Privacy Policy — Luvables

1. Data controller

The data controller for personal data is SAS Intimate Innovations Technologies (IITECH), operating the Luvables brand, with its registered office at:

5 Place du 11 Novembre 1918
13280 Arles, France
Contact : contact@luvables.fr | contact@iitech.fr
DPO : dpo@iitech.fr
Phone : 04 65 08 03 39

2. Data collected

As part of the use of our services, we collect the following data:

Identification data: encrypted email address, display name chosen by the user
Usage data: anonymized usage statistics, application preferences
Technical data: encrypted device identifier, application version, device type

Intimate data: All data relating to the intimate use of the devices remains stored exclusively on the user's device. It is never transmitted to our servers and is never collected.

3. Legal basis for processing

The processing of your personal data is based on the following legal grounds:

Consent (Article 6(1)(a) GDPR): for account creation and use of the services
Performance of a contract (Article 6(1)(b) GDPR): for the provision of the subscribed services
Legitimate interest (Article 6(1)(f) GDPR): for the security and improvement of our services

Given the potentially sensitive nature of data related to our field of activity, we apply the provisions of Article 9 GDPR on special categories of data. Processing is based on the user's explicit consent.

4. Storage and security

We implement rigorous security measures to protect your data:

Military-grade encryption for all personal data stored on our servers
End-to-end encryption for communications between paired devices
Mutual authentication for communications between services
Intimate data on-device only: no intimate usage data ever leaves your device
Pseudonymization of user identifiers in our databases
Hosting in the European Union exclusively

5. Retention period

Your personal data is retained for the following periods:

Account data: for the entire duration of your registration, then 30 days after account deletion
Billing data: 10 years in accordance with legal obligations
Security logs: 12 months maximum
Anonymized analytics data: 24 months

6. Your rights

In accordance with the GDPR, you have the following rights regarding your personal data:

Right of access (Article 15): obtain confirmation that your data is being processed and obtain a copy of it
Right to rectification (Article 16): correct inaccurate or incomplete data
Right to erasure (Article 17): request the deletion of your data
Right to data portability (Article 20): receive your data in a structured, machine-readable format
Right to object (Article 21): object to the processing of your data
Right to restriction (Article 18): restrict processing in certain cases

To exercise your rights, go to our dedicated GDPR rights page or contact our DPO at dpo@iitech.fr.

7. Data Protection Officer (DPO)

Our Data Protection Officer can be reached at the following address:

DPO — SAS IITECH (Luvables)
Email : dpo@iitech.fr
Address : 5 Place du 11 Novembre 1918, 13280 Arles, France

You also have the right to lodge a complaint with the CNIL (French Data Protection Authority).

8. Cookies

Our site uses a minimal number of cookies, strictly necessary for the operation of the service. We use no tracking cookies, no advertising cookies and no third-party behavioral analytics tools.

Essential cookies: session management and technical preferences (duration: session)
Security cookies: CSRF protection and anomaly detection (duration: session)

No additional consent is required for these cookies insofar as they are strictly necessary for the provision of the service.