Privacy policy
This English version is a translation provided for convenience. The French version prevails.
Last updated: October 18, 2026.
Data controller
LVLUP, 20 rue Louis Feuillée, 13013 Marseille, France. Contact for any question about your data: contact@lvlup.fr.
Data collected and purposes
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Last name, first name, email, encrypted password, language | Manage your account and your team | Performance of the contract | Until the account is deleted, then 30 days |
| Selfie | Generate your portraits | Your consent | 7 days after the portraits are delivered |
| Generated portraits | Deliver your portraits | Performance of the contract | 90 days after delivery |
| Main portrait of the team administrator | Serve as a style reference for the other team members | Performance of the contract | As long as the team exists |
| Billing details, VAT number | Invoice your purchases | Legal obligation | Statutory accounting periods |
| Browsing data on the sales page | Measure the audience | Your consent | 13 months at most |
| Affiliate invoices (company, SIRET or VAT number, IBAN shown on the invoice) | Pay affiliate withdrawals | Legal obligation | Legal accounting retention periods |
| Date, time and text of the consents given | Prove your consent | Legal obligation | As long as the related data is kept |
Your data is never sold. Your photos are never published or used to train an artificial intelligence model.
Processors
- OpenAI (OpenAI Ireland Ltd, Ireland): generation of the portraits from your selfie.
- Stripe: payment.
- Qonto: invoicing.
- Mailjet: sending emails.
- Google Analytics: audience measurement of the sales page, only with your consent.
- Scaleway: hosting of the website and the data.
Some of these processors process data in the United States. For OpenAI, the contract is with OpenAI Ireland Ltd, and transfers to the United States are governed by the European Commission's standard contractual clauses of 4 June 2021. For the others, transfers are governed by the EU-US Data Privacy Framework or by the same clauses, depending on the processor.
Cookies
The sales page uses Google Analytics to measure its audience. This cookie is only set after your consent, collected by the consent manager. You can change your choice at any time with the "Cookie settings" link at the bottom of the page. Cookies required for your account to work do not require consent.
When you arrive through an affiliate's link, an affiliate cookie stores their code for 30 days, to credit the referral to that affiliate if you create a team. It only contains the affiliate's code, no data about you: it is set without asking for your consent, on the basis of our legitimate interest in paying our affiliates. It is listed in the cookie manager.
Your rights
You have the right to access, rectify, erase, restrict, object to the processing of, and port your data. You can withdraw your consent at any time. To exercise these rights, write to contact@lvlup.fr.
You can delete your account from your settings. Deletion becomes final 30 days after the request. During this period, you can reactivate your account by logging in again.
If you believe your rights are not respected, you can file a complaint with the CNIL, the French data protection authority.