English translation for information only. Only the French version of this document is legally binding. In case of any discrepancy, the French version prevails.
Version 1.5 — 9 October 2026 Processing of personal data — GDPR compliance (EU 2016/679)
CrossbordIA SAS, whose registered office is located at 47 rue Vivienne, 75002 Paris, is the controller of the personal data collected via the Service. This data is used exclusively to provide the CrossbordIA Service, a customs classification support tool based on the Google Gemini AI model; the help assistant in the logged-in area uses Anthropic's Claude model. It is never sold or transferred to third parties for commercial purposes. To exercise your rights or ask any question relating to your data: contact@crossbordia.fr. The competent supervisory authority is the CNIL, the French data protection authority (www.cnil.fr).
The controller is CrossbordIA SAS, a simplified joint-stock company (SAS) with share capital of €1.00, whose registered office is located at 47 rue Vivienne, 75002 Paris, registered with the Paris Trade and Companies Register (R.C.S.) under number 103 738 084.
For any question relating to the protection of your personal data, you may contact the controller at contact@crossbordia.fr or by post at the address of the registered office, for the attention of the GDPR officer.
CrossbordIA collects only the data strictly necessary for the provision of the Service, in accordance with the data minimisation principle laid down in Article 5.1.c of the GDPR.
Account creation and authentication. CrossbordIA collects the surname, first name, professional email address, company name and an encrypted password. This data is processed on the basis of the performance of the contract (Article 6.1.b of the GDPR) and kept for the term of the contract plus three years.
Customer relationship management and support. Email exchanges, support tickets and the history of interactions are processed on the basis of the performance of the contract and the legitimate interest of the Publisher (Article 6.1.b and 6.1.f of the GDPR) and kept for five years from the closure of the ticket.
Help assistant. In your logged-in area, an artificial intelligence assistant answers your questions about the use of the Service. A visible notice informs you that you are interacting with an AI assistant.
Provision of the AI Service — customs classification. The product descriptions, codes, labels and files transmitted by the Customer are processed by the Google Gemini model in order to generate customs classification suggestions. This processing is based on the performance of the contract (Article 6.1.b of the GDPR). The data is kept for the term of the contract plus twelve months. Any product photographs transmitted are processed by the Google Gemini model solely to establish visible properties (for example the direction of fastening of a garment).
Invoicing and accounting. The name or company name, the billing address and the payment data tokenised via Stripe are processed on the basis of a legal obligation (Article 6.1.c of the GDPR) and kept for ten years in accordance with Article L.123-22 of the French Commercial Code.
Company identification. When a French company signs up, we ask for its SIREN number. We use it to verify, via the Recherche d'entreprises API (recherche-entreprises.api.gouv.fr), a public service that disseminates the data of INSEE's Sirene register, that the company exists and is active, and to prefill its name, the address of its registered office, its legal form and its activity code (NAF/APE). This information is used to issue invoices, to calculate the intra-Community VAT number, to offer the appropriate account type and to apply the rule of a single free plan per company (Article 2 bis of the Terms of Use). If this service does not find the SIREN entered, which may be the case for a company whose data is not publicly disseminated (partial dissemination), online sign-up to the free plan is refused with a message inviting you to check the number; you may then write to us at contact@crossbordia.fr. If this service is temporarily unavailable, the company is created with the status “to be verified” and a new verification is carried out automatically. For companies from another Member State of the European Union, the VAT number is verified with the European Commission's VIES service. This data concerns legal entities; where it identifies a sole trader, it constitutes personal data processed on the basis of the performance of the contract and of our accounting obligations (Article 6.1 b and 6.1 c of the GDPR), and kept for the duration of the account, then ten years for accounting records (Article L123-22 of the French Commercial Code).
Customs invoices. The name, address and contact details of the recipient transmitted by your store are used solely to draw up the commercial invoice for the shipment. They are kept for ten years, the period required by the French Commercial Code (Art. L123-22), then deleted.
Free trial without an account. The home page may offer a trial classification without creating an account (one item, to the European Union).
Connection logs and security. The IP address, timestamp, browser type and actions carried out in the Service are processed on the basis of the legitimate interest of the Publisher in matters of security (Article 6.1.f of the GDPR) and kept for a rolling period of twelve months.
Improvement of the Service (applicable from 6 October 2026). In order to improve the quality and regulatory compliance of the results (consistency of the classifications of the same item across nomenclatures, questions asked and answers given, error reports, comparison with published administrative decisions, stability of the results), CrossbordIA analyses the operation of the Service in aggregated form or after removal of the elements making it possible to identify the Customer, its products or its partners. Any personal data concerned is limited to the technical identifier of the user who initiated an action and, in the case of an error report, the reason entered; it is deleted or rendered non-identifying as soon as the analysis begins. This processing is based on the legitimate interest of the Publisher in making its Service more reliable (Article 6.1.f of the GDPR). The data is never disclosed to another customer, nor sold, nor used to train an artificial intelligence model. Non-anonymised elements are kept for a maximum of twelve months; aggregated or anonymised results may be kept without time limit, as they are no longer personal data. You may object to this processing (Article 21 of the GDPR) by writing to contact@crossbordia.fr.
Audience measurement. Anonymised browsing data (pages visited, clicks, session duration) is processed on the basis of consent (Article 6.1.a of the GDPR) and kept for a maximum of twenty-five months, in accordance with the recommendations of the CNIL.
Marketing communications. The professional email address and communication preferences are processed on the basis of consent or legitimate interest in the context of a B2B relationship (Article 6.1.a and 6.1.f of the GDPR) and kept until unsubscription, plus three years.
CrossbordIA is not designed to process sensitive data within the meaning of Article 9 of the GDPR, in particular data relating to health, biometrics, religion or ethnic origin.
If the Customer transmits, as part of the content it provides to the Service, product descriptions or documents containing personal data of third parties, it acts as controller of that data and must have a legal basis for that processing. CrossbordIA then processes that data solely as a processor, under the conditions defined by the applicable Data Processing Agreement (DPA).
Internal teams. Personal data is processed by the authorised teams of CrossbordIA SAS — technical, support and accounting teams — strictly within the limits of their duties.
Host and platform. The Service is hosted via Lovable Labs AB, whose registered office is located at Box 190, 101 23 Stockholm, Sweden (lovable.dev). Lovable Labs AB is SOC 2 Type II and ISO 27001 certified. The infrastructure may involve the processing of data outside the European Union, governed by Standard Contractual Clauses.
Artificial intelligence provider. The content submitted to the Service is processed by Google LLC and Google DeepMind, whose registered office is located at 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States, as part of the Google Gemini model. This processing involves a transfer of data outside the European Union, governed by the Standard Contractual Clauses adopted by the European Commission.
Help assistant. The messages exchanged with the help assistant and the account data necessary for the reply are processed by Anthropic, PBC (United States), Claude model, as a processor. According to Anthropic's commitments, this data is not used to train its models without express authorisation and is deleted from its servers within 30 days, except where required by law or for abuse monitoring. This processing involves a transfer outside the European Union, governed by the Standard Contractual Clauses of the European Commission provided for in Anthropic's data processing addendum.
Payment service provider. Transactions are processed by Stripe, Inc., whose registered office is located at 354 Oyster Point Boulevard, South San Francisco, CA 94080, United States. Bank details are tokenised by Stripe and are not stored by CrossbordIA. This processing involves a transfer of data outside the European Union, governed by the Standard Contractual Clauses.
Transactional emails. Transactional emails (sign-up confirmation, Service notifications) are sent by the email service of the Lovable platform, provided by Lovable Labs AB (Sweden).
Information campaigns. The sending of information campaigns and the tracking of their opening are handled by Brevo (Sendinblue SAS), whose registered office is located in Paris, France.
Anti-bot check. When the free trial without an account is offered, the Turnstile service of Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, United States) receives the result of the test run in your browser and your IP address, solely for the anti-bot check. This processing may involve a transfer outside the European Union, governed by the EU–US Data Privacy Framework and the Standard Contractual Clauses.
No sale of data. CrossbordIA does not sell, rent or transfer your personal data to third parties for commercial purposes. Your data is not used for advertising targeting by third parties. Only Google Ads conversion measurement, subject to your consent, is described in section 9.
Our processors are Lovable Labs AB (Sweden), including the email service of the Lovable platform, Google LLC and Google DeepMind (United States), Stripe, Inc. (United States), Cloudflare, Inc. (United States), Anthropic, PBC (United States) and Brevo — Sendinblue SAS (France). Among them, Google LLC, Lovable Labs AB, Stripe, Inc., Cloudflare, Inc. and Anthropic, PBC may process data outside the European Economic Area. These transfers are systematically governed by the Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914) and, where applicable, by the EU-US Data Privacy Framework if the provider has adhered to it. Additional security measures, in particular encryption and pseudonymisation, are put in place by each provider.
The content transmitted to the Service by the Customer is processed by the Google Gemini model for the sole purpose of generating customs classification suggestions, in accordance with the performance of the contract. According to Google's contractual terms applicable to the Gemini API for professional use, data submitted via the API is not used by default to train Google's models. CrossbordIA ensures that this guarantee is maintained in its terms of use of the API.
For any information relating to the processing of data by Google Gemini, you may consult: https://cloud.google.com/gemini/docs/data-privacy
In accordance with Articles 15 to 22 of the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have the following rights over your personal data.
The right of access allows you to obtain a copy of your personal data and the associated information, in particular the purposes of the processing, the recipients and the retention periods.
The right to rectification allows you to have any inaccurate or incomplete data concerning you corrected.
The right to erasure allows you to request the deletion of your data in the cases provided for by the GDPR, subject to the legal retention obligations to which CrossbordIA is subject.
The right to restriction of processing allows you to request the temporary suspension of the processing of your data in certain situations, in particular where their accuracy is contested or an objection is under review.
The right to data portability allows you to receive your data in a structured, machine-readable format and to transmit it to another controller. This right applies to processing based on your consent or on the performance of a contract.
The right to object allows you to object at any time to the processing of your data based on the legitimate interest of CrossbordIA, in particular for commercial prospecting purposes.
The right to withdraw consent allows you to withdraw your consent at any time for processing based on it, such as analytics cookies or marketing communications, without such withdrawal affecting the lawfulness of the processing carried out before it.
The right to set post-mortem directives, provided for in Article 85 of the French Data Protection Act, allows you to set your instructions regarding the retention, erasure and disclosure of your data after your death.
How to exercise your rights. You may send your request by email to contact@crossbordia.fr, attaching if necessary a copy of proof of identity, or by post to the following address: CrossbordIA SAS, for the attention of the GDPR officer, 47 rue Vivienne, 75002 Paris. CrossbordIA undertakes to reply within one month of receipt of the request, a period which may be extended by two months in the case of a complex request, with prior notice.
If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the CNIL on the website www.cnil.fr or by post at the address: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.
CrossbordIA implements appropriate technical and organisational measures to protect your personal data against any unauthorised access, loss, destruction, alteration or accidental disclosure, in accordance with Article 32 of the GDPR.
These measures include encryption of data in transit via TLS 1.2 and 1.3, encryption of data at rest to an AES-256 standard or equivalent, access control based on the principle of least privilege combined with strong two-factor authentication, logging of access to data and regular review of access rights, regular backups with restoration tests, and the SOC 2 Type II and ISO 27001 certification of the Lovable Labs AB infrastructure.
In the event of a data breach likely to result in a risk to your rights and freedoms, CrossbordIA will notify the CNIL within seventy-two hours in accordance with Article 33 of the GDPR, and will inform you without delay if that breach is likely to result in a high risk.
Cookies that are strictly necessary for the operation of the Service, in particular those ensuring session management, authentication and form security (CSRF protection), are placed without consent being obtained, in accordance with Article 82 of the French Data Protection Act.
Analytics cookies, intended for audience measurement and the improvement of the Service, as well as personalisation cookies enabling your interface preferences to be remembered, are only placed after your prior consent has been obtained via the cookie manager accessible on the Service. Their retention period is limited to twenty-five months for analytics cookies and twelve months for personalisation cookies.
Advertising cookies (Google Ads). Only with your consent (“Advertising cookies” category of the banner, disabled by default), CrossbordIA uses the Google Ads conversion tag to find out whether a sign-up comes from one of its adverts.
You may change your preferences at any time via the cookie management panel or by configuring your browser.
Where the content provided by the Customer to the Service contains personal data of third parties, CrossbordIA acts as a processor within the meaning of Article 28 of the GDPR, the Customer being the controller. In this context, a Data Processing Agreement (DPA) must be concluded between the parties. This document can be consulted on the Data Processing Agreement page.
This Privacy Policy may be updated at any time in order to reflect legal, regulatory or technical changes. Substantial amendments will be notified by email or via a banner on the Service with at least thirty days' notice. Continued use of the Service after notification constitutes acceptance of the amendments. The version in force is the one published online on the date of consultation.
For any question relating to this Policy or to the processing of your personal data, you may contact CrossbordIA SAS by email at contact@crossbordia.fr or by post at 47 rue Vivienne, 75002 Paris, for the attention of the GDPR officer.
The competent supervisory authority is the Commission Nationale de l'Informatique et des Libertés, reachable at www.cnil.fr and whose registered office is located at 3 place de Fontenoy, 75334 Paris Cedex 07.
CrossbordIA SAS — 47 rue Vivienne, 75002 Paris — SIREN 103 738 084 — contact@crossbordia.fr