Privacy Policy
Last updated: February 18, 2026
1. Data Controller
Valeron Labs is an AI research laboratory operated under Hexa, the startup studio.
Data Controller: Valeron Labs (Hexa)
Address: Paris, France
Email: privacy@valeronlabs.ai
Website: valeronlabs.ai
We are committed to protecting your personal data in compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and applicable French data protection laws.
2. Scope of This Policy
This Privacy Policy applies to all personal data collected through our website (valeronlabs.ai), contact forms, email communications, and any other interactions you may have with Valeron Labs. It describes our practices regarding the collection, use, storage, and disclosure of your personal information.
3. Categories of Personal Data Collected
We collect and process the following categories of personal data:
3.1 Data You Provide Directly
- Identity Data: Name, professional title, organization
- Contact Data: Email address
- Communication Data: Content of messages sent through our contact form
- Professional Data: Information about research interests or collaboration inquiries
3.2 Data Collected Automatically
- Technical Data: IP address, browser type and version, operating system, device type
- Usage Data: Pages visited, time spent on pages, navigation paths, referral sources
- Cookie Data: Information collected through cookies and similar technologies (see Section 11)
4. Legal Basis for Processing (Article 6 GDPR)
We process your personal data only when we have a valid legal basis under GDPR:
Consent (Art. 6(1)(a))
For non-essential cookies and analytics. You can withdraw consent at any time.
Contract Performance (Art. 6(1)(b))
To respond to your inquiries and process collaboration requests.
Legitimate Interests (Art. 6(1)(f))
To improve our website, ensure security, and conduct internal analytics. Our legitimate interests do not override your fundamental rights.
Legal Obligation (Art. 6(1)(c))
To comply with applicable laws and regulations.
5. Purpose of Processing
We process your personal data for the following specific purposes:
- Responding to contact form submissions and inquiries
- Processing research collaboration requests
- Managing recruitment and career applications
- Improving website functionality and user experience
- Analyzing website traffic and usage patterns
- Ensuring website security and preventing fraud
- Complying with legal and regulatory obligations
- Sending relevant communications (only with your consent)
6. Data Retention Periods
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:
| Data Type | Retention Period |
|---|---|
| Contact form submissions | 3 years from last contact |
| Collaboration inquiries | 5 years or duration of partnership |
| Analytics data | 26 months (anonymized thereafter) |
| Server logs | 12 months |
| Cookie consent records | Duration of consent + 1 year |
After the retention period expires, data is securely deleted or anonymized.
7. Recipients and Data Sharing
We do not sell your personal data. We may share your data with the following categories of recipients:
- Hexa: Our parent company for operational and administrative purposes
- Hosting Providers: Vercel (website hosting)
- Analytics Providers: For anonymized website analytics
- Legal Authorities: When required by law or to protect our rights
All third-party processors are bound by Data Processing Agreements (DPAs) ensuring GDPR-compliant handling of your data.
8. International Data Transfers
Some of our service providers may process data outside the European Economic Area (EEA). When this occurs, we ensure appropriate safeguards are in place:
- Adequacy Decisions: Transfers to countries with EU adequacy decisions
- Standard Contractual Clauses (SCCs): EU-approved contractual protections
- Data Privacy Framework: For US-based processors certified under the EU-US DPF
You may request a copy of the safeguards in place by contacting us.
9. Your Rights Under GDPR
As a data subject, you have the following rights under GDPR:
Right of Access (Art. 15)
You have the right to obtain confirmation of whether we process your personal data and to receive a copy of that data.
Right to Rectification (Art. 16)
You have the right to request correction of inaccurate personal data or completion of incomplete data.
Right to Erasure "Right to be Forgotten" (Art. 17)
You have the right to request deletion of your personal data when it is no longer necessary, you withdraw consent, or the data was unlawfully processed.
Right to Restriction of Processing (Art. 18)
You have the right to request limitation of processing while we verify accuracy or assess a legitimate interest objection.
Right to Data Portability (Art. 20)
You have the right to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller.
Right to Object (Art. 21)
You have the right to object to processing based on legitimate interests, including profiling. We will cease processing unless we demonstrate compelling legitimate grounds.
Rights Related to Automated Decision-Making (Art. 22)
You have the right not to be subject to decisions based solely on automated processing that produce legal or significant effects. We do not currently engage in such automated decision-making.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
10. How to Exercise Your Rights
To exercise any of your rights, please contact us:
Email: privacy@valeronlabs.ai
Please include "GDPR Request" in the subject line and provide sufficient information for us to verify your identity.
Response Time: We will respond to your request within 30 days. If your request is complex, we may extend this by an additional 60 days with prior notice.
No Fee: Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.
11. Cookies and Tracking Technologies
Our website uses cookies and similar technologies. Here is how we use them:
Essential Cookies
Required for website functionality. Cannot be disabled. Legal basis: Legitimate interest.
Analytics Cookies
Help us understand how visitors interact with our website. Legal basis: Consent.
Managing Cookies
You can control cookies through your browser settings. Note that disabling certain cookies may affect website functionality.
12. Data Security Measures
We implement appropriate technical and organizational measures to protect your personal data, including:
- HTTPS/TLS encryption for all data in transit
- Encryption of data at rest
- Access controls and authentication
- Regular security assessments
- Employee training on data protection
- Incident response procedures
While we strive to protect your data, no system is 100% secure. In the event of a data breach affecting your rights, we will notify you and the relevant supervisory authority as required by GDPR.
13. Children's Privacy
Our website is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately at privacy@valeronlabs.ai and we will take steps to delete such information.
14. Supervisory Authority
If you believe that our processing of your personal data violates GDPR, you have the right to lodge a complaint with a supervisory authority. For France, this is:
CNIL (Commission Nationale de l'Informatique et des Libertés)
3 Place de Fontenoy, TSA 80715
75334 Paris Cedex 07, France
We encourage you to contact us first so we can address your concerns directly.
15. Third-Party Links
Our website may contain links to third-party websites (e.g., Hexa). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal data.
16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will:
- Update the "Last updated" date at the top of this page
- Post a notice on our website for significant changes
- Obtain new consent where required by law
We encourage you to review this policy periodically.
17. Contact Us
For any questions about this Privacy Policy or our data practices, please contact us:
Privacy Inquiries: privacy@valeronlabs.ai
General Contact: research@valeronlabs.ai
You can also reach us through our contact page.