PRIVACY POLICY

Last updated: September 29, 2026

1. INTRODUCTION AND DATA CONTROLLER FOR PERSONAL DATA PROCESSING‌‍

This privacy policy informs you about how LAUYAN SOFTWARE collects, uses, and protects your personal data when you visit the site lauyan.com, purchase one of our software products, or use the online services that our software calls upon. It is established in accordance with the General Data Protection Regulation (GDPR) and Law No. 78-17 of January 6, 1978, known as "Informatique et Libertés".

Data Controller: LAUYAN SOFTWARE, a limited liability company (SARL) with a capital of €7,500, registered with the RCS of Versailles under number 482 806 155, with its registered office located at 16 rue du Général de Gaulle, 78120 Rambouillet, France. Contact: contact@lauyan.com.

As the data controller, LAUYAN SOFTWARE determines the purposes and means of the processing described below. In accordance with Article 5 of the GDPR, your data is processed lawfully, fairly, and transparently, for specified, explicit, and legitimate purposes, and is limited to what is necessary in relation to these purposes.

LAUYAN SOFTWARE has not appointed a dedicated data protection officer. For any questions regarding this policy or the processing of your data, you can contact us at contact@lauyan.com.

2. DEFINITIONS‌‍

2.1 Personal Data

Personal data refers to any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.

2.2 Data Controller

The data controller is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. For the site lauyan.com and the services associated with our software, the data controller is LAUYAN SOFTWARE.

2.3 Processor

A processor is a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the data controller.

2.4 Processing

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

2.5 Consent

Consent of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

2.6 Cookies

Cookies are small text files placed on your device when you visit a website. Those used on lauyan.com are described in section 11 and in our cookie policy.

2.7 General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR) is Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

2.8 Supervisory Authority

A supervisory authority is an independent public authority established by a Member State pursuant to Article 51 of the GDPR. In France, the supervisory authority is the Commission nationale de l'informatique et des libertés (CNIL).

2.9 Personal Data Breach

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

3. DATA COLLECTED‌‍

3.1 Categories of Data Collected

Identification and contact data: name and email address, used for ordering, sending the license key and invoice, activating licenses, and support.
Order data: purchased software, amount, date, order number, and invoice. Payment is made on the payment page hosted by Stripe: we do not receive or store your card numbers or payment identifiers.
License data: license key and technical identifier of the computer on which the software is activated.
Technical data transmitted by the software: software version and operating system (update verification); technical diagnostics attached to support requests.
Content of requests: messages sent to support and texts you submit to the software's artificial intelligence functions.
Audience measurement data: pages viewed, information about the browser and device, collected by Google Analytics only if you have consented.
Security data: IP address and technical logs, especially when using the support form protected by Cloudflare Turnstile.

No user account is created on lauyan.com, and we do not send any newsletters or commercial solicitations.

3.2 Collection Methods

Data is collected directly from you: when placing an order, requesting support, activating a license, using the online functions of our software, and when browsing lauyan.com. Stripe transmits the payment confirmation and associated order information to us.

3.3 Mandatory Nature of Data

The data requested when ordering (name and email address) and activating a license is necessary for the conclusion and execution of the contract: without it, we cannot process the order, send you the license key and invoice, or activate the software. Consent for audience measurement is optional; refusing it does not affect access to the site.

3.4 Data Retention

The retention periods applicable to each category of data are detailed in section 7.

4. PURPOSES OF COLLECTION‌‍

4.1 Provision of Services and Contract Execution

LAUYAN SOFTWARE publishes downloadable desktop software for Windows and macOS. We process your data to manage your orders, send you the license key and invoice, and activate and verify the licenses of our software (email address, name, license key, technical identifier of the computer).

The sites and stores you create with our software are hosted by the host of your choice. LAUYAN SOFTWARE does not operate them and does not access the data they contain or collect.

4.2 Update Verification

Our software queries our servers to check for available updates. This verification transmits the software version and operating system.

4.3 Customer Support and Assistance

To respond to support requests sent from our software or via the support form, we process your identity, email address, message, and technical diagnostics (version, system, identifier). The support form is protected by Cloudflare Turnstile to prevent automated submissions.

4.4 Payment Processing and Accounting

Payments are processed by Stripe. We retain invoices and accounting documents to meet our legal obligations.

4.5 Artificial Intelligence Features

The artificial intelligence functions integrated into our software transmit the texts you submit, via our servers, to OpenAI to produce a response. These texts are processed for the time necessary to provide the response and may appear in security technical logs, retained for 12 months.

4.6 Audience Measurement

If you consent via the cookie banner, we use Google Analytics 4 to establish traffic statistics for lauyan.com.

4.7 Automated Decisions

No decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you is made.

5. LEGAL BASIS FOR PROCESSING‌‍

In accordance with Article 6 of the GDPR, each processing is based on one of the following legal bases.

5.1 Contract Execution

order management;
sending the license key and invoice;
activation and verification of licenses;
support;
artificial intelligence functions integrated into the software.

5.2 Legitimate Interest

Some processing is based on our legitimate interest, respecting your rights and freedoms:

update verification from the software, to ensure you have functional and up-to-date software;
protection of the support form against bots and abuse (Cloudflare Turnstile).

5.3 Legal Obligation

retention of invoices and accounting documents for ten years (Article L123-22 of the Commercial Code);
response to requests from authorized authorities.

5.4 Consent

audience measurement of the lauyan.com site by Google Analytics 4, activated only after your agreement via the cookie banner.

You can withdraw your consent at any time, as easily as you gave it, using the "Manage cookies" link at the bottom of each page of the site. Withdrawal does not affect the lawfulness of processing carried out before it.

6. DATA RECIPIENTS‌‍

Your data is intended for LAUYAN SOFTWARE. It may be communicated to the following recipients, to the extent necessary for their mission.

6.1 Service Providers

OVH SAS (Roubaix, France): site hosting;
Stripe: payment processing;
OpenAI: processing of requests addressed to the software's artificial intelligence functions;
Google: audience measurement (Google Analytics 4), only with your consent;
Cloudflare: anti-bot protection of the support form (Turnstile).

6.2 Legal Authorities

Your data may be communicated to authorized administrative or judicial authorities, upon legal request.

6.3 International Transfers

Some of these recipients are established outside the EEA. These transfers are described in section 10.

7. DATA RETENTION PERIOD‌‍

In accordance with Article 5(1)(e) of the GDPR, your data is retained for no longer than necessary for the purposes for which it is processed:

Customer and prospect data (identification, contact, orders, support requests): 3 years after the last use of the software or the last contact.
License data (email address, name, license key, technical identifier of the computer): 3 years after the last use of the software or the last contact.
Invoices and accounting documents: 10 years, in accordance with Article L123-22 of the Commercial Code.
Audience measurement data: maximum of 13 months.
Security technical logs: 12 months.
Texts submitted to artificial intelligence functions: time necessary for the response; security technical logs: 12 months.

At the end of these periods, the data is deleted or anonymized.

8. RIGHTS OF DATA SUBJECTS‌‍

In accordance with Articles 15 to 22 of the GDPR, you have the following rights regarding your data. You can exercise them by writing to LAUYAN SOFTWARE at contact@lauyan.com.

8.1 Right of Access

You have the right to obtain confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to the personal data and certain information such as the purposes of the processing, the categories of data concerned, and the recipients or categories of recipients to whom the data has been or will be disclosed.

8.2 Right to Rectification

You can request the rectification of inaccurate personal data concerning you. You also have the right to have incomplete data completed, including by providing a supplementary statement.

8.3 Right to Erasure

In certain cases, you have the right to obtain the erasure of your personal data, particularly if the data is no longer necessary for the purposes for which it was collected or processed, or if you withdraw your consent on which the processing is based.

8.4 Right to Restriction of Processing

You can request the restriction of processing of your personal data in certain cases, for example, when you contest the accuracy of the data, for a period enabling the data controller to verify the accuracy of the data.

8.5 Right to Data Portability

You have the right to receive the personal data concerning you that you have provided to us, in a structured, commonly used, and machine-readable format, and to transmit those data to another data controller, where the processing is based on your consent or on the performance of a contract.

8.6 Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you based on our legitimate interest (Article 6(1)(f) of the GDPR).

8.7 Right Not to Be Subject to Automated Individual Decision-Making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. LAUYAN SOFTWARE does not make any such decisions.

8.8 Right to Withdraw Consent

Where processing is based on your consent, you can withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

8.9 Directives Regarding the Fate of Your Data After Your Death

In accordance with Article 85 of the "Informatique et Libertés" law, you can define directives regarding the retention, erasure, and communication of your data after your death.

8.10 Response to Your Requests

We respond to your request as soon as possible and at the latest within one month, in accordance with Article 12 of the GDPR. In case of reasonable doubt about your identity, we may request additional information.

8.11 Minors

Our services are not intended for minors under 15 years of age. In accordance with Article 45 of the "Informatique et Libertés" law, a minor under 15 cannot consent alone to the processing of their data; consent must then be given jointly by the minor and the holder(s) of parental authority.

9. DATA SECURITY‌‍

We implement appropriate technical and organizational measures, including encryption of exchanges (HTTPS), access control, and data backup.

9.1 Breach Notification

In accordance with Articles 33 and 34 of the GDPR, in the event of a personal data breach, we notify the CNIL within 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. If the breach is likely to result in a high risk, we also inform the data subjects without undue delay.

10. INTERNATIONAL TRANSFERS‌‍

Some of our service providers are established outside the European Economic Area (EEA). These transfers are carried out in accordance with Articles 44 to 50 of the GDPR.

10.1 Appropriate Safeguards

Transfers outside the EEA are based on one of the following safeguards:

Adequacy decision: where the European Commission has recognized that the country or framework concerned offers an adequate level of protection, notably the EU-US Data Privacy Framework for certified US companies;
Standard contractual clauses adopted by the European Commission, in the absence of an adequacy decision.

10.2 Specific Transfers

Google, OpenAI, Stripe, and Cloudflare (anti-bot verification of the support form) are established in the United States. Data transfers to these providers are based on the EU-US Data Privacy Framework or, failing that, on standard contractual clauses.

10.3 Information on Safeguards

You can obtain information on the safeguards framing these transfers by writing to us at contact@lauyan.com.

11. COOKIES AND SIMILAR TECHNOLOGIES‌‍

The site lauyan.com uses Google Analytics 4 for audience measurement; this service is only loaded after your consent given via the cookie banner, where refusing is as simple as accepting. Strictly necessary cookies remember your cookie choices and, if you choose one, the site language. The support form is protected by Cloudflare Turnstile for security purposes. Details of cookies, their purposes, and their durations are in our cookie policy. You can change your choices at any time using the "Manage cookies" link at the bottom of each page of the site.

12. POLICY UPDATES‌‍

LAUYAN SOFTWARE may modify this privacy policy, notably to reflect legal developments or its practices. The applicable version is the one online at the time of your consultation; its update date is indicated at the top of this policy.

13. CONTACT AND COMPLAINTS‌‍

For any questions regarding this policy or the processing of your data, you can write to LAUYAN SOFTWARE at contact@lauyan.com.

If you believe that your rights are not being respected, you can file a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 (www.cnil.fr).