LeLab.dev INDEPENDENT ENGINEERING LAB
Contact
← Back to home

LELAB.DEV / LEGAL / DRAFT

Privacy policy — LeLab.dev

Astro source: document last updated 26 July 2026. This SvelteKit adaptation has not yet been approved.

Draft: the site owner must review this content before production.

The historical policy named LeLab.dev, represented by the person identified in that version, as data controller and provided a contact address.

To confirm: The exact identity and address remain in the historical source dated 26 July 2026 and are not repeated in this draft pending confirmation. The SvelteKit site displays hello@lelab.dev as its contact address.

The historical policy stated that the contact form collected the following data:

To confirm: The Formspree form is no longer part of the current application. The site no longer collects these fields through a form; the link opens the visitor’s email software. The former document also stated that no other data was collected and that there were no cookies or audience measurement; those general statements no longer describe the current API routes and session cookies.

  • Your first name (field “Your first name”).
  • Your email address (field “Your email”).
  • Your message (free-text field).

Ask the Lab: when you submit a question, the server sends the entered text and selected excerpts from public sources to OpenAI to generate an answer. Do not enter unnecessary personal, sensitive or confidential information.

Triage: no decision simulation runs in the browser. If you explicitly choose “Analyze with Laya”, the application attempts to send the ticket (subject, text and parameters needed for analysis) to the Laya service through a private server-side connection; if that service is unavailable, no result is generated.

Voice transcription: after you click Record, the browser captures up to 16 seconds of audio. After you stop, the file is sent to Whistle for transcription. The resulting text is inserted into the field for review; it is not sent to Ask/OpenAI until you take the separate action to Send.

To confirm: These descriptions cover flows implemented in the application; they do not verify the actual deployment of private services or the processing and logs operated by providers.

For the former form, the policy described responding to an enquiry and, where appropriate, arranging a preliminary discussion about a service. It referred to consent provided through the form checkbox and to the legitimate interest in responding.

This description concerned the form that has been removed. The purposes and legal bases applicable to Ask questions, Laya triage, Whistle transcription, quotas and contact by email must be established by the controller before publication; the historical basis is not automatically applied to them.

The historical policy stated that form messages were intended solely for the data controller. Formspree, described as a US-based processor, received and forwarded the messages.

For current features, OpenAI receives Ask question text and selected public excerpts. Laya and Whistle are called server-side through dedicated private connections. Upstash receives technical data needed for quotas: HMAC-transformed IP and session identifiers and temporary counters, not ticket, question or audio-file content.

To confirm: Formspree is no longer part of the current contact flow. The contracts, subprocessors, regions and retention periods of currently configured providers — as well as the hosting provider — still need to be verified for the actual deployment.

The historical policy stated that Formspree hosted data in the United States and that the transfer relied on the European Commission’s standard contractual clauses. It also stated that Cloudflare infrastructure could be located outside the European Union.

To confirm: These statements are retained as claims from the former policy; they do not establish the regions or safeguards applicable to current SvelteKit flows. Confirm transfers and contractual mechanisms for OpenAI, Laya, Whistle, Upstash and the hosting provider before publication; no provider test has been performed.

The former policy stated that no cookies or advertising trackers were used. The current code sets HttpOnly and SameSite=Lax session cookies to apply quotas when using the Ask, Triage and Transcription routes. They are Secure over HTTPS; the transcription route limits its cookie to /api/lab/transcribe.

The application uses the request IP address to limit abuse; identifiers sent to Upstash are transformed into HMAC fingerprints. Deployed audience-measurement settings, access logs and third-party tools must be checked before confirming that no tracker is used.

  • Ask: lelab_ask_session, maximum duration 24 hours.
  • Triage: lelab_triage_session, maximum duration 30 days.
  • Transcription: lelab_transcribe_session, maximum duration 30 days, path /api/lab/transcribe.

For the former form, the policy stated that data would be kept while handling the enquiry — generally for the duration of the exchange and a reasonable follow-up period — then deleted. If there was no follow-up, messages were to be deleted no later than 12 months after receipt. This period applied to Formspree and must not be presented as the current retention period for the demos.

The application code does not store questions, tickets or audio files in a database and does not write their content to application logs. Retention periods, logs and provider, host and Whistle service regions are not established by the repository and must be confirmed before publication.

The historical policy listed the rights of access, rectification, erasure, objection, restriction and portability under EU Regulation 2016/679. The controller must confirm the contact and process for making a request about current processing.

The former policy provided a contact address; the current site displays hello@lelab.dev. You may also lodge a complaint with the French data-protection authority (CNIL).

To confirm: The rights historically published are retained. Confirm the address, channel and response time before approving this version.