Privacy Policy
Last updated: October 2026
This Privacy Policy explains how Baguette Dynamics (“Lawve” or “we”), publisher of the platform available at https://lawve.ai (the “Platform”), processes your personal data, who we share it with, and the rights you have. Learn more about our company in our Legal notice.
Lawve may update this Privacy Policy at any time. We encourage you to review it regularly to stay informed of the latest changes.
1.Definitions
- “Personal Data”: personal data processed in connection with the use of the Platform, including cookies where applicable.
- “French Data Protection Act”: Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, as amended.
- “Organization”: any legal entity that has entered into an agreement with Lawve for the provision of the Services.
- “GDPR”: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC.
- “Services”: all services provided by Lawve, including access to and use of the Platform and any related professional services (integration, training, support, etc.).
- “Skill”: a legal artificial intelligence module published on the Platform, whether available to every User (public marketplace) or reserved for the members of an Organization.
- “User” or “you”: any natural person who has an account and uses the Platform or benefits from the Services, on their own behalf or on behalf of an Organization.
- “Visitor” or “you”: any person visiting the Platform.
2.Who is the data controller?
When you use the Platform, and in managing its contractual and commercial relationship with you, Lawve processes Personal Data about you for which it determines, as data controller, the means and purposes of the processing.
Lawve undertakes to limit the collection of Personal Data to what is necessary, in line with the data minimization principle, and to comply with the GDPR and the French Data Protection Act.
For any question about your Personal Data, write to us at contact@lawve.ai.
3.How is Personal Data collected?
We process the Personal Data you provide to us:
- when you browse and use the Platform;
- when you use the Services;
- when you complete the forms available on the Platform, in particular when you create your account and your profile;
- when you communicate with other Users through the Platform, in particular through the contact forms of profiles and resources;
- when you connect an artificial intelligence assistant to the Platform (MCP protocol);
- when you contact us by email or through our GitHub repository.
4.What Personal Data does Lawve process?
For each purpose, we list the Personal Data processed, the legal basis of the processing, and the retention period. Data marked with an asterisk (*) is optional.
| Purpose | Personal Data | Legal basis | Retention |
|---|---|---|---|
| Responding to your contact requests | first and last name, company, email address, content of the message. | our legitimate interest in responding to contact requests. | 3 years from collection or from your last contact. |
| Creating your account and providing the Services | account data (email address, hashed password, Google or LinkedIn sign-in identifiers when you use them); Platform usage data (data that you or others provide when using the Services, including your search history, the profiles and resources you view, your favorites and follows, the messages sent through contact forms and, more broadly, the actions you take when using the Services); authorizations granted to the artificial intelligence assistants you connect to the Platform. | performance of the agreement between us if you use the Services on your own behalf, or our legitimate interest in providing the Services if you are a member of an Organization. | until you delete your account. |
| Creating a public profile | first and last name; expertise*, experience*, biography*, photo*, location*; link to your LinkedIn profile*. | your consent to publish this information on your profile. You choose whether your profile is public when you create it and can make it private at any time in your settings. When you publish a public resource, your profile becomes public so that its author can be identified. | until you withdraw your consent. |
| Managing our contractual and commercial relationship with you or your Organization | first and last name, title or position, professional email address, phone number, billing and payment data (where applicable). | our legitimate interest in managing our contractual and commercial relationship with you or your Organization. | up to 5 years after the end of the contractual relationship with the Organization. |
| Evaluating, improving, and developing our Services | account data, Platform usage data. | our legitimate interest in improving our Services. | 24 months from collection. |
| Producing statistics and improving the Platform | cookies (see “Cookies”). | our legitimate interest in improving the Platform. | up to 13 months from collection. |
| Securing the Platform and investigating fraud, offenses, and abuse | account data, Platform usage data, billing and payment data (where applicable). | Lawve’s legitimate interest in defending and preserving its rights and protecting the Platform. | 13 months from collection. |
| Protecting our rights and interests, and those of other Users and third parties, in the event of litigation or pre-litigation with a User | all Personal Data collected under this Policy. | our legitimate interest in protecting our rights and interests and those of other Users and third parties. | 13 months from collection if no dispute arises with a User; otherwise, for as long as necessary to defend and enforce our rights and for the applicable limitation period. |
| Managing the organization of our company and transactions such as mergers, acquisitions, or sales | all Personal Data collected under this Policy. | our legitimate interest in managing our corporate organization, activities, and assets. | for as long as necessary to complete the reorganization. |
| Meeting our legal and regulatory obligations (in particular tax rules and requests from authorities) | all Personal Data necessary to comply with the obligation concerned. | our legal obligations. | Personal Data reported to the tax authorities is kept for 10 years; other Personal Data is kept for the period required by the applicable legal obligation. |
Lawve makes no automated decisions producing legal effects and carries out no profiling concerning you.
We also collect data about your browsing when you visit the Platform. Some information may be collected on that occasion, in particular through cookies (see the section below).
To deduplicate anonymous views and downloads, we process the Visitor’s IP address and browser identifier and store only a keyed hash of them.
5.Cookies
5.1What is a cookie?
A cookie is a small file stored by a server on a user’s device and associated with a web domain for various purposes, in particular:
- allowing websites to work optimally and securely;
- analyzing website traffic to improve its performance;
- personalizing the experience of Users and remembering their preferences (in particular the display language).
Cookies make it possible to collect and use information about the users of websites, mobile applications, etc. Cookies are placed or read when you visit the Platform.
Session cookies are deleted automatically when you close your browser, while persistent cookies remain on your device after the browser is closed, allowing Lawve to remember your settings and preferences on later visits.
Lawve may also use other technologies similar to cookies for analytics purposes or to follow your interaction with the Platform.
5.2First-party and third-party cookies
First-party cookies are those set by Lawve and used to interact with you when you use the Platform.
The Platform also allows third parties to set their own cookies (third-party cookies). These third parties may set their own cookies when you use the Platform and may receive information about your behavior. Lawve cannot be held responsible for the placement or use of these cookies.
You should therefore consult these third parties’ websites to learn more about their use of cookies. For more information about the third-party cookies used on the Platform, see “List of cookies used” below.
5.3Managing cookie settings in your browser
You can use your browser’s settings to refuse cookies automatically or to delete all cookies stored on your computer or mobile device.
The procedure depends on the browser you use. The main browsers concerned are:
- Google Chrome
- Mozilla Firefox
- Microsoft Edge
- Safari (macOS)
- Safari (iOS / iPhone)
If you have disabled one or more cookies, we may still use the information collected through cookies placed before they were disabled. However, we will no longer use the disabled cookies to collect further information.
Keep in mind that disabling or deleting technical cookies may cause the Platform to malfunction.
5.4Cookie categories
- Strictly necessary cookies (enabled by default): These cookies are needed to use the Platform and to provide its basic technical features (authentication, sign-in security, language preference). Without them, the Platform could not be used, so your consent is not required. These cookies cannot be disabled.
- Audience measurement cookies: These cookies collect information about how you interact with the Platform, giving Lawve, for example, an overview of the pages you visit, the time you spend on them, and the operating system you use (PostHog). They allow Lawve to evaluate, improve, and develop the Platform to offer you a better user experience. They are used solely to produce audience statistics for our own purposes and are neither used for advertising nor shared with third parties.
We do not use advertising cookies.
5.5Information collected through cookies
The information we collect through cookies is used only in aggregated and anonymized form.
5.6List of cookies used
The cookies and similar technologies used by the Platform are:
| Cookie name | Provider | Purpose | Type | Duration | Activation |
|---|---|---|---|---|---|
| lawve_locale | Lawve | Remembers your display language | HTTP, secure | 12 months | Required |
| lawve_oauth_state | Lawve | Secures sign-in through Google or LinkedIn | HTTP, secure, HttpOnly | 10 minutes | Required |
| lawve_access_token | Lawve | Keeps you signed in | Local storage | Until you sign out, and at most 30 days | Required |
| ph_* | PostHog | Audience measurement: recognizes returning visitors | HTTP | Up to 12 months after the last visit | By default |
PostHog is hosted in the European Union; page addresses are stripped of query parameters, your IP address is used only to estimate your country and is not stored, and visits are not linked to your account.
6.Recipients and transfers outside the EU
The Personal Data collected is intended solely for Lawve and is accessible only to Lawve staff who need to know it. It may also be accessible to third-party service providers acting as processors for the purposes described above or for the functional and technical management of Lawve’s activities. In that case, Lawve ensures that these providers protect your Personal Data and that it is transferred with an adequate level of security. Where applicable, clauses compliant with Article 28 of the GDPR govern these relationships.
Personal Data is shared with the following categories of recipients:
- Service providers: Scaleway (Platform hosting, database, file storage, and email delivery, in France); Microsoft Azure (artificial intelligence applications offered to Organizations, in Europe); PostHog (audience measurement, hosted in the European Union); Stripe (payment of Organization subscriptions). The full list of recipients is available on request.
- Lawyers, to defend our interests;
- Third parties bound by confidentiality obligations, for the reorganization of our activities;
- Judicial and administrative authorities (for example, police or courts), to protect the rights and interests of Lawve and third parties or to meet our legal and regulatory obligations.
In all cases, only where necessary and justified for a specific purpose.
We host your Personal Data in the European Economic Area. Some providers, such as Stripe, may transfer data outside the European Economic Area; such transfers are then covered by appropriate safeguards under the GDPR (an adequacy decision, such as the EU-U.S. Data Privacy Framework, or the European Commission’s standard contractual clauses).
When you sign in with Google or LinkedIn, these services process your data under their own privacy policies.
When you connect an artificial intelligence assistant to the Platform (for example Claude, ChatGPT, Gemini, or Mistral) and use it to run Skills, your Personal Data, including your prompts and files, is processed by the provider of the assistant you chose. This processing is governed by that provider’s own privacy policy.
The Platform may also contain links to third-party websites (in particular LinkedIn, Substack, and GitHub). When you visit them, the processing of your Personal Data may be subject to their own privacy policies, which Lawve recommends you read.
7.Security
Lawve implements technical and organizational security measures appropriate to the nature of the Personal Data and to the risk for the people concerned.
8.What are your rights and how can you exercise them?
You have the right to access, rectify, and erase your Personal Data, to restrict its processing, to data portability, and to object, as well as the right to set general and specific instructions on how your rights should be exercised after your death.
You can exercise your rights by contacting Lawve at contact@lawve.ai or by post at the address of our registered office.
You can also withdraw your consent at any time where processing is based on it, without affecting the lawfulness of processing carried out before the withdrawal. You can manage your consent directly from your User profile or by contacting us. You can delete your account at any time from your account settings.
Where we send you commercial communications, you can unsubscribe at any time using the link included in each email. Where such communications rely on our legitimate interest, you can object to them at any time.
Conditions and limitations provided for by the GDPR and applicable laws and regulations may apply to the exercise of these rights.
We respond within one month, which may be extended by two months where necessary given the complexity or number of requests. If we have reasonable doubts about your identity, we may ask for additional information.
You can also lodge a complaint with the supervisory authority: Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr).