HomePrivacy policy
Privacy policy
Last updated: 20 August 2026
This policy explains what personal data Lif8 collects, why, how long it keeps that data, who it passes it on to, and what rights you can exercise.
It is written to be read. If anything seems unclear, write to us at contact@lif8.co: answering is also an obligation we meet.
1 · Who is responsible for your data
The data controller is Lif8, whose registered office is at 58 rue de Monceau, 75008 Paris, registered under number 102 393 733.
Contact: contact@lif8.co
Lif8 is not required to appoint a data protection officer and has not appointed one. Any request concerning your data is handled at contact@lif8.co.
2 · What we collect
2.1 When you write to us
Your surname and first name, your email address, your telephone number if you provide it, and the content of your message.
2.2 When you complete “The Lif8 Protocol”
“The Lif8 Protocol” is the commercial name of “The Lif8 Protocol”. It takes the form of a structured questionnaire about a living space. It collects:
The applicant’s identity and contact details: surname, first name, email address, telephone number.
The address of the property assessed, its postcode, its town, its country and, where applicable, its geographical coordinates. This address is the only information in the questionnaire that triggers an automated query of public environmental registers. Those registers return values relating to the place, never to you.
The characteristics of the property: type, occupancy status, year of construction, floor area, number of rooms, storey, presence of a pool.
Information about the people who occupy the home: how many there are, the age of each of them, their situation, and any specific sensitivity they may have.
This last point deserves careful reading. The specific sensitivity fields (asthma, allergies, ongoing pregnancy, respiratory treatment) constitute data concerning health within the meaning of Article 9 of the GDPR. They benefit from enhanced protection. They are optional: the assessment can be carried out without them. They are processed only if you consent to this explicitly, by means of a dedicated tick box, separate from acceptance of the general terms and conditions. You may withdraw that consent at any time.
Their only use is to bring to the top of the recommendations those that concern sensitive individuals. They are not used in any score calculation. They are never passed on to a third party for commercial purposes, are never used for marketing purposes, and are never disclosed to an insurer, an employer or a credit institution.
Your answers to the questionnaire, together with the photographs and documents that you choose to upload: plans, an overview video, photographs of rooms, invoices, product data sheets, official statements, certificates and analysis reports.
Photographs of an interior may show people, or reveal aspects of your private life. Photograph only what the instructions ask for, and remove anything you do not wish to send us.
2.3 When you purchase a service
Billing data, the reference and the amount of the transaction. Payment is handled by our provider: we neither receive nor store your full bank card number.
2.4 When you browse the site
See the Cookie policy. No audience measurement is placed without your prior agreement.
3 · Data about people other than you
The questionnaire invites you to provide the age, situation and any sensitivity of the other occupants of the home. Those people are not parties to the contract.
It is for you to inform them that this data is sent to Lif8, of the purpose of that transfer, and of their rights of access and objection. You may give them this policy, which answers those questions.
If one of the occupants is a minor, sending data relating to their health is the responsibility of the holders of parental authority. By providing that information, you declare that you hold such authority or the authorisation of whoever does.
Any data subject may write to us directly at contact@lif8.co to request the erasure of data concerning them, without having to go through you.
4 · Why we process it, and on what basis
| What we do | Legal basis | Retention period |
|---|---|---|
| Answer your contact request | Our legitimate interest in handling the requests addressed to us | 24 months from the last exchange |
| Draw up a quotation | Pre-contractual measures taken at your request, art. 6.1.b GDPR | 3 years from the last contact if the quotation does not lead to a contract |
| Carry out the assessment and produce the report | Performance of the contract, art. 6.1.b GDPR | Term of the contract, then 5 years |
| Process occupants’ sensitivity data | Your explicit consent, art. 9.2.a GDPR | Until consent is withdrawn, and at the latest on delivery of the report plus 12 months |
| Query public registers on the basis of the address | Performance of the contract, art. 6.1.b GDPR | Term of the contract, then 5 years |
| Invoice and keep the accounts | Legal obligation, art. 6.1.c GDPR | 10 years, art. L.123-22 of the French Commercial Code |
| Handle a complaint or a dispute | Our legitimate interest in asserting our rights | Until the time limits for legal remedies expire |
| Send you commercial information | Your consent, or our legitimate interest in respect of services similar to those already ordered | Until withdrawal, and at the latest 3 years after the last contact |
| Improve our services | Our legitimate interest, on aggregated and anonymised data only | No limit, as the data is no longer personal data |
We do not sell your data. We do not rent it out. We do not pass it on to any advertiser. No decision producing legal effects concerning you is taken solely on the basis of automated processing.
5 · How the report is produced
The report is drawn up by Lif8 on the basis of your answers, the documents you upload and the readings obtained from public registers.
Its production involves automated tools, including artificial intelligence systems, used to structure the data, calculate the indicators and prepare the drafting. The report is then reviewed and approved by a natural person before delivery. No report is sent without that review.
You may ask us for explanations as to how a result was obtained, and challenge any interpretation you consider incorrect.
6 · Who has access to your data
Within Lif8: only those people who need it in order to deliver the service.
Our processors, each bound by a contract compliant with Article 28 of the GDPR:
| Role | Provider | Place of processing |
|---|---|---|
| Hosting of the site and the form | Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, United States | United States, standard contractual clauses |
| Delivery of emails (acknowledgements, access links, reminders) | Resend, Inc., United States | European Union, “EU” processing region |
| Storage of the photographs and documents you upload | Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States (R2 service) | European Union, bucket under European jurisdiction |
| Audience measurement, with your consent | Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | European Union and United States |
| Messaging and office software | Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace, Gmail) | European Union, transfers to the United States framed by the standard contractual clauses |
than no list at all: it amounts to a declaration.
Delivery partners (architect, design office, contractor, installer), only where their involvement is necessary to your project, limited to what is useful to them, and after informing you.
The authorities where the law so requires.
7 · Where your data is processed
We give preference to processing within the European Union.
Some providers are established outside the Union or may process data there. Those transfers are governed by the safeguards provided for in Chapter V of the GDPR: an adequacy decision of the European Commission, or standard contractual clauses together with the necessary supplementary measures. You may obtain a copy of these on request.
Point to note. Health data sent through the questionnaire should pass only through providers offering safeguards appropriate to its sensitivity. This point is currently the subject of a technical review.
8 · How we protect it
Encryption of exchanges between your browser and our servers. Access limited to authorised persons only. Access logging. Regular backups. Confidentiality undertakings from everyone involved.
No system offers absolute security. In the event of a data breach likely to result in a high risk to your rights, we will inform you, and the CNIL, the French data protection authority, within the time limits laid down in Articles 33 and 34 of the GDPR.
9 · Your rights
You have the following rights:
- Access: to find out whether we process data concerning you and to obtain a copy of it.
- Rectification: to have inaccurate or incomplete data corrected.
- Erasure: to have your data deleted, subject to our legal retention obligations.
- Restriction: to ask us to keep your data without using it, while a check is carried out.
- Objection: to object to processing based on our legitimate interest, and at any time and without giving reasons to direct marketing.
- Portability: to receive the data you have provided to us in a machine-readable format.
- Withdrawal of consent: at any time, without this calling into question what was done beforehand.
- Post-mortem directions: to set out what is to become of your data after your death, under Article 85 of the French Data Protection Act (loi Informatique et Libertés).
To exercise them: contact@lif8.co. We reply within one month, extended to three months where the request is complex, in which case we will inform you. We may ask you for proof of identity in the event of reasonable doubt.
Complaints: you may refer the matter to the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 · www.cnil.fr.
10 · Deleting a file
You may at any time request the erasure of the assessment concerning you. Your answers, your photographs, your documents and the report are then deleted.
Three reservations, imposed by law:
- Accounting records are kept for ten years.
- The material needed to defend our rights is kept until the time limits for legal remedies expire, where a dispute has arisen or is foreseeable.
- Statistics that have already been anonymised cannot be recovered, as they are no longer personal data.
11 · Changes
This policy may change. The date at the top indicates the last revision. Any substantial change will be brought to the attention of active clients by email.