Privacy policy

1. Data controller

The data controller and person responsible for the protection of personal information is:

Yoann Vanitou
YV17Labs
Email: hello [at] yv17labs.com

For any question related to your personal data or this policy, please write to the address above.

2. Data we collect

We apply the data minimization principle: we only collect what is strictly necessary.

• Emails you send us — your address and the content of your message.
• Language preference cookie — a cookie named yv17_lang remembering your chosen language. No analytics, tracking or advertising cookies are set.

We use no third-party analytics (no Google Analytics, no tracking pixels, no tracking CDN). Fonts and scripts are served from our own server, except the files the TokenShooter demo downloads when you ask it to (see section 5).

3. Purposes and legal bases

• Responding to your contact request or email — legal basis: pre-contractual measures at your request (GDPR art. 6-1-b) and your consent at the time of sending (Law 25).
• Storing your language preference — legal basis: legitimate interest, strictly necessary cookie for the site to function correctly.

4. Retention periods

• Messages you send us, and related exchanges: 3 years after the last contact, then deletion.
• yv17_lang cookie: 1 year, deletable at any time via your browser.

5. Recipients and processors

Your data is never sold, rented, or shared for commercial purposes.

Only strictly necessary technical processors have access to your data:

• OVH SAS (France, EU) — website hosting and email delivery. ISO 27001 certified, hosted in the European Union.

Our source code is hosted on GitHub, and some projects have their own website. When you follow a link to those services, their own privacy policies apply.

The TokenShooter demo sends nothing to us: the model runs in your browser. Only when you click to load it does your browser download the model directly from Hugging Face, and its inference engine from the jsDelivr CDN; like any website, these services receive your IP address, and their own privacy policies apply. The model then stays in your browser’s cache, and your demo settings (model, pace, sound) in its local storage. Clearing this site’s data in your browser deletes both.

6. Transfers outside Quebec / outside the EU

The site is hosted in France (European Union) by OVH. If you contact us from Quebec, your data will transit to and be stored in the EU. France has a data-protection framework (GDPR) recognized as adequate by Quebec’s Commission d’accès à l’information.

No data is transferred to countries outside the EU or Canada. The TokenShooter downloads described in section 5 go straight from your browser to those services, which may be located outside the EU.

7. Your rights

Under the GDPR and Law 25, you have the following rights:

• Right of access to your data;
• Right to rectification of inaccurate data;
• Right to erasure (“right to be forgotten”);
• Right to data portability — receive your data in a structured format;
• Right to object and to restriction of processing;
• Right to withdraw consent at any time;
• Right to de-indexing (Law 25).

To exercise these rights: write to hello [at] yv17labs.com. We respond within 30 days.

If you believe your rights are not being respected, you may file a complaint with:

• CNIL (France/EU) — www.cnil.fr
• Commission d’accès à l’information du Québec — www.cai.gouv.qc.ca

8. Security

The site is served exclusively over HTTPS (TLS). Access to sensitive files (configuration, logs) is blocked at the server level. In the event of a confidentiality incident that could affect your rights, we will inform you in accordance with our legal obligations.

9. Changes

This policy may evolve. The last-updated date is shown at the top of the page. Significant changes will be communicated to the persons concerned when required.