Privacy policy

SUCHET & BUTTIER, SAS, 102 avenue des Champs-Élysées, 75008 Paris, France, controls processing for its own Loocas websites. Privacy contact: contact@suchetbuttier.com; postal requests can be sent to this address marked “Loocas — personal data”.

This policy describes the presentation version currently available. It does not claim that processing for future accounts, reviews, missions or scans is already operating. Service-specific information will be provided before any real collection.

Log-retention settings and the exact data-centre location still need confirmation. This notice identifies those gaps explicitly and must be finalised before operational processing opens.

Delivering a page requires your IP address and technical information sent by your browser: date and time, requested resource, user agent and, depending on browser settings, referring page. Infrastructure may log access and errors to support availability and security.

The purpose is to deliver the requested website and prevent abuse, based on the publisher’s legitimate interest in operating and securing its services. This data is not used to create an advertising profile. Technical data required to connect cannot be omitted if you wish to load a page.

The loocas-language cookie remembers the language. Its use is explained on the Cookies page.

Login, password-reset and two-factor fields are interfaces in preparation. Submitting a form transmits your inputs to the Loocas server to read the request and return an unavailable or validation status. They are not checked against a real account, saved by the application or sent to Google or Apple.

Passwords and codes must not appear in logs. A temporary per-domain counter limits requests for one minute; it does not create an individual profile. Do not enter real credentials in this version. No authenticated-session cookie is created.

If you contact the publisher, the contact details, message and relevant attachments you provide are used to reply or handle your request. Avoid including sensitive data or unnecessary information about other people.

The lawful basis depends on the request: steps you request before a contract, a legitimate interest in answering a professional enquiry, or a legal obligation for a rights request. Contact details needed for a reply are required only for that purpose; unnecessary attachments remain optional.

An enquiry does not automatically subscribe you to a newsletter. The current website version does not operate a marketing list or collect real reviews.

Access is limited to authorised publisher staff, technical providers for their assigned tasks, and authorities where required by law. Contractual hosting provider: OVH SAS (OVHcloud); confirmed country: to be confirmed by the publisher. Other providers and subprocessors will be identified before the relevant processing opens.

Inter and Inter Tight fonts currently load from Google Fonts. Your browser therefore sends Google a request including your IP address and technical information needed to download the font. This is a font request, not Google sign-in.

Demonstration social visuals are images served by Loocas, with no embedded social player. Google and Apple buttons do not yet call their identity services.

The contractual hosting location must be confirmed in the legal notice: to be confirmed by the publisher. The website does not claim exclusively French or European hosting without that confirmation.

Loading Google Fonts may involve Google’s international infrastructure under that provider’s terms. Google’s privacy policy describes its applicable transfer mechanisms. Loocas does not present Google or Apple as active authentication providers.

Before any other transfer outside the European Economic Area, the recipient entity, country and appropriate mechanism must be documented and disclosed; publishing general terms alone does not make a transfer lawful.

Language cookie: up to 12 months from storage, renewed on a subsequent localised visit; it can be deleted in your browser. Data submitted to a closed login form: only for processing the request, without persistent application storage. Rate-limit counter: one minute in memory.

For loocas.io, raw access logs are processed every 24 hours; archiving is enabled and the previous month’s archives are removed at the end of the current month, roughly two calendar months at most unless an incident justifies preservation. Other infrastructure-log settings still need verification.

For future enquiry handling, the proposed rule is the handling period plus 12 months after an ordinary enquiry closes. Evidence strictly necessary for a right or dispute may be separately archived for the applicable statutory period with restricted access. Identity documents needed for verification are deleted afterwards unless a specific legal obligation applies. This organisation must be implemented in the chosen contact channel before it opens.

Depending on the processing and its lawful basis, you may request access, rectification, erasure, restriction and portability, and object to processing. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. You may also provide instructions recognised by French law about your data after death.

Write to contact@suchetbuttier.com or the postal address above. Identify the service and information needed to locate your request. Identity evidence is requested only where there is reasonable doubt and must be proportionate. Exercising rights is generally free.

A reply is normally provided within one month of receipt. For complex or numerous requests, an extension of up to two further months may be explained within the first month. Some obligations may justify retaining data despite an erasure request; the reason will be explained.

You may complain to the CNIL at cnil.fr or to Commission nationale de l’informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. You do not have to wait for an amicable process to exercise a statutory remedy.

Each future collection will specify its data, lawful basis, recipients, retention and rights. Collection on a merchant’s instructions will require a data processing agreement; network distribution needs a separate assessment of responsibilities and rights and is not authorised by default through that agreement.

Directory social data will be limited to authorised, relevant information. Added-up followers will not be described as a deduplicated unique audience. Score methodology, sources, date, limitations and a correction route will be accessible before use. No rejection with legal or similarly significant effects should rely solely on an automated score.

A future app’s camera and any location access will require appropriate permissions. The current service accesses neither camera nor location. Displayed AI summaries are illustrative, with no current transfer of reviews to an AI provider. New processing cannot be activated retroactively by simply changing this page.

The planned process examines a review, the complaint grounds and only necessary evidence. Protecting review integrity and preventing abuse may rely on legitimate interests after assessing necessity and individuals’ rights; a legal obligation may also apply to particular requests. Those bases do not automatically make a fully automated decision lawful.

AI may decide to retain, remove or request clarification only within a legally authorised scope. Its role, criteria, evidence and limitations will be explained. Ambiguous or sensitive cases, or decisions potentially producing legal or similarly significant effects on a person, will be referred to a human before the measure unless a lawful exception and its safeguards have actually been established.

Remedies that must be free remain free and allow meaningful human intervention. Any separately charged commercial assessment neither buys removal nor conditions the exercise of a right. The detailed process is in “Complaints and AI moderation”.

The model provider, processing locations, instructions, case-retention period and non-reuse safeguards must be contractually defined and transparently disclosed before activation. No real case should be sent to a model until that framework, risk assessment and security measures are validated. No decision engine operates on real reviews in the current version.