 to 49 hours after creation, and demo session data 24 to 25 hours after the session expires. Tasks and appointments created in the Todoist and Google demo accounts are reviewed and deleted manually every month, and on request.

Which cookies and technical logs does the site use?

In its showcase version, the site itself sets no cookies. The host’s visitor analytics and AI app context features were turned off on October 10, 2026. Fonts are served with the site.

Your theme choice is saved in your browser’s local storage (key by9-theme) and never leaves your device.

Like any host, Lovable and its infrastructure providers process technical and security logs (for example IP address and request details) under their published policy (https://lovable.dev/privacy). Retention of these logs: [À COMPLÉTER : host technical log retention].

Who receives your data and where is it processed?

BY 9 AGENCY reads the messages you send it. Site host: Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, United States. Hosting may involve processing outside the European Economic Area, including in the United States. Lovable publishes its subprocessor list (https://trust.lovable.dev/subprocessors). BY 9 AGENCY does not sell your data.

Transfer safeguards applicable to BY 9’s contract: [À COMPLÉTER : confirmation of the Lovable data processing agreement for BY 9’s plan and related transfer safeguards]. For data collected while the demo was active: Google data processing terms for the demo calendar: [À COMPLÉTER : confirmation of the Google Workspace data processing terms]; retention at AI providers: [À COMPLÉTER : OpenAI and Google retention via Lovable].

What are your rights?

You can ask to access, correct or erase your data, or to restrict its processing. For processing based on our legitimate interest, you can object to it on grounds relating to your situation. Data portability applies to data processed as part of pre-contractual steps. Write to contact@by9agency.com.

We reply within one month. This can be extended by two months in the cases set out in the GDPR, and we will tell you so within the first month. We ask for proof of identity only when we have reasonable doubt.

You can lodge a complaint with the CNIL, the French data protection authority: https://www.cnil.fr/fr/plaintes.

Which sources does this text rely on?

Service-Public guidance (https://entreprendre.service-public.gouv.fr/vosdroits/F37351), CNIL examples (https://www.cnil.fr/fr/exemples-de-formulaire-de-collecte-de-donnees-caractere-personnel), the Lovable privacy policy (https://lovable.dev/privacy), the Lovable subprocessor list (https://trust.lovable.dev/subprocessors) and the Todoist privacy policy (https://www.todoist.com/privacy), consulted on October 10, 2026.