Privacy policy

1. Data controller

The data controller is i2NV8 GROUP (SASU), whose registered office is at 30 Rue Ernest Cognacq, 11100 Narbonne, France. Contact: thomas@noctalis.digital.

2. Data collected and purposes

Noctalis may collect the information entered in its contact, studio booking and project estimation forms: name, company, email address, telephone number, message, booking details, selected options and project description.

These data are used to answer requests, prepare estimates, manage studio bookings, contact the requester and provide the services requested.

3. Legal bases

Contact and estimation requests are processed on the basis of pre-contractual measures taken at the requester’s request. Studio bookings are processed to take pre-contractual measures or perform the requested service. Any commercial prospecting based on consent requires a separate, optional consent.

4. Recipients and service providers

Data may be accessed by authorised Noctalis staff and the providers needed to operate the website and its features: OVH (website hosting, as stated in the legal notice), Amazon Web Services (email delivery through Amazon SES), MongoDB (booking database), OpenAI (the estimation questionnaire and translation API), and Amazon Bedrock (AI automations). Data is shared only as needed for these purposes.

5. AI features and international transfers

The project description entered in the AI questionnaire is sent to the OpenAI API to pre-fill the estimation questions. OpenAI states that API data is not used to train its models by default. Under the standard API setting, abuse-monitoring logs that may contain prompts and responses are retained for up to 30 days; Zero Data Retention or Modified Abuse Monitoring requires approval and may not be enabled for Noctalis. AI automations may also use Amazon Bedrock. Bedrock does not ordinarily store inputs and outputs durably, but model-specific abuse-detection exceptions and account retention settings may apply. Do not enter sensitive data or information about another person.

OpenAI’s data processing terms identify OpenAI Ireland Ltd. as the provider for customers in the EEA and provide for approved transfer safeguards, including the EU Standard Contractual Clauses where required. AWS processing location depends on the Bedrock region and any cross-region inference profile configured for the service. Noctalis must verify the settings and terms active for its accounts.

6. Retention periods

Contact requests and related callback details are kept for up to 3 years after the last contact from the prospect, then deleted unless a legal obligation or dispute requires restricted archival. Confirmed studio bookings are automatically deleted after 3 years; temporary booking holds expire after 15 minutes. Project descriptions are not stored in Noctalis’ application database. OpenAI API abuse-monitoring logs may retain prompts and responses for up to 30 days by default; Amazon Bedrock generally does not durably store inputs and outputs, subject to model-specific exceptions and account settings. Rate-limit IP data is held in memory for 10 minutes and is not persisted by the application.

7. Your rights

You may request access, rectification, erasure, restriction, objection and, where applicable, data portability. Where processing is based on consent, you may withdraw it at any time without affecting prior processing. Send requests to thomas@noctalis.digital.

You may also lodge a complaint with the French data protection authority (CNIL).

8. Cookies and trackers

The website currently loads no analytics, advertising or chat trackers, and no third-party video is embedded. The application does not set a consent cookie. Any non-essential tracker added in the future must be documented and blocked until consent is obtained.

9. Security

Noctalis implements reasonable technical and organisational measures to protect personal data, including input validation, access restrictions, security headers and anti-abuse measures.