Privacy policy

Hugo BILLAUX EI, a sole trader (entrepreneur individuel) trading as LIORA — SIREN 923 209 183.

Address: 91 rue de la Girardière, appartement 33, 49300 Cholet, France.

Contact, including for exercising your rights: direction@liora-eu.com.

We have not appointed a data protection officer: neither our size nor the nature of our processing requires one.

We attach great importance to the protection of your personal data. This policy explains what data we collect, why, who it is passed on to, how long we keep it and what your rights are.

It covers the data of YOUR account, for which we are the controller. The data of your own customers, which you entrust to us by connecting your store, falls under a different regime: you are the controller of it, we are its processor, and it is our Data processing agreement that applies.

The service is reserved for business users. Registration on this site is refused to anyone under the age of sixteen, and we do not knowingly collect any data concerning children.

When you create your account, we ask you for:

• Your identity: first name, surname and date of birth.
• Your contact details: personal email address (which serves as your login), telephone number and, where applicable, a business email address.
• Your business: SIREN number, legal form and, if you wish, a trading name.

To these are added, through your use of the service:

• Your password: stored in hashed form, which cannot be reversed. We do not know it and cannot remind you of it.
• Your logins: date, IP address and browser used, for every session opened. These details are used to show you your connected devices and to detect unusual access.
• Your store: the Shopify domain you link to your account.
• Your subscription: plan, status, renewal dates and history of changes. Your card details, for their part, never reach us — they are entered with our payment provider.
• Your acceptance of our terms: the date on which you accepted them, and their version.
• The asset-freeze check: the date on which we checked that your business and its managers do not appear in the French national register of asset freezes, and its result.
• Our exchanges: messages sent through our forms or by email, service emails addressed to you, and internal notes our team may write about your file — to follow up a support request, for instance.
• Your feedback: when you indicate, in the application’s help centre, whether an article was useful to you.

We collect no sensitive data within the meaning of Article 9 of the GDPR, and we build no automated profile producing legal effects concerning you.

• Managing your account and your subscription — performance of the contract.
• Issuing your invoices and meeting our accounting obligations — legal obligation. This is why your SIREN number and legal form are requested.
• Proving your acceptance of our terms — performance of the contract and legitimate interest: being able to establish which text you accepted, and when.
• Checking that you have the legal capacity to subscribe — this is the only use made of your date of birth.
• Checking that your business and its managers are not subject to an asset freeze — legal obligation (Regulations (EU) No 269/2014 and No 833/2014). We consult the French national register of asset freezes for each new subscription or installation, and record the date and result of that check.
• Replying to you and providing support — performance of the contract and legitimate interest. The internal notes relating to your file fall under this purpose.
• Keeping the service secure — legitimate interest: logging of logins and of our team’s actions on accounts, so that unusual access can be established and explained.
• Writing to you about the service — performance of the contract for essential messages (address confirmation, password reset, renewal dates, incidents), legitimate interest for messages relating to your experience, such as a satisfaction request. You may object to the latter at any time, as explained in the ‘Opting out of our satisfaction and departure emails’ section, with no consequence whatsoever for the service.

Your data is neither sold, rented out nor passed on to third parties for commercial purposes. We do not use your data to train models. When we write to merchants who are not yet customers, we do so in accordance with the rules set out in the next section.

We sometimes write to merchants who run a Shopify store to introduce LIORA to them. This section applies to you if you have received such a message without being a customer. We have written it so that you know exactly what we know about you, where we got it from, and how never to hear from us again.

Who we contact, and who we do not:

• Only generic company addresses — such as contact@ or info@, on the store’s domain name, belonging to a business that has legal personality. We check this legal form before writing.
• Never an individual in a personal capacity — neither a sole trader, nor an address in a person’s name, nor a personal mailbox such as Gmail or Outlook, unless you have given us your agreement beforehand. If in doubt about the legal form, we assume the recipient is an individual and we do not write.
• In Malta, no one without written agreement — companies included. Maltese law requires this, and we apply it without exception.

We only begin prospecting in a country once we have completed the formalities that country imposes on businesses writing to recipients there.

Where your contact details come from, and what we keep of them:

• Collected by hand — from your website, your contact page, your legal notice or a business directory: the places where you yourself publish an address in order to be contacted. Never a purchased, rented or exchanged list, and no automated extraction tool.
• Only what is strictly necessary — the address, the name and website of the store, the country, the legal form and registration number, the exact web address of the page where we found it, the dates of collection and sending, and your reply, if any.

How we write:

• A single message — if you do not reply, we do not follow up. We keep a record that the message was sent precisely so that we never write to you cold again.
• By email, and nothing else — no telephone, no SMS, no instant messaging, no social media.
• Without any tracking — no pixel telling us whether you opened the message, no link telling us whether you clicked. All we know of your reading is what you choose to tell us in reply.
• Promptly, or not at all — the message is sent no later than seven days after the address is collected. An address that has not led to any message being sent within thirty days is erased.

On what basis, depending on where you are:

• European Union, United Kingdom, Andorra, Thailand and Indonesia — our legitimate interest in presenting a management tool to professionals whose very business this is, for generic company addresses only.
• United States — the federal rules on commercial messages, which rest on your right to object to them at any time.
• United Arab Emirates — your consent, or the fact that you have made the address public yourself.
• Turkey — for a company address, the regime applicable to messages sent to traders; for any address belonging to an individual, your explicit consent.
• Everywhere, for an individual — sole trader, address in a person’s name, and any recipient in Malta: your prior consent.

How long we keep this information:

• Three months — for all of the data, after our message, if you have not responded favourably to it.
• Three years — only for the record that the message was sent (address, country, date), so that we never write to you twice.
• For as long as we carry out prospecting — if you object: your address is added to an objection list, reduced to the address and the date of your request. This is the only way to guarantee that we will not write to you again.

There is no automated decision-making and no profiling, and no score is assigned to the people we contact.

You may object at any time to receiving our prospecting messages. This right is absolute: it is free of charge, it need not be justified, and we do not dispute it.

• Through the unsubscribe link included in every one of our messages — one click, with no account to create and no form to fill in.
• By replying ‘STOP’ to the message you received.
• By writing to us at direction@liora-eu.com, by any means: every request is taken into account, whatever form it takes.

Your objection is applied within forty-eight hours, and no further message is sent to you. Your other requests — access, rectification, erasure — receive a reply within thirty days at most, and within seventy-two hours when they are simple.

If our reply does not satisfy you, you may refer the matter to the Commission nationale de l’informatique et des libertés (CNIL), lead supervisory authority for Hugo BILLAUX EI, or to the authority of your country:

• Luxembourg — Commission nationale pour la protection des données (cnpd.public.lu).
• Malta — Information and Data Protection Commissioner (idpc.org.mt).
• Portugal — Comissão Nacional de Proteção de Dados (cnpd.pt).
• United Kingdom — Information Commissioner’s Office (ico.org.uk).
• United States — Federal Trade Commission (reportfraud.ftc.gov).
• Andorra — Agència Andorrana de Protecció de Dades (apda.ad).
• Thailand — Personal Data Protection Committee (pdpc.or.th).
• Indonesia — Ministry of Communication and Digital Affairs (komdigi.go.id), pending the establishment of the authority provided for by law.
• Turkey — Kişisel Verileri Koruma Kurumu (kvkk.gov.tr).
• United Arab Emirates — UAE Data Office (u.ae).

Anyone, whether a customer or not, can use our reporting form to report content stored in LIORA that they consider illegal (Regulation (EU) 2022/2065 on digital services, Article 16). We then process:

• The data: your name and email address — optional when the notice concerns child sexual abuse —, the location of the content, your explanation, the type of content and the language of the form.
• The purpose: to review the notice, acknowledge its receipt and notify you of our reasoned decision.
• The legal basis: compliance with a legal obligation (GDPR, Article 6(1)(c)).
• The recipients: Resend, which delivers the notice and the acknowledgement, and Google (Google Workspace), whose mailbox receives it.
• The retention period: no more than three years after our last exchange, like the other messages received in our mailbox, where they are currently deleted by hand.

Your IP address is not stored with the notice: it is used only to limit the number of submissions from the same device, in a counter deleted no later than the day after your last submission.

Your data leaves us only for the providers strictly necessary to the service. Each acts on our instructions, and only for the part that concerns it:

• Vercel Inc. — hosting of the site and execution of the processing. Located in the European Union, in Paris.
• Databricks, Inc. (Neon service) — database. Located in the European Union, in Frankfurt (Germany).
• Stripe Payments Europe Ltd — collection of subscription payments and issuing of invoices. Receives your name, your business’s name and SIREN number, your email address, your billing address and your payment details, which we never see.
• Resend Inc. — delivery of our emails. Receives your email address and the content of the message.
• Google (Google Workspace) — our team’s email. Receives the messages sent through our forms, the emails you send us and your requests to exercise your rights.
• Shopify — billing of your subscription when you install LIORA from the Shopify App Store. The images of your catalogue displayed in the application are also served by Shopify, which thereby receives your browser’s IP address.
• Scaleway SAS — hosting of the application, in France.

Hosting and processing take place in the European Union, except for our email, whose location Google does not guarantee. Vercel, Databricks (Neon service), Stripe, Resend and Google belong to groups established in the United States: access from that country, for operational or support purposes, cannot be ruled out. Where that happens, it is governed by the European Commission’s standard contractual clauses. Shopify belongs to a group established in Canada, a country whose level of protection the European Commission has recognised as adequate. We would rather flag these reservations than claim a watertightness we could not demonstrate.

• Account, profile, store and internal notes — for as long as your account exists. Everything is erased when it is closed, including the notes written about you.
• Asset-freeze check — the date of the latest check is recorded on your account for as long as it exists, and disappears with it. A record of each check — its date, who carried it out and its result — is also entered in the log of our team’s actions, where it is kept for three years, including after the account is closed, under a technical identifier: it proves that the check required by the regulations was indeed carried out.
• Login log (dates, IP addresses, browsers) — twelve months after the end of each session, then automatic erasure; at the latest when the account is closed.
• Confirmation and reset tokens — twenty-four hours at most, seventy-two hours for the link of an account opened by our team. They are erased the night after they expire.
• Log of the emails we have sent you — three years, so that we can prove what was sent to you and not write to you again in error; at the latest when the account is closed.
• Help centre feedback — three years after it is submitted, and at the latest when your account is closed. Feedback submitted on this site without an account is erased after three years.
• Messages sent through our forms, and emails you send us — erased no later than three years after our last exchange. They are not kept in our database but in our mailbox (Google Workspace), where we currently carry out this deletion by hand.
• Log of our team’s actions on accounts — three years. This is what makes it possible to say who did what, should you ask us; it remains after the account is closed, linked to a technical identifier.
• History of your subscription — ten years, like the accounting records it documents; it remains after the account is closed, linked to a technical identifier.
• Invoices and accounting records — ten years, as the law requires, regardless of whether the account is closed. They are kept by our payment provider.
• Register of security incidents — five years. It contains the technical identifier of the accounts affected, never the content of your data.

When your account is closed, therefore, all that remains are your invoices, the history of your subscription, the log of our team’s actions, which keeps the record of asset-freeze checks, and the register of incidents — the last three under a technical identifier — together with our email correspondence, for the periods stated above.

The retention periods for the data held in our database are applied automatically, every night, and not by hand. Encrypted backups may keep a copy beyond them, for the time it takes them to rotate; they are never consulted and are overwritten of their own accord.

In accordance with the GDPR, you have the rights of access, rectification, erasure, objection, restriction and portability, as well as the right to withdraw at any time a consent you have given.

Most of your information can be changed directly from your customer area, where you can also close your account yourself — deletion is then immediate and final, within the limits described in the previous section. For any other request, write to direction@liora-eu.com: we reply within one month.

You may also give us instructions on what should happen to your data after your death — retention, erasure or disclosure — and designate the person responsible for carrying them out, by writing to direction@liora-eu.com (Article 85 of French Law No 78-17 of 6 January 1978). In the absence of instructions, your heirs may ask us to close your account.

Before referring the matter to an authority, you may send us a complaint at direction@liora-eu.com: we acknowledge receipt within thirty days and keep you informed of the action we take on it.

If our reply does not satisfy you, you may refer the matter to the French data protection authority (Commission nationale de l’informatique et des libertés, CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or lodge a complaint at cnil.fr.

Our Security and incident response page sets out what we do when an incident affects your data: how to report it, how we assess it, and who is notified.

You may object, at any time and without having to give reasons, to the emails relating to your experience: satisfaction requests, the message sent after you leave. Each of these emails contains a link that lets you record your objection without logging in; your email program may also offer you a one-click unsubscribe button. You can also record it from your customer area, in the ‘My details’ section.

Your objection takes effect immediately, is kept with its date, and has no consequence for the service. It does not cover the messages that are essential to your account, such as an address confirmation or notice of a renewal date.