Privacy policy

This English text is provided for information only. The binding version is the French one, available at gilbert-assistant.fr/politique-confidentialite. In the event of any discrepancy, the French version prevails.

This Privacy Policy explains how LEXIA FRANCE (“LEXIA”, “we”) collects, uses and protects personal data in connection with the use of the Gilbert SaaS service (the “Service”).

It is written in accordance with Regulation (EU) 2016/679 (GDPR) and with the guidance of the French data protection authority (CNIL) on informing individuals.

1) Controller and contact

Controller (B2C, and B2B account data): LEXIA FRANCE, SAS (full details in the legal notice, in French).

Contact (GDPR / support / legal): mathis@lexiapro.fr
In the absence of an appointed DPO, this contact handles all requests relating to personal data.

2) Who does this policy apply to?

This policy applies to:

• individual users (B2C);
• professional users (B2B);
• visitors to the website and users of the Service (including free trials).

Important (B2B): when your organisation subscribes to the Service, LEXIA may act:

• as controller for account, billing and security data,
• as processor for the personal data contained in the audio and transcripts, processed on behalf of the professional customer (the controller). The processing rules are set out in the DPA annex (Article 28 GDPR).

3) What data do we collect?

3.1 Account and usage data

• Account identity: email, username, any profile information.
• Subscription and billing data: plan type, payment history, invoices, information needed for payment (processed through payment providers).
• Usage data: quota consumed, technical events (e.g. errors), settings.

3.2 Security data

• Connection logs (e.g. date and time, IP address, technical identifiers, security-related events).

3.3 Content data

Depending on how the Service is used:

• imported audio files and recordings,
• transcripts, summaries and structured content generated,
• associated metadata (e.g. duration, language, timestamps).

Note: the Service may segment speakers (diarisation) based on audio characteristics; it is not a biometric identification system and is not intended to authenticate individuals.

The Service implements no biometric identification mechanism and does not seek to authenticate or recognise a specific individual.

4) What do we use this data for?

1. Providing the Service: creating and managing the account, enabling transcription and summarisation and access to the results.
2. Managing subscription and billing: performing the contract, handling payments and accounting.
3. Ensuring security and preventing fraud: logging, detection of abnormal access, protection of the infrastructure.
4. Support and assistance: answering requests and incidents (with access to content only on express authorisation).
5. Improving the Service: bug fixing, performance, usability, without using customer content to train models.

5) Legal bases (GDPR)

• Performance of the contract (GDPR art. 6(1)(b)): account creation, provision of the Service, billing.
• Legal obligation (art. 6(1)(c)): accounting and tax obligations, legal requests.
• Legitimate interest (art. 6(1)(f)): security, fraud prevention, technical improvement.
• Consent (art. 6(1)(a)): only where required, in particular for certain non-essential cookies and trackers.

6) Who receives your data?

• Internally at LEXIA: only authorised staff, on a need-to-know basis.
• Technical providers involved in delivering the Service: hosting, infrastructure, security, payment, and so on.
• Authorities: only where required by law or on a legally founded request.

7) Where is your data processed?

Processing and hosting relating to the Service take place within the European Union. We do not organise transfers outside the EU in the normal course of providing the Service.

Data is hosted in data centres located in France, operated by OVHcloud.

8) How long do we keep your data?

8.1 Audio

Audio files are deleted immediately after processing.

8.2 Transcripts, summaries and generated content

Kept for as long as the account is active. Users can delete their content manually at any time.

8.3 Exports

LEXIA does not retain exports: they are generated and downloaded by the user.

8.4 Connection logs

Kept for 12 months.

8.5 Backups

Where a user deletes data, backups are fully purged within 30 days at the latest. During that period the data is held only in secure backup systems and is not accessible in the production environment.

9) Support and access to content

By default, LEXIA does not access users’ content (transcripts or summaries). Where support is requested, occasional access may take place only with the user’s express authorisation.

No member of LEXIA listens to or analyses users’ audio recordings, other than on an explicit support request with formal authorisation from the user concerned.

10) Model training

LEXIA does not use user or customer content to train or improve AI models, other than under a separate explicit agreement (contractual opt-in).

11) Google User Data

Google User Data. When you connect your Google Calendar, Gilbert accesses your calendar events in read-only mode (event titles and start/end times) via the calendar.readonly scope. This is used to display your upcoming meetings inside the app and to send you local reminder notifications before a meeting starts.

Data sharing and disclosure. We do not sell your Google user data and we do not disclose or transfer it to third parties for advertising or for training AI models. Calendar data used for meeting reminders is processed locally within the app. In an optional AI-assisted feature that proposes follow-up actions, calendar content may be processed by our self-hosted AI model (see "Artificial Intelligence" below). In all cases, Google user data stays within OVHcloud's European infrastructure, is not shared with any AI model vendor, and is not used to train AI models.

Limited Use. Gilbert's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Artificial Intelligence. Gilbert uses AI models to transcribe and summarize the meetings you record, and to generate optional suggestions:

• Speech-to-text: the open-weight Whisper model, hosted via OVHcloud AI Endpoints (European Union).
• Summaries and suggestions: the open-weight Mistral Small model, hosted via OVHcloud AI Endpoints (European Union).

These models are hosted within OVHcloud's EU infrastructure. Data processed by them is handled within this infrastructure, is not shared with any model vendor, and is not used to train generalized AI models. Any Google user data that is processed by these models is handled solely under the Limited Use requirements stated above.

12) Security

LEXIA implements technical and organisational measures proportionate to the risks:

• access control and authorisation management,
• logging and detection of security events,
• measures protecting transmissions and the infrastructure,
• secured exchanges over HTTPS/TLS,
• backups and restoration procedures.

Data transmissions between the app, the website and the servers are secured over HTTPS/TLS.

13) Cookies and trackers

• Strictly necessary for operation (exempt from consent),
• Audience measurement and/or personalisation: subject to consent where required.

14) Your rights

Subject to the conditions set out in the GDPR, you have the right to:

• access, rectification and erasure,
• restriction and objection,
• portability,
• post-mortem instructions (under French law).

Exercising your rights: write to mathis@lexiapro.fr. You may also lodge a complaint with the CNIL, the French data protection authority.

15) Sensitive data and precautions

The Service is not intended to process special categories of data deliberately. It is for the user to assess whether uploading such content is appropriate and to obtain the necessary authorisations.

16) Minors

The Service is not intended for minors without parental authorisation.

17) Changes to this policy

LEXIA may update this policy to reflect legal, technical or functional developments.