Privacy Policy

Last updated:

AMI Labs SAS ("the Company," "we," "us," or "our") (36 Rue de Courcelles, 75008 Paris, France) is the data controller responsible for personal data collected through the amilabshq.com website and the AMI Labs industrial equipment world-model platform (collectively, "the Service"). This Privacy Policy explains what personal data we collect, why we collect it, the legal bases we rely on under the General Data Protection Regulation (EU 2016/679) ("GDPR"), and the rights you hold as a data subject.

AMI Labs processes only a narrow set of personal data. The core value our platform delivers rests on industrial sensor data, control-parameter histories, and equipment telemetry that customers feed from their own OPC-UA servers and SCADA historians. That operational time-series data stays entirely on the customer's on-premise infrastructure - it never leaves the customer's network boundary and is therefore not personal data that the Company processes as a controller. This Policy describes the personal data associated with the people who use and evaluate our Service: names, contact details, account credentials, and the technical data generated when you interact with amilabshq.com.

1. Identity and Contact Details of the Controller

AMI Labs SAS
36 Rue de Courcelles
75008 Paris, France
Email: [email protected]
Phone: +33 1 85 09 4180

For all privacy-related enquiries, write to the address above or email [email protected] with the subject line "Privacy Request." We will respond within 30 days.

2. Personal Data We Collect

We collect personal data in three ways: directly from you, automatically when you use the Service, and from third parties in limited circumstances.

Data you give us directly:

  • Name, job title, company name, professional email address, and phone number when you submit a pilot request, contact form, or create an account.
  • Authentication credentials (email address and hashed password) when you sign in to the platform.
  • Communication content when you correspond with us by email.
  • Payment and billing details processed by our payment service provider when you subscribe to a paid plan.

Data collected automatically:

  • IP address, browser type, operating system, and referral URL collected in server logs when you access amilabshq.com.
  • Cookies and similar tracking technologies as described in our Cookie Policy.
  • Usage data such as pages visited, features accessed, and session duration within the platform, collected only after you grant cookie consent.

Data from third parties:

  • We may receive professional contact information from publicly available sources or from our angel investors who refer prospective pilot customers.

3. Purposes and Legal Bases for Processing

Purpose Categories of data Legal basis (GDPR Art. 6)
Respond to pilot access requests and enquiries Name, email, company, phone Art. 6(1)(b) - steps prior to contract
Provide and administer the platform Account credentials, usage data Art. 6(1)(b) - performance of contract
Process payments and manage billing Payment details, billing address Art. 6(1)(b) - performance of contract
Maintain security and prevent fraud IP addresses, server logs Art. 6(1)(f) - legitimate interests
Improve the Service through usage analytics Anonymised usage data (consent only) Art. 6(1)(a) - consent
Send product updates and relevant communications Email, name, company Art. 6(1)(a) - consent or Art. 6(1)(f) for existing customers
Comply with legal obligations (accounting, tax) Invoice and payment records Art. 6(1)(c) - legal obligation

We do not use your personal data to train or improve any AI or machine learning model. The world models AMI Labs builds for customers are trained exclusively on each customer's own industrial sensor data within their on-premise environment, not on data collected from our website or account platform.

4. Recipients and International Transfers

We share personal data only where necessary to operate the Service:

  • Cloud infrastructure and hosting providers processing data within the European Economic Area.
  • Payment service providers for billing and subscription management.
  • Email delivery services for transactional communications.
  • Analytics providers, solely for anonymised aggregate usage statistics and only where you have given cookie consent.
  • Professional advisors (lawyers, accountants) under confidentiality obligations.
  • Competent authorities where disclosure is required by applicable law.

AMI Labs is a French company and our primary data processing infrastructure is located within the EEA. Where any sub-processor is based outside the EEA, we ensure that an appropriate transfer mechanism is in place as required by GDPR Chapter V - for example, the European Commission's standard contractual clauses. We do not transfer personal data to countries that do not offer an adequate level of protection without implementing such safeguards.

5. Retention

We retain personal data only for as long as necessary for the purposes described in this Policy:

  • Account and contract data: retained for the duration of your account plus 5 years after closure to meet contractual and legal obligations under French law.
  • Financial and billing records: 10 years as required by French accounting regulations (Code de commerce, Art. L. 123-22).
  • Marketing communications preferences: until you withdraw consent or object.
  • Pilot application enquiries where no contract results: 3 years from your last contact with us.
  • Server logs and security data: 12 months rolling.
  • Cookie consent records: 13 months from the date of consent.

When data is no longer required, we securely delete or anonymise it.

6. Your Rights Under GDPR

As a data subject in the European Economic Area, you hold the following rights under the GDPR:

  • Right of access (Art. 15): You may request confirmation of whether we process your personal data and, if so, a copy of that data along with information about how it is processed.
  • Right to rectification (Art. 16): You may request correction of inaccurate personal data and completion of incomplete personal data.
  • Right to erasure (Art. 17): You may request deletion of your personal data where it is no longer necessary, you withdraw consent, or you object successfully. Certain legal obligations may require us to retain data despite an erasure request.
  • Right to restriction of processing (Art. 18): You may request that we limit how we use your data in certain circumstances, for example while you contest its accuracy.
  • Right to data portability (Art. 20): Where processing is based on consent or contract and is carried out by automated means, you may request your personal data in a structured, commonly used, machine-readable format and, where technically feasible, request its transmission to another controller.
  • Right to object (Art. 21): You may object at any time to processing based on legitimate interests (Art. 6(1)(f)), including profiling. You may also object to processing for direct marketing purposes at any time and we will stop such processing immediately.
  • Rights relating to automated decision-making (Art. 22): We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects.
  • Right to withdraw consent (Art. 7(3)): Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at [email protected] or by post to 36 Rue de Courcelles, 75008 Paris, France. We will respond within one calendar month and may ask you to verify your identity before processing a request.

7. Right to Lodge a Complaint

If you believe we have handled your personal data in a manner inconsistent with the GDPR, you have the right to lodge a complaint with the French data protection authority:

Commission Nationale de l'Informatique et des Libertes (CNIL)
3 Place de Fontenoy
TSA 80715
75334 Paris Cedex 07
France
Website: www.cnil.fr

We would appreciate the opportunity to address your concerns directly before you contact the CNIL, so please reach out to us in the first instance at [email protected].

8. Cookies

We use cookies and similar technologies on amilabshq.com. Essential cookies required for the site to function are set without your consent. Analytics cookies are set only after you actively choose to accept them. For a full description of the cookies we use, their lifetimes, and your choices, please see our Cookie Policy. You may manage or withdraw your cookie preferences at any time by clicking "Cookie preferences" in the page footer.

9. Security

The Company implements technical and organisational measures appropriate to the risk of processing personal data, including encrypted transmission (TLS), access controls limiting personal data to personnel who need it, and regular review of our security practices. Industrial sensor data processed on customer premises is subject to the security controls maintained by the customer within their own network environment; the Company never receives or stores this data.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay as required by GDPR Art. 34.

10. Changes to This Policy

We may update this Privacy Policy from time to time as our Service evolves or as legal requirements change. When we make material changes we will update the "Last updated" date at the top of this page and, where required, notify you by email or by a prominent notice on our website. We encourage you to review this Policy periodically. Your continued use of the Service after we post changes constitutes acceptance of those changes.

11. Contact

For any questions or requests relating to this Privacy Policy or our handling of personal data, contact the Company at:

AMI Labs SAS
36 Rue de Courcelles
75008 Paris, France
Email: [email protected]
Phone: +33 1 85 09 4180