Legal
Privacy policy
Last updated: . Lamda SAS, operator of Val-Eight.
This policy explains how Val-Eight collects and uses personal data, and the rights you have over it. It applies to the Val-Eight desktop app, web app, website and marketplace (the "Service").
1. Who is responsible
The data controller is Lamda SAS, 40 rue Pascal, 75013 Paris, France, registered in Paris under number 932 899 008 ("we", "us"). Lamda SAS operates Val-Eight.
For any question about your data or to exercise your rights: [email protected].
Business Customers. When a company uses Val-Eight and its Vals process personal data of its own clients, employees or contacts, that company is the data controller for this data, and we act as its processor. In that case, our Data Processing Agreement applies, available on request at [email protected].
2. The data we collect
Waitlist data. The email address and the answers you give when you join the waitlist, through a form hosted by Tally.
Account data. Name, email address, password (stored hashed), team, role, language and appearance settings.
Billing data. Purchases of credits, amounts, invoices and billing address. Card details are collected and stored by Stripe. We never see or store your full card number.
Your Content. The messages you exchange with your Vals, the instructions, routines and memory of your Vals, and the files they create or handle on their computer.
Data from connected tools. When you connect a tool (for example Gmail, Google Calendar, Slack, Notion or HubSpot), your Vals access the data of that tool that is needed for the tasks you give them, within the permissions you grant. Access tokens are kept in a dedicated secrets system and are never sent to the AI models.
Usage and technical data. Logs of actions and errors, IP address, device and app version, and service metrics (for example the duration of a task or the number of credits used). We use them to run, secure and improve the Service.
Support and feedback. The messages and reports you send us, including from the Bug & Feedback section, and the technical logs you choose to attach.
We do not collect sensitive data on purpose. Please do not give your Vals sensitive data (health, political opinions, religious beliefs and similar) unless it is necessary for your task.
3. Why we use your data, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Managing the waitlist and inviting you to try Val-Eight | Waitlist data | Consent |
| Creating and managing your account and your team | Account data | Performance of the contract |
| Running your Vals, their computers, routines and integrations | Your Content, data from connected tools | Performance of the contract |
| Selling credits, invoicing, keeping accounting records | Billing data | Performance of the contract, legal obligation |
| Answering your requests and handling bug reports | Support data | Performance of the contract, legitimate interest |
| Securing the Service, preventing fraud and abuse | Usage and technical data | Legitimate interest |
| Improving the Service with aggregated statistics | Usage and technical data | Legitimate interest |
| Sending you product news by email | Email address | Consent, or legitimate interest for existing customers |
| Handling content reports on the marketplace | Report and content data | Legal obligation (Digital Services Act) |
- Purpose
- Managing the waitlist and inviting you to try Val-Eight
- Data
- Waitlist data
- Legal basis (GDPR)
- Consent
- Purpose
- Creating and managing your account and your team
- Data
- Account data
- Legal basis (GDPR)
- Performance of the contract
- Purpose
- Running your Vals, their computers, routines and integrations
- Data
- Your Content, data from connected tools
- Legal basis (GDPR)
- Performance of the contract
- Purpose
- Selling credits, invoicing, keeping accounting records
- Data
- Billing data
- Legal basis (GDPR)
- Performance of the contract, legal obligation
- Purpose
- Answering your requests and handling bug reports
- Data
- Support data
- Legal basis (GDPR)
- Performance of the contract, legitimate interest
- Purpose
- Securing the Service, preventing fraud and abuse
- Data
- Usage and technical data
- Legal basis (GDPR)
- Legitimate interest
- Purpose
- Improving the Service with aggregated statistics
- Data
- Usage and technical data
- Legal basis (GDPR)
- Legitimate interest
- Purpose
- Sending you product news by email
- Data
- Email address
- Legal basis (GDPR)
- Consent, or legitimate interest for existing customers
- Purpose
- Handling content reports on the marketplace
- Data
- Report and content data
- Legal basis (GDPR)
- Legal obligation (Digital Services Act)
We do not sell your data and we do not use your content to train AI models.
4. Artificial intelligence
4.1. Vals are AI systems. To complete a task, the content needed for that task (your instructions, the conversation and the relevant data) is processed by AI model providers through OpenRouter.
4.2. Each AI model provider processes this content under its own API terms and may process it in a different country. Most major providers state that they do not use API data to train their models, but we cannot guarantee the practices of every provider. The provider of each model, its location and its data policy are shown on its page at openrouter.ai/models.
4.3. Vals do not make decisions that produce legal effects on you or significantly affect you without human involvement. Sensitive actions require your agreement in the conversation.
5. Who receives your data
Your data is accessible only to the people at Lamda SAS who need it for their work, and to the following providers, who act on our instructions:
- Railway: hosting of the app, the database and your Vals' computers;
- OpenRouter and the AI model providers: processing of the content needed for each task;
- Stripe: payments;
- Resend: sending of transactional emails;
- Tally: the waitlist form;
- Google Workspace: our email, including support conversations.
The full list, with the location of each provider, is on our Third party providers page, which we update before adding a new provider. We may also disclose data when required by law or by a competent authority.
6. Where your data is stored, and transfers outside the EU
6.1. Your data is hosted in the region that matches your account: on servers in the European Union for customers in Europe, and in the United States for customers in the United States.
6.2. Some providers, including OpenRouter and most AI model providers, are located in the United States. Depending on the provider, a request may also be processed in another country. When personal data is transferred outside the European Economic Area, we rely on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, for certified providers) or on the Standard Contractual Clauses adopted by the European Commission.
7. How long we keep your data
| Data | Retention |
|---|---|
| Waitlist data | Until you are invited or ask to leave the waitlist, and at most 3 years after our last contact |
| Account data, Your Content, connected tools | As long as your account is active, then up to 60 days after the account is closed, then deleted |
| Technical logs | 60 days maximum |
| Billing and accounting records | 10 years, as required by French commercial law |
| Support conversations | 3 years after our last exchange |
| Marketing contacts | 3 years after our last contact, or until you unsubscribe |
- Data
- Waitlist data
- Retention
- Until you are invited or ask to leave the waitlist, and at most 3 years after our last contact
- Data
- Account data, Your Content, connected tools
- Retention
- As long as your account is active, then up to 60 days after the account is closed, then deleted
- Data
- Technical logs
- Retention
- 60 days maximum
- Data
- Billing and accounting records
- Retention
- 10 years, as required by French commercial law
- Data
- Support conversations
- Retention
- 3 years after our last exchange
- Data
- Marketing contacts
- Retention
- 3 years after our last contact, or until you unsubscribe
You can delete a Val, a conversation or a file at any time from the app. Deleted items are removed from our backups within the same 60-day period.
8. Your rights
Under the GDPR, you have the right to:
- access your data and receive a copy of it;
- correct inaccurate data;
- delete your data;
- receive your data in a structured, machine-readable format (portability);
- object to processing based on our legitimate interest, and to marketing at any time;
- restrict the processing of your data in certain cases;
- withdraw your consent at any time, when processing is based on consent;
- give instructions on what happens to your data after your death.
To exercise your rights, write to [email protected]. We answer within one month. We may ask you to prove your identity if we have a reasonable doubt.
If you think your rights are not respected, you can file a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of the country where you live.
9. Security
Each Val works on its own isolated computer, and its files and memory are separated from those of other Vals. Data is encrypted in transit. Access tokens to your tools are kept in a dedicated secrets system and never sent to AI models. Access to production systems is restricted to the people who need it.
No system is perfectly secure. If a data breach is likely to put your rights at risk, we will inform you and the CNIL as required by law.
10. Cookies and similar technologies
10.1. The website and the app only use cookies and local storage that are strictly necessary: keeping you logged in, securing your session, and remembering your settings (such as theme, language and the state of the sidebar). These do not require your consent.
10.2. We do not use advertising cookies, and we do not use analytics cookies. The statistics we use to run the Service are measured on our servers, without tracking you across sites.
10.3. If we add analytics or other non-essential cookies in the future, we will ask for your consent first, with the option to refuse as easily as to accept, and we will update this section.
11. Google user data
When you connect a Google account (for example Gmail, Google Calendar, Google Drive or Google Sheets), Val-Eight's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use this data only to provide the features you request from your Vals, we do not use it for advertising, we do not sell it, and we do not use it to train AI models.
12. Minors
The Service is not intended for people under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it.
13. Changes to this policy
We may update this policy. We inform you of any material change by email or in the app before it takes effect. The date at the top shows the last update.
