Privacy Policy

Data controller

Florin Livada, sole trader — SIRET 44198112300025 — Castellane (04120, France)
GDPR contact: [email protected]

1. Preamble

Livada Cockpit is a SaaS tool for businesses (hotels, restaurants, spas, healthcare, legal and accounting professionals, shops and services) to manage customer reviews from Google Business Profile, Booking.com and TripAdvisor. Other platforms are being considered; support for them is not committed and no date is promised.

This policy explains what data we collect, for what purpose, how long we keep it, and what your rights are.

2. Personal data collected

2.1 Business customer data (subscriber)

2.2 Reviewer data (collected reviews)

Cockpit collects the public reviews left by your customers on connected platforms (username, rating, text, date, source URL, detected language). We never collect private emails, postal addresses, phone numbers, banking data, or identifying medical data.

3. Purposes of AI processing

Google (Gemini), OpenAI and Anthropic (Claude) may draft Cockpit's replies depending on the AI routing. The review text is sent to the selected model, then returned for validation.

The AI providers receive the review text and the context needed to generate the reply. Their own terms apply, in particular regarding reuse of data depending on the plan used: Livada does not currently guarantee a configuration excluding training of their models at each of them.

4. Hosting and sub-processors

5. Retention period

• Active customer account: for the duration of the subscription
• Data after cancellation: deletion on request sent to [email protected]
• Free trial not converted into a subscription: your data is kept for 30 days after the trial ends, so that you can subscribe and find everything again. You can ask for it to be deleted at any time at [email protected].
• Invoices: 10 years (statutory tax obligation)
• Technical logs: kept according to the host's (Cloudflare) settings
• Collected reviews: kept for the duration of the subscription; deletion on request
• OAuth tokens: until revoked by the customer

6. Your GDPR rights

In accordance with the GDPR (EU 2016/679), you have the following rights:

• ✓ Access: obtain a copy of all your data
• ✓ Rectification: correct inaccurate data
• ✓ Erasure ("right to be forgotten"): deletion of account + data
• ✓ Portability: JSON export of your reviews and configurations
• ✓ Objection: refuse processing based on legitimate interest
• ✓ Withdrawal of consent at any time

To exercise these rights: email [email protected] with proof of identity. Response within 30 days.
You may lodge a complaint with the CNIL.

7. Security

• TLS 1.3 encryption for all communications
• At-rest encryption of Cloudflare D1 data, provided by the platform
• No passwords stored in plain text
• GDPR / AI Act audit logs for all AI actions
• No commercial sharing of data with third parties

8. Sector-specific rules

For customers in the healthcare, legal, and accounting sectors, confidentiality rules specific to the profession are added to every request sent to the AI:

• Healthcare: no medical information of any kind allowed in public replies (GDPR art. 9)
• Legal: no promise of judicial outcome allowed (Bar Association)
• Accounting: no personalised public advice allowed (Ordre des Experts-Comptables)

An AI may not follow them: you review and approve every reply before it is published.

9. Changes

Material changes will be notified by email to active customers 30 days before they take effect. The version in effect is always available at https://livada.io/en/legal/privacy.