Last Updated: March 23, 2026
PREAMBLE
The purpose of this Privacy Policy (hereinafter the “Policy”) is to inform you about how Lelops, a French société par actions simplifiée (SAS) with a share capital of 15,000.00 euros, registered with the Paris Trade and Companies Register under number 100 197 532, having its registered office at 60 Rue François 1er, 75008 Paris, France (hereinafter “Lelops”, “we”, “us”), collects and processes your Personal Data. As a company based in France, Lelops is committed to complying with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the French Data Protection Act No. 78-17 of 6 January 1978 as amended (“Loi Informatique et Libertés”).
1. SCOPE AND DEFINITIONS
1.1. Scope
This Policy applies to all Personal Data collected through our website http://www.lelops.ai (the “Site”) and our cybersecurity and Edge orchestration SaaS platform (the “Service”). It applies to:
- Visitors of our Site;
- Representatives of our Clients (B2B contacts);
- Users of the Service (Administrators, security analysts, operation engineers, …).
1.2. Role of Lelops (Controller vs. Processor)
- Data Controller: Lelops acts as a Data Controller when it collects data for its own purposes (e.g., billing, account management, marketing, website analytics). This Policy covers these processing activities.
- Data Processor: When providing the Edge Infrastructure Services (e.g., orchestrating configurations, detecting vulnerabilities on Client assets), Lelops acts as a Data Processor on behalf of the Client. In its role as a Data Processor, Lelops processes Edge traffic logs in real-time to extract security and financial metrics. These raw logs are destroyed immediately after processing (“Stateless Architecture”) and are not stored by Lelops, unless specifically requested by the Client for forensic purposes via a dedicated opt-in feature. These processing activities are governed by the Data Processing Agreement (DPA) signed between Lelops and the Client, not by this Policy.
1.3. Definitions
- Client: Any legal entity or professional organization that has subscribed to the Service.
- Cookies: Small text files placed on your device to store preferences or analyze traffic.
- Service: The Edge Infrastructure Operation SaaS platform accessible via the Site.
- Site: The website http://www.lelops.ai edited by Lelops.
- Usage Data: Data collected automatically regarding how the Service is accessed and used (e.g., page views, session duration).
- User: Any natural person authorized by the Client to access and use the Service (e.g., employees, security analysts, administrators, …).
2. PERSONAL DATA WE COLLECT
We limit the collection of Personal Data to what is strictly necessary (Data Minimization).
2.1. Data you provide directly
- Account Information: Name, first name, professional email address, phone number, job title, company name, hashed password.
- Billing Information: Billing address, VAT number, transaction history. Note: We do not store credit card numbers; they are handled securely by our payment provider (Stripe).
- Communications: Messages sent to our support team (tickets), feedback, survey responses.
- Recruitment: CVs and cover letters if you apply for a job.
2.2. Data collected automatically
- Connection Data: IP address, browser type, operating system, time zone, connection logs.
- Usage Data: Actions taken within the SaaS platform, pages viewed, duration of sessions, features used, communication with Lelops Chat, …
- Cookies: See Section 9.
3. PURPOSES AND LEGAL BASIS
We process your data only for specific purposes and based on a valid legal ground (Art. 6 GDPR).
| Purpose of Processing | Legal Basis |
| Provision of the Service: Creating accounts, authenticating users, providing access to the SaaS platform features. | Performance of the Contract (T&Cs) |
| Billing and Administration: Invoicing, accounting, managing unpaid bills. | Performance of the Contract & Legal Obligation |
| Security and Fraud Prevention: Detecting malicious behavior, preventing DDoS attacks, securing the platform. | Legitimate Interest (Ensuring the security of our IT systems) |
| Product Improvement: Analyzing usage trends to improve user experience (UX) and fix bugs. | Legitimate Interest (Improving our business) |
| Marketing (B2B): Sending newsletters, product updates, or commercial offers to professional prospects. | Legitimate Interest (B2B Prospecting) or Consent (where required) |
| Legal Compliance: Managing data subject rights requests, complying with judicial authorities. | Legal Obligation |
| R&D and Threat Intelligence: Aggregating and anonymizing Data to generate statistics, improve detection models, and enhance cybersecurity features. We use aggregated, high-level telemetry and anonymized threat patterns. This processing never involves the use of raw PII or Client-specific sensitive business data. | Legitimate Interest (Improvement of the Service and collective security) |
4. DATA RECIPIENTS
Your Personal Data is strictly confidential. It is accessible only to:
4.1. Internal Staff
Lelops employees (technical, sales, marketing, and legal teams) on a strict “need-to-know” basis.
4.2. Service Providers (Sub-processors)
We share data with trusted third-party vendors who assist us in operating the Service. We ensure they comply with GDPR requirements.
- Hosting: Google Cloud Platform (GCP) – Location: EU / USA / ASIA
- Payment Processing: Stripe – Location: USA
- CRM & Support: HubSpot – Location: USA
- Analytics: Google Analytics – Location: USA / PostHog – Location: EU Cloud
4.3. Legal Authorities
We may disclose Data if required by law, a court order, or to protect our rights or the safety of others.
5. INTERNATIONAL DATA TRANSFERS
Lelops is based in France. However, some of our service providers are located outside the European Economic Area (EEA), notably in the United States. To ensure the security of your Data, these transfers are governed by appropriate safeguards in accordance with Chapter V of the GDPR:
- Adequacy Decision: Transfers to US organizations certified under the EU-U.S. Data Privacy Framework (DPF).
- Standard Contractual Clauses (SCCs): For providers not certified under the DPF, we have signed the European Commission’s Standard Contractual Clauses to guarantee a level of protection equivalent to that of the EU.
6. DATA RETENTION
We retain your Personal Data only for as long as necessary for the purposes set out in Article 3.
- Active Account Data: Duration of the contractual relationship.
- Audit Data: To comply with Governance requirements, Lelops retains time-stamped configuration states and change logs (who changed what in the Edge setup) for the duration of the contract. The underlying traffic data related to these states is destroyed at the edge.
- Inactive Account Data: Deleted or anonymized 3 years after the last activity (for marketing/prospecting purposes).
- Billing Data: Retained for 10 years (legal accounting obligation in France).
- Technical Logs: Retained for 13 months (security and traceability).
- Recruitment Data: Retained for 2 years after the last contact, unless the candidate requests deletion.
7. SECURITY
We implement state-of-the-art technical and organizational measures to protect your Personal Data against unauthorized access, alteration, disclosure, or destruction. These measures include:
- Encryption of data in transit (TLS 1.2+) and at rest.
- Strict access controls (MFA, RBAC).
- Regular security audits and vulnerability scans.
In the event of a Personal Data breach presenting a risk to your rights and freedoms, Lelops is committed to notifying you and the competent supervisory authority (CNIL) within the legal timeframes (72 hours).
8. YOUR RIGHTS
Under the GDPR, you have the following rights regarding your Personal Data:
- Right of Access: Obtain confirmation as to whether your Data is processed and receive a copy.
- Right to Rectification: Correct inaccurate or incomplete Data.
- Right to Erasure (“Right to be forgotten”): Request the deletion of your Data under certain conditions.
- Right to Restriction: Suspend the processing of your Data in specific cases.
- Right to Portability: Receive your Data in a structured, commonly used format.
- Right to Object: Object to processing based on legitimate interest (e.g., marketing).
- Right to Withdraw Consent: For processing based on consent (e.g., cookies), you may withdraw it at any time.
- Digital Will: In accordance with the French Data Protection Act, you have the right to define general or specific directives regarding the retention, erasure, and communication of your Personal Data after your death.
How to exercise your rights?
You can contact our Privacy Team at: privacy@lelops.ai You can also contact our Data Protection Officer (DPO) regarding any privacy matters at: dpo@lelops.ai We may ask for proof of identity before processing your request. We will respond within one (1) month. If you believe your rights are not respected, you have the right to lodge a complaint with the French Data Protection Authority (CNIL) or your local supervisory authority.
9. COOKIES AND TRACKING
When you visit our Site, cookies may be placed on your device.
- Essential Cookies: Necessary for the Site to function (cannot be refused).
- Analytics & Marketing Cookies: Used to measure audience and target ads. These require your prior consent. You can manage your preferences at any time via the “Cookie Settings” link available in the footer of our Site.
10. CHILDREN’S PRIVACY
Our Service is strictly B2B and is not intended for individuals under the age of 16 (Europe) or 13 (USA/COPPA). We do not knowingly collect data from children.
11. SPECIFIC PROVISIONS FOR UNITED STATES RESIDENTS (CCPA/CPRA)
This section applies solely to residents of California and other US states with similar consumer privacy laws.
11.1. Categories of Information Collected
In the preceding 12 months, we have collected the following categories of “Personal Information” as defined by the CCPA:
- Identifiers: Name, email, IP address, unique personal identifier.
- Commercial Information: Records of products or services purchased.
- Internet Activity: Browsing history, search history, interaction with our website.
- Professional Information: Job title, employer name.
11.2. No Sale or Sharing of Personal Information
Lelops does not “sell” your Personal Information as defined by the CCPA. We do not share your Personal Information with third parties for their direct marketing purposes (“cross-context behavioral advertising”) without your explicit consent.
11.3. Your US Privacy Rights
In addition to the rights listed in Section 8, US residents have the right to:
- Right to Know: Request disclosure of the specific categories and pieces of personal information we have collected about you.
- Right to Delete: Request the deletion of your personal information, subject to certain exceptions (e.g., legal compliance, security).
- Right to Non-Discrimination: We will not discriminate against you (e.g., by denying services or charging different prices) for exercising your privacy rights.
- Authorized Agent: You may designate an authorized agent to make a request on your behalf.
11.4. “Do Not Track” Signals
Our systems do not currently recognize “Do Not Track” signals from web browsers, as no uniform standard has yet been adopted. However, as a stateless platform, Lelops inherently minimizes tracking by design, far exceeding standard “Do Not Track” requirements. To exercise your rights under US laws, please contact us at privacy@lelops.ai with the subject line “US Privacy Request”.
12. INTERNATIONAL USERS (ASIA, LATAM, CANADA)
If you are accessing our Services from regions with specific data protection laws (including but not limited to Brazil (LGPD), Canada (PIPEDA/Law 25), Japan (APPI), or South Korea (PIPA)), the following provisions apply:
12.1. Global Standard of Protection
Lelops applies the GDPR standard widely recognized as the strictest data protection framework globally to all Users. This ensures that regardless of your location, you benefit from high standards of transparency, security, and data rights (access, correction, deletion).
12.2. Brazil (LGPD)
For users in Brazil, the data processing described in this Policy complies with the Lei Geral de Proteção de Dados (LGPD). The legal bases for processing set out in Section 3 apply similarly under the LGPD. You have the same rights as described in Section 8.
12.3. Canada
For users in Canada, Lelops complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial laws (including Quebec’s Law 25).
- Consent: By using the Service, you provide implied consent for the collection and use of information as described. Sensitive data requires express consent.
- Data Transfer: Your data may be processed outside of Canada (in the EU or US) and may be accessible to law enforcement in those jurisdictions.
12.4. Asia-Pacific (Japan, South Korea, Singapore)
- Japan (APPI): We comply with the rules regarding the provision of data to third parties. Our international transfers are based on Adequacy Decisions or equivalent standards.
- Cross-Border Transfer Consent: By using the Service, you explicitly consent to your Personal Data being transferred to, stored, and processed in France (EU) and the United States by our secure sub-processors listed in Section 4.
13. THIRD-PARTY LINKS
Our Service may contain links to third-party websites or applications (e.g., CVE databases, partners). Lelops does not control these external sites and is not responsible for their privacy practices or content. We encourage you to review their privacy policies before providing any Personal Data.
14. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. In the event of a material change, we will notify you by email or via a prominent notice on the Service. The “Last Updated” date at the top of this page indicates when the latest modifications were made.
Contact Information: Lelops SAS, 60 Rue François 1er, 75008 Paris, France – Email: privacy@lelops.ai