← Version française

Privacy Policy

Version 1.3 — October 2026

This English text is a courtesy translation. In the event of any discrepancy, the French version available at silexia.legal/confidentialite prevails.

Silexia SARL — 32 avenue Bosquet, 75007 Paris
SIRET: 894 462 217 00015 — RCS Paris
Publication director: Maxime Lehmann
Contact: bonjour@silexia.fr
Website: https://silexia.legal
Host: Scalingo SAS — 13 rue Jacques Peirotes, 67000 Strasbourg

1. Who we are

Company name: Silexia SARL
Legal form: French limited liability company (SARL)
Share capital: €1,000
Registered office: 32 avenue Bosquet, 75007 Paris
SIRET: 894 462 217 00015 — RCS Paris
Email: bonjour@silexia.fr
Website: https://silexia.legal

Silexia SARL acts as data controller within the meaning of Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and French Act No. 78-17 of 6 January 1978, as amended.

2. Data collected

2.1 Data collected directly

  • Identification data: last name, first name, professional email address
  • Professional data: firm or company name, role, bar membership
  • Account data: account credentials, encrypted password (not accessible to Silexia)
  • Payment data: processed directly by Stripe. Silexia stores no banking data

2.2 Data collected automatically

  • Browsing data: IP address, browser type, pages visited, session duration
  • MCP usage metadata: timestamp, database and tool called, status and processing time of each request — collected solely for quota management, billing and monitoring proper operation (see § 3.2)
  • Cookies and trackers: detailed in the Cookie Policy

3. Special case — MCP connector and official databases

3.1 Neutral technical architecture

The Silexia MCP connector is a hosted technical gateway that the user connects to the large language model (LLM) of their choice — Claude by Anthropic, Mistral, ChatGPT by OpenAI, Cursor or any other MCP-compatible agent. The connection is established securely via the OAuth 2.0 protocol and a personal access key. In this context:

  • Silexia does not store the content of the requests sent to the connector or of the responses returned by the official databases or by the LLM (except for the legal-watch and AI Discussion features described in § 3.4 and § 3.5);
  • Silexia keeps only a technical record of each call (metadata, see § 3.2), in order to verify the proper operation of the Service, detect any malfunctions and monitor usage (quota management and billing);
  • the user remains solely responsible for the choice of their LLM, its configuration and the data they decide to submit to it;
  • Silexia acts as a provider of a technical tool and does not exploit the content of the exchanges for any other purpose.

This architecture has been designed to preserve the confidentiality of professional data, in particular the legal professional privilege of lawyers provided for in Article 66-5 of Act No. 71-1130 of 31 December 1971.

3.2 MCP request metadata

In order to manage usage quotas, bill subscriptions and detect malfunctions, Silexia keeps a technical record of each MCP request, consisting exclusively of the following metadata:

  • Identifier of the user account and of the access key used
  • Request timestamp
  • Database queried (e.g.: Légifrance, Judilibre, RNE…) and name of the tool called (e.g.: search in the codes, reading a decision)
  • Request status (response code, success or failure) and processing time

This metadata never includes the content of the requests (search terms, references consulted, parameters) or the responses returned. It is hosted in the European Union (see § 8), retained for 12 months and then automatically deleted. If the account is deleted, it is no longer linked to the account.

3.3 Requests to official databases

When using the Service, real-time requests are sent to the following sources:

  • Légifrance (consolidated codes and texts, statutes and decrees, Official Journal, administrative and constitutional case law, CNIL decisions — DILA's Légifrance API, api.piste.gouv.fr);
  • Judilibre (judicial case law: Cour de cassation, courts of appeal, first-instance courts — api.piste.gouv.fr);
  • Collective bargaining agreements (KALI collection — api.piste.gouv.fr; identification of the agreement by SIRET — Recherche d'entreprises API, recherche-entreprises.api.gouv.fr);
  • EUR-Lex / CJEU (European Union law and case law of the Court of Justice — eur-lex.europa.eu);
  • European Parliament (legislative procedures, votes, MEPs and documents — data.europarl.europa.eu);
  • Parliamentary questions (written questions and ministerial answers from the National Assembly and the Senate — data.assemblee-nationale.fr, data.senat.fr);
  • National Business Register – RNE (company and director data — data.inpi.fr);
  • RNA and SIRENE (registers of associations, companies and establishments — public open-data exports);
  • INPI Trademarks (French, European Union and international trademarks: search, details, logos and BOPI publications — data.inpi.fr);
  • EUIPO (European Union trade marks and Nice classification — official APIs of the European Union Intellectual Property Office);
  • NATINF (national classification of offences — data.gouv.fr);
  • Service-public.fr and impots.gouv.fr (practical guides to administrative procedures, official DILA export; tax documentation for individuals and businesses);
  • CNIL and EDPB (decisions and sanctions, appointed DPOs, notified breaches, inspections, statistics; documents and decisions of the European Data Protection Board — DILA, CNIL open data, edpb.europa.eu);
  • BOFiP (tax doctrine in force — DGFiP open data);
  • BOSS (Official Social Security Bulletin — boss.gouv.fr);
  • Official Bulletin of the French Ministry for the Ecological Transition (circulars, instructions and notes);
  • HAL (open research archive — api.archives-ouvertes.fr);
  • Isidore (Huma-Num's humanities and social sciences search engine — api.isidore.science);
  • Urban planning (Géoportail de l'Urbanisme, land registry, DVF real-estate transactions, energy-performance diagnostics, buildings, co-ownerships, addresses — IGN Géoplateforme, data.gouv.fr, data.ademe.fr);
  • Juriveille (legal-watch database published by Silexia, read-only access).

These requests transit through Silexia's servers without their content being stored; only the technical record of the call is retained (see § 3.1 and § 3.2). The request parameters (search terms, identifiers consulted) are sent only to the source queried. The connection servers for these databases do not call any artificial-intelligence service. Each source is subject to its own terms of use, in particular the Etalab v2.0 open licence for most French public data. Silexia cannot be held liable for the unavailability or modification of these databases. The availability levels (SLAs) of the official databases are those published by their respective providers.

3.4 Legal watch and email notifications

Silexia offers an optional legal-watch feature allowing the user to set up automated monitoring of legal sources and to distribute the results by email (newsletters). Unlike the passthrough described in § 3.1, this feature requires the storage of the data strictly necessary for its operation:

  • the watch configuration (title, search terms, monitored sources, sending frequency);
  • the recipient email addresses entered by the user;
  • the sending history (subject, newsletter content, recipients, date and status), for traceability and proper operation of the Service.

Watches are run by a Silexia service hosted in France (Scalingo); their data is stored in the European Union (see § 8). The articles collected from public sources are sorted and then summarised using Anthropic's Claude artificial-intelligence models (Claude Haiku for sorting, Claude Sonnet for writing). The content of the collected articles and the watch configuration (title, description, angle, monitored sources) are sent to Anthropic. The watch tools exposed by the MCP connector are part of this feature.

Emails are sent by our processor Resend Inc. (DPA in force). The legal basis for this processing is the performance of the contract (Art. 6.1.b GDPR).

The user is solely responsible for the addresses they register as recipients and ensures they have the right to send them these communications. Each email includes a one-click unsubscribe link (Art. 21 GDPR; RFC 8058).

Retention periods: the watch configuration is kept for the duration of the contractual relationship; the sending history is limited to the 10 most recent sends per watch, kept for a maximum of 12 months, after which they are deleted.

3.5 AI Discussion

The "AI Discussion" tab of a watch lets the user talk with an assistant that relies on the Service's sources. This feature is optional. The user's messages and the assistant's answers are sent to Anthropic's Claude Sonnet model to generate each answer, and kept in the discussion history, stored in the European Union (see § 8), for the lifetime of the account; they are deleted with it. Anthropic does not use data sent through its API to train its models.

Outside the legal-watch (§ 3.4) and AI Discussion (§ 3.5) features, Silexia sends no content to any artificial-intelligence service.

4. Purposes and legal bases for processing

  • Performance of the contract (Art. 6.1.b GDPR): creation and management of your account, provision of subscribed plans, request-quota management, billing
  • Legitimate interest (Art. 6.1.f GDPR): improvement of the Service, platform security, fraud prevention, aggregated and anonymised usage statistics
  • Consent (Art. 6.1.a GDPR): sending of marketing communications, placement of non-essential cookies — consent may be withdrawn at any time
  • Legal obligation (Art. 6.1.c GDPR): retention of billing data in accordance with accounting and tax obligations (Art. L. 123-22 French Commercial Code — 10 years)

5. Retention periods

  • Account data: duration of the contractual relationship + 2 years after termination
  • Billing data: 10 years (legal obligation — Art. L. 123-22 French Commercial Code)
  • MCP request metadata: 12 months
  • Connection logs: 12 months
  • Prospecting data: 2 years from the last contact
  • Audience-measurement cookies: 13 months maximum (CNIL recommendation)
  • Watch data: configuration kept for the duration of the contractual relationship; sending history limited to the 10 most recent sends per watch (12 months maximum)
  • AI Discussion history: lifetime of the account, deleted with it

6. Data recipients

Your data may be shared with the following processors, strictly within the limits of the purposes described above, with whom Silexia has concluded a data processing agreement (DPA) compliant with the GDPR:

  • Scalingo SAS — hosting of the gateway, of the connection servers ("MCP") and of the watch-execution service, France (EU)
  • Supabase (Supabase Pte. Ltd., Singapore, and its affiliates, including Supabase, Inc., United States) — database: accounts, subscriptions, access keys (as a fingerprint, never in clear), usage metadata, watch configuration and history, AI Discussion history. Data hosted in the European Union (Ireland, Amazon Web Services infrastructure); processor established outside the European Union (see § 8)
  • Anthropic, PBC — Claude artificial-intelligence models for sorting and writing watches and for the AI Discussion, United States (see § 8)
  • Replit, Inc. — hosting of the Juriveille connection server ("MCP") (legal watch), United States (Google Cloud infrastructure). Transfer framed by safeguards (see § 8)
  • Stripe — online payment solution (Stripe Payments Europe, Ltd., Ireland, and its affiliates, see § 8)
  • Resend Inc. — sending of transactional emails and watch newsletters, United States (Resend DPA in force, see § 8)
  • Sentry (Functional Software, Inc.) — application error monitoring. Data hosted in the European Union (Germany); company established in the United States (see § 8)

Silexia never sells your data to third parties for commercial purposes.

7. Your rights

In accordance with the GDPR and the amended French Data Protection Act, you have the following rights:

  • Right of access (Art. 15 GDPR): obtain a copy of your personal data
  • Right to rectification (Art. 16 GDPR): correct inaccurate or incomplete data
  • Right to erasure (Art. 17 GDPR): request the deletion of your data, subject to legal conditions
  • Right to restriction (Art. 18 GDPR): temporarily restrict a processing operation
  • Right to data portability (Art. 20 GDPR): receive your data in a structured, machine-readable format
  • Right to object (Art. 21 GDPR): object to processing based on legitimate interest or for prospecting purposes
  • Right to withdraw consent: at any time, without retroactive effect

To exercise your rights, contact us at: bonjour@silexia.fr. We undertake to respond within one month. If you encounter difficulties, you may lodge a complaint with the CNIL (the French data protection authority), 3 place de Fontenoy, 75007 Paris — www.cnil.fr.

8. Transfers outside the European Union

The Service's data is hosted in the European Union: the gateway, the connection servers and the watch service in France (Scalingo), the database in Ireland (Supabase, Amazon Web Services infrastructure), error logs in Germany (Sentry).

Several processors are, however, companies established outside the European Union (United States, Singapore). This results in processing outside the European Union, or possible access from those countries (support, operations, requests from authorities subject to local law, in particular US law), for the following data:

ProcessorData concernedNature
Supabase (Supabase Pte. Ltd. and affiliates)Data stored in the database (see § 6)Hosted in the EU (Ireland); possible access from Singapore and the United States
Anthropic, PBCWatch content and configuration (§ 3.4), AI Discussion messages (§ 3.5)Processing in the United States
Replit, Inc.Requests sent to the Juriveille databaseTransit through the United States, without storage
Resend Inc.Recipient addresses and email contentProcessing in the United States
StripePayment and billing dataContract with Stripe Payments Europe (Ireland); transfers to Stripe, Inc. (United States)
Sentry (Functional Software, Inc.)Technical error logsHosted in the EU (Germany); possible access from the United States

These transfers are framed by the European Commission's Standard Contractual Clauses (SCCs) (Decision 2021/914) incorporated into each processor's data processing agreement (DPA) and, where the processor is certified, by the EU–US Data Privacy Framework. They are supplemented by technical measures: encryption in transit (TLS), access keys kept only as a fingerprint, no retention of the content of requests sent to the databases.

For the Juriveille database (legal watch), the technical relay between the gateway and the database is handled by a connection server ("MCP") hosted by Replit, Inc. in the United States (Google Cloud infrastructure). When a request is made to this database, the content of the request transits through this US server — transiently, encrypted (TLS) and without storage. Only the technical record of the call (metadata, see § 3.2) is retained, in the European Union.

Location of connection servers by database:

HostingDatabases concerned
United States (Replit / GCP)Juriveille
France (Scalingo)Légifrance, Judilibre, Collective bargaining agreements, EUR-Lex, European Parliament, Parliamentary questions, RNE, RNA / SIRENE, INPI Trademarks, EUIPO, NATINF, Service-public.fr / impots.gouv.fr, CNIL / EDPB, BOFiP, BOSS, Ecological Transition Official Bulletin, HAL, Isidore, Urban planning

9. Security

Silexia implements appropriate technical and organisational measures to protect your data, in accordance with Article 32 of the GDPR, including:

  • Encryption of data in transit (TLS 1.2 minimum) and at rest
  • Strong authentication on administration interfaces
  • Data access limited to authorised personnel, on a least-privilege basis
  • Logging of access to sensitive data

10. Cookies

Our site uses cookies and trackers. To learn more and set your preferences, see our Cookie Policy.

11. Changes

Silexia reserves the right to amend this policy at any time, in particular to reflect legal and regulatory developments. In the event of a substantial change, you will be informed by notification on the site or via your client area at least 30 days before the new provisions take effect.

12. Contact

Email: bonjour@silexia.fr
Mail: Silexia SARL — 32 avenue Bosquet, 75007 Paris

Last updated: 14 October 2026 — Version 1.3