Privacy Policy

This Privacy Policy explains how La Mashine collects, uses, shares and protects your personal data when you use our website, our platform and our human advisory services. La Mashine is a simplified joint-stock company (SAS) registered in Toulouse, France, with its registered office at 231 rue Pierre et Marie Curie, 31670 Labège, France.

For a detailed description of your rights under the GDPR and how to exercise them, please see our GDPR & Data Protection Notice. This policy should be read together with our Terms & Conditions.

1. Information we collect

We collect information that you provide directly and information generated as you use our services:

• Account information: your name, email address, password, role and the name of your project when you register.
• Project content: the notes, documents, decisions and other content you add to the platform as you build your project.
• Usage information: how you interact with the platform, including pages viewed, features used, dates and times of access, and log data.
• Device and technical information: IP address, browser type, operating system and similar technical identifiers.
• Billing information: your billing address, VAT number where relevant and subscription details. Payment card data is processed by our payment provider and never stored on our servers.
• Communications: the messages you send to our support and advisory teams.

2. How we use your information

We use your personal data to:

• Provide, operate, maintain and improve the platform and advisory services;
• Create and secure your account and authenticate you;
• Deliver human support and advisory sessions relevant to your project;
• Process payments, manage your subscription and send invoices;
• Respond to your requests and communicate service-related information;
• Send you, with your consent, product news and other communications you can unsubscribe from at any time;
• Monitor, prevent and address technical issues, fraud and abuse;
• Comply with our legal obligations.

3. Sharing with sub-processors

We do not sell your personal data. We share it only with trusted service providers who process it on our behalf and under our instructions (our sub-processors), and only to the extent necessary to run our services. Our main categories of sub-processors are:

• Cloud hosting and infrastructure providers, located within the European Union;
• Payment processing providers, who handle your card data securely;
• Email and transactional messaging providers;
• Analytics and product-monitoring providers;
• Customer support tooling providers.

4. Cookies and analytics

Our website and platform use cookies and similar technologies. Strictly necessary cookies are required to make the service work, for example to keep you signed in, and do not require your consent. Analytics and preference cookies are only set with your consent, which you can give or refuse through our cookie banner and change at any time in your settings.

We use privacy-respecting analytics to understand how our services are used and to improve them. Where analytics involve non-essential cookies or similar identifiers, we rely on your consent, and you can withdraw it at any time.

5. Data retention

We keep your personal data only for as long as necessary for the purposes described in this policy. Account and project data are retained for the duration of your relationship with us and deleted or anonymised within a reasonable period after your account is closed. Billing records are kept for ten (10) years to meet legal obligations, and technical logs for up to twelve (12) months.

6. Security

We take the security of your data seriously and apply appropriate technical and organisational measures, including encryption in transit, need-to-know access controls and regular review of our practices. No system can be guaranteed to be completely secure, but we work to protect your data and to respond promptly to any incident.

7. Your rights

You have rights over your personal data, including the rights to access, rectify, erase, restrict, port and object to the processing of your data, as well as the right to withdraw your consent. These rights and the way to exercise them are described in detail in our GDPR & Data Protection Notice. To exercise any right, write to us at contact@lamashine.com.

8. Children

La Mashine is a professional service intended for founders and is not directed at children. We do not knowingly collect personal data from anyone under the age of 16. If you believe that a minor has provided us with personal data, please contact us and we will delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. When we make material changes, we will update the “last updated” date above and, where appropriate, notify you by email or through the platform. We encourage you to review this page periodically.

10. Contact

If you have any question about this Privacy Policy or how we handle your data, please contact us at contact@lamashine.com or through our contact page. You can also write to us at La Mashine, 231 rue Pierre et Marie Curie, 31670 Labège, France.