Privacy Policy

Data controller

Florin Livada, sole trader — Castellane (04120), France — SIRET 44198112300025. Contact: [email protected].

Data collected

• When purchasing: name, email, billing address, banking data (handled exclusively by Lemon Squeezy — we store no banking data).
• When joining a waitlist: email + first name (optional).
• When sending a form message: name, email, message content.
• Audience measurement: Cloudflare Web Analytics — anonymous, cookie-free, no cross-site tracking. Google Analytics and an affiliate cookie are only activated after your consent (see “Cookies and trackers” below).
• Internal visit counter, without cookies: for each page view, Livada records the date and time, the page viewed, the device category (mobile, tablet or desktop) and the source category (for example search engine, AI assistant, direct access). For links we publish with a campaign tag (the utm_campaign parameter) from a closed list of tags that we control, a counter aggregated per day and per tag is also kept. No IP address, identifier or user-agent is recorded; any address parameter value outside that list is not retained.

Legal bases

• Performance of the contract: purchases, licence delivery, support.
• Consent: newsletter, waitlist, contact form.
• Legal obligations: invoicing, 10-year accounting retention.
• Legitimate interest: anonymous audience measurement, site security, commercial outreach to professionals (see below).

Retention

• Customer accounts: 3 years after last activity.
• Billing data: 10 years (accounting obligation).
• Waitlist / newsletter sign-ups: until consent is withdrawn.
• Contact messages: 2 years.
• Internal visit counter: the detailed log (date and time, page, device, source) is deleted automatically after 25 months; the daily aggregated counters, which contain no individual data, are kept.
• Log of Cap, Livada’s AI sales assistant (fingerprints, never the text): 12 months (see below).

Hosting and sub-processors

We use the following sub-processors, with EU edge/hosting preferred:

• Cloudflare: site hosting, D1 storage and edge/reverse-proxy infrastructure (EU edge preferred; company established in the United States).
• Lemon Squeezy (Merchant of Record): payment and invoicing (United States). No banking data is stored by Livada.
• Brevo (formerly Sendinblue): transactional emails (EU — France).

Transfers outside the EU. Where a sub-processor (notably Cloudflare or Lemon Squeezy) carries out a transfer outside the EU/EEA, it is framed by a valid mechanism under Chapter V of the GDPR: EU-US Data Privacy Framework adequacy decision (10/07/2023) where the importer is certified, and/or Standard Contractual Clauses of the Commission (art. 46) with supplementary measures (the SCCs serving as a fallback basis). No data is resold.

Livada Edge SEO — processing as a processor

When you use Livada Edge SEO, the traffic of your site's visitors transits through our optimisation infrastructure. In this respect, Livada acts as a processor (GDPR art. 4-8) on your behalf, with you (or your end client) being the controller. The conditions are governed by our Data Processing Agreement (DPA), which is provided to you and prevails for personal data.

• Data processed (in transit): connection IP address, user-agent, requested URL, headers, page content of your site's visitors. No retention beyond the technical transit, no profiling, no resale.
• Purpose & legal basis: provision of the optimisation service, on the controller's instruction (the legal basis for processing visitor data lies with the controller — your site).
• Retention: strictly the time necessary for relay/injection (transit); configuration records are deleted on termination.
• Sub-processors: Cloudflare (edge infrastructure), Brevo (emails), Lemon Squeezy (payment) — see Annex 1 of the DPA.
• Transfers outside the EU: framed (EU-US DPF and/or Standard Contractual Clauses + supplementary measures); EU edge preferred.
• Data-subject rights: visitors exercise their rights with the controller (the site publisher); Livada assists as far as possible given the “transit” nature of the processing.

Livada Clarté — data processed and recipients

Data collected. At order: email address, name, name and official website of each establishment, the text of your Google listing, the address of the Booking.com listing and the text of that listing (which you paste yourself), consents recorded (date, acceptance of the Terms and of the data processing agreement). During the service: public content of the official website, reports produced. These contents are not meant to collect personal data; they may contain some incidentally (a manager's name or phone number, for example).

Purposes and legal bases. Performance of the contract: delivering the service, producing and sending reports, invoicing and support. Legitimate interest: security, abuse prevention. Legal obligations: accounting retention.

Artificial intelligence. To write the reports, the compared texts are sent to an artificial intelligence model provided by Anthropic, PBC (United States). The report is produced automatically, without prior human review, and involves no decision producing legal effects concerning you.

Recipients and sub-processors. Anthropic, PBC (AI model analysis, United States); Brevo (email delivery, France); Cloudflare (hosting and infrastructure); Lemon Squeezy (payment and invoicing, on its own behalf, United States). No data is resold.

Transfers outside the EU. Transfers to the United States rely on the European Commission's standard contractual clauses (art. 46 GDPR), incorporated in Anthropic's data processing terms, and/or on the EU-US Data Privacy Framework adequacy decision (10 July 2023) where the importer is certified.

Retention. Reports: 12 months after sending; texts and addresses provided: 90 days after the subscription ends; order and consent data: duration of the subscription then 3 years; invoicing: 10 years.

Your rights. Access, rectification, erasure, restriction, objection, portability, withdrawal of consent where consent is the legal basis, complaint to the CNIL, by writing to [email protected]. Reply within 30 days at most.

Livada AgentRadar — data processing

When you order Livada AgentRadar, Livada processes the data necessary to perform the service in order to analyse the website and question you provided, carry out the measurements required by the protocol, evaluate the responses obtained, produce the report and send it to you. The legal basis for this processing is the performance of the contract.

The data processed may include: the email address used for the order; the address of the website and pages analysed; the question provided by the Customer; the visible text of the pages consulted; links contained on those pages; facts derived from the website content and the quotations supporting those facts; responses produced by the artificial intelligence agents; evaluations of those responses; the last page consulted; and the technical information, hashes, costs and statuses necessary to perform and monitor the measurement.

Livada uses OpenAI and Anthropic to perform certain artificial intelligence operations required for AgentRadar. Both providers may be used as agents; each response produced by an agent is evaluated by a model from the other provider. Fact derivation uses an OpenAI model to propose facts and an Anthropic model to verify them.

For fact derivation, the Customer's question, the URL and the visible text of candidate website pages, up to a maximum of five pages, may be transmitted to these providers. For measurement runs, the question, URL, visible text of the pages consulted, links and the agent's previous actions may be transmitted. For evaluation of responses, the question, the agent's final response, the facts together with their supporting quotations and the last page consulted may be transmitted.

Livada does not intentionally transmit the Customer's name or email address to the artificial intelligence providers. However, the question is transmitted as entered by the Customer. If the Customer includes personal data or confidential information in the question, that information may therefore be transmitted to the providers used to perform the service. Customers are advised not to include personal data, secrets, credentials, passwords or other confidential information in a question submitted to AgentRadar.

Data necessary to perform the service are also processed by Cloudflare, which is used to host the engine and send emails, and by Lemon Squeezy, which acts as Merchant of Record for payment and invoicing. The order status, including in particular the email address, website and question, is also recorded in the livada.io infrastructure. The engine's technical execution logs contain the order reference and status but do not contain the Customer's email address.

Measurement logs and order status retained on the AgentRadar engine are kept for a maximum of twelve months and are then deleted or anonymised when they are no longer required. This period does not alter the retention periods applicable to accounting, tax or payment records retained by Lemon Squeezy or required to be retained under a legal obligation.

OpenAI and Anthropic are accessed using their standard endpoints, with no processing region imposed by the configuration currently in use. Some processing may therefore take place outside the European Union or the European Economic Area, including in the United States. Those transfers are governed by the providers' data processing agreements, which provide for the standard contractual clauses adopted by the European Commission.

Under the GDPR, and subject to the conditions laid down by applicable law, you may exercise your rights of access, rectification, erasure and restriction of processing and, where applicable, your right to data portability. You may also lodge a complaint with the CNIL. The general procedure for exercising these rights and the relevant contact details are set out in this Privacy Policy.

Livada SEO — optional remote services

Three optional features of the Livada SEO plugin exchange data with Livada's servers: Rank Tracking, AI Citations and Visibility Receipt. They do so only if you use them; once enabled, Rank Tracking and AI Citations query our servers every week. You can never enable them, or stop using them, without losing the rest of the plugin. The legal basis for this processing is performance of the contract.

Rank Tracking sends Livada your site address, your Search Console property address, the list of keywords you track, the requested period and your licence key. AI Citations sends your site address, the AI provider you chose, the list of questions to test and your licence key; if you entered your own access key for that provider, it is sent so that the measurement runs on your account and at your cost. Today, the only supported provider is Perplexity. Visibility Receipt sends Livada the public address of each language version of a page, to measure its visibility to AI assistants.

Recipients. For AI Citations, the questions to test are sent to Perplexity, which runs them; without a key of your own, Livada uses its own key for a single test question. The key you enter is used only to relay your request: our server does not store it in its database. Perplexity's processing, including any transfers outside the European Union, depends on that provider; see its privacy policy. For Rank Tracking, positions are obtained from Google through the Search Console API for the property you indicated.

Retention. Rank Tracking: our server does not keep the positions returned to the plugin; they are stored on your site. AI Citations: for each measurement, Livada keeps the site address, the questions, the results (cited or not, rank, competitors and sources cited) and a fingerprint of your licence key, for 12 months from the measurement, then deletes them automatically; they are deleted earlier on simple request at [email protected]. Visibility Receipt: the address sent is used for the measurement requested.

To exercise your rights or ask a question about this processing, write to [email protected]; see also the "Your rights (GDPR)" section below.

Cap, Livada’s AI sales assistant (/en/sales-assistant/)

What we keep. For each question asked: a hashed fingerprint of the message (sha256, which cannot be turned back into the text), its length, the random conversation identifier, the time, the language and the outcome of the answer (information shown, purchase link shown or not). Never the text of the message, never your identity: no name, no email, no IP address in this log.

Why. To check that Cap only answers with information verified by Livada, and to improve it. Legal basis: our legitimate interest (article 6.1.f GDPR). To limit abuse, a fingerprint of the IP address is used to count questions per hour.

Who processes the message. To understand the question, its text is sent to an artificial intelligence model provided by Anthropic, PBC (United States), which chooses among answers that have already been verified; it does not write the answer itself. Transfers outside the EU are framed as described in “Hosting and sub-processors” above.

How long. 12 months, then automatic deletion.

Commercial outreach to professionals

Who is writing to you. Livada AI is an artificial-intelligence assistant that writes and sends these messages under the responsibility of Florin Livada, data controller (see “Data controller” above).

Data concerned. Your professional email address, the name of your business, your website address and a technical finding about your public pages (for example the title shown by a translated page). We keep the address, the business name, the message subject, the date and the delivery status (sent or failed); for a person who has objected, or whose address rejected a message, the address, the reason and the date.

Where it comes from. Your public website (contact page or legal notice) and, to find sites, open directories (for example OpenStreetMap). We buy no lists and never guess an address.

Purpose and legal basis. To point out something observable on your site and, if it concerns you, to introduce Livada Match. Legal basis: our legitimate interest in making a professional aware of a service related to their activity (GDPR art. 6(1)(f)).

Who receives this data. Brevo (sending the messages, France); Cloudflare (hosting and database); Anthropic, PBC (artificial-intelligence model that helps write the messages, United States). Brevo also records that the message was sent, whether it was opened, and clicks on its links. Transfers outside the EU are framed as described in “Hosting and sub-processors” above. No data is resold.

How long. Three years at most after the last exchange (last message sent or last reply received). The address of a person who has objected is kept on an opt-out list, for the sole purpose of honouring their refusal.

Your rights. Access, rectification, erasure, restriction, objection, portability. You can object at any time, free of charge: “unsubscribe” link at the bottom of every message (immediate effect), or a reply to that message, or an email to [email protected] (handled by hand, reply within 30 days at most). You may also lodge a complaint with the CNIL.

Your rights (GDPR)

You have the following rights at any time:

• Right of access, rectification, erasure
• Right to portability
• Right to object and to restriction of processing
• Right to withdraw your consent
• Right to lodge a complaint with the CNIL

To exercise your rights, write to [email protected]. Response within 30 days maximum.

Cookies and trackers

By default, no measurement, tracking or affiliation cookie is set. These trackers load only after your explicit consent via the cookie banner (Consent Mode v2, refusal as simple as acceptance). Your choice is kept for 6 months.

If you accept, the following trackers may be enabled:

• Google Analytics 4 (audience measurement, anonymised IP) — to understand which pages are useful. No data sold.
• Meta Pixel (campaign measurement, if enabled) — to assess the effectiveness of our occasional ads.
• Lemon Squeezy affiliate tracking — to credit the partner who referred you, within our affiliate programme. Cookie duration: 60 days.

If you refuse, none of these trackers is loaded and your browsing stays anonymous. You can change your choice at any time by clearing the site data in your browser.