Privacy policy
This policy describes the personal data Mazlo processes, why, for how long, and your rights, under Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act. This English version is provided for information; the French version prevails.
Two distinct roles
- Controller: for your account, billing, support and site-security data. This policy describes them.
- Processor: for the content you send to the API (messages, documents, model outputs). You remain the controller of that content, and we process it only on your instructions, under the data processing agreement (DPA) concluded with you under article 28 GDPR.
Controller
Mazlo, 82 rue Pierre Lalumière, 33320 Eysines, France. Contact for any question about your data: rgpd@bretelle.eu.
Data processed, purposes and legal bases
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email, name, Google or Microsoft sign-in identifier if you use them | Create and secure your account | Performance of the contract | Life of the account, then 3 years for disputes |
| Company identity, VAT number, e-invoicing address | Invoice and meet our accounting and tax obligations | Legal obligation and contract | 10 years (article L.123-22 of the French Commercial Code) |
| Payment information | Collect your credit purchases | Performance of the contract | Handled by our payment provider; we do not store card numbers |
| Crossing log: date, key, requested zone, served zone, model, token count | Give you residency evidence and compute your usage | Performance of the contract | 12 rolling months, exportable at any time |
| Technical logs: IP address, timestamps, errors | Security, abuse prevention, troubleshooting | Legitimate interest | 12 months |
| Support exchanges | Answer your requests | Performance of the contract | 3 years after the last exchange |
Content sent to the API
We do not keep the content of your requests and responses beyond the time needed to process them. The crossing log holds only metadata, never content.
We never use your data to train models, and we choose hosts that make the same commitment.
Recipients and sub-processors
| Sub-processor | Role | Location |
|---|---|---|
| Scaleway SAS (France) | Hosting of the site and API, database, email sending, model execution in the EU zone | France |
| OVHcloud SAS (France) | Model execution in the EU zone | France |
| Mistral AI SAS (France) | Execution of Mistral models in the EU zone | European Union |
| Infomaniak Network SA (Switzerland) | Model execution in the CH zone | Switzerland |
| Stancer | Credit payments | France |
| OpenAI, Anthropic, Google | Execution of proxy models, only for requests you send in the proxy zone | United States |
The current sub-processor list is in the DPA, and we inform you of any change before it takes effect.
Transfers outside the European Union
- CH zone: Switzerland benefits from a European Commission adequacy decision.
- Proxy zone: requests you choose to send in the proxy zone are processed in the United States. These transfers are covered by the European Commission's standard contractual clauses and, where the vendor is certified, by the EU-US Data Privacy Framework. The EU and CH zones transfer no data to the United States.
- Sign-in with Google or Microsoft: if you choose this sign-in method, these providers process your authentication under their own policies. Sign-in with a code sent by email involves no third party outside the Union.
Cookies
The site uses only strictly necessary cookies: the session cookie that keeps you signed in, and your language preference. They are exempt from consent (article 82 of the French Data Protection Act). No advertising cookies, no audience measurement, no third-party trackers.
Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to set instructions for your data after your death. Write to rgpd@bretelle.eu; we answer within one month.
If you believe your rights are not respected, you may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at cnil.fr, or with the supervisory authority of your country.
Security
Encrypted connections (TLS), API keys stored hashed, access restricted to authorised staff, logging of administrative access.
Changes
We inform you by email of any substantial change to this policy before it takes effect.