Privacy Policy
Version of 22 October 2026 · in force since 22 October 2026
Privacy Policy
Last updated: 22 October 2026
Invexa protects the personal data you entrust to it through the Portal, in accordance with Regulation (EU) 2016/679 ("GDPR") and the amended French Data Protection Act of 6 January 1978.
1. Data controller
JAYLO SAS, operating under the Invexa and BlueVectis brands, RCS Cherbourg 948 881 362, 12 La Rue, 50330 Carneville, France, ORIAS no. 25008593. Privacy contact: louis@invexa.fr.
2. Data we collect
| Category | Examples |
|---|---|
| Identity and contact | Surname, first name, date and place of birth, nationality, address, email, phone, ID document |
| Personal and professional situation | Marital status, occupation, employer, tax residence |
| Financial situation | Income, tax notices, bank statements, assets, existing loans, down payment, source of funds |
| Property project | Target property, price, location, financing plan |
| Co-borrowers | Same categories, provided by the User with their consent |
| Connection data | Login credentials, IP address, access logs, device type |
| Communications | Emails, messages (including WhatsApp), notes, transcripts and recordings of calls and video meetings, of which you are informed and to which you agree at the start of the conversation |
Invexa does not collect health data through the Portal. Borrower insurance health questionnaires are sent directly to the insurer.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing your account | Performance of a contract (Terms of Service) |
| Reviewing your file, searching for and presenting mortgage offers, sharing the file with insurers and guarantee providers | Performance of the Mandate and pre-contractual steps |
| Identity verification, know-your-customer, anti-money laundering and counter-terrorist financing | Legal obligation (Art. L561-1 et seq. French Monetary and Financial Code) |
| Compliance with IOBSP obligations (duty to advise, record-keeping, ACPR supervision) | Legal obligation |
| Portal security and fraud prevention | Legitimate interest |
| Handling complaints and disputes | Legitimate interest / legal obligation |
| Information about our services | Consent, or legitimate interest for similar services (you may object at any time) |
4. Automated processing
Invexa uses automated tools, including artificial intelligence provided by specialised service providers, to:
- identify your documents, extract information from them and check that it is consistent with your file;
- help our advisers summarise and find information in your communications (emails, call notes, messages).
The tool may mark a document as compliant, but its final validation, before it is presented to any lending institution, rests with an analyst. A document considered non-compliant is always reviewed by a staff member before the rejection is reported to you. You may at any time ask for a document to be reviewed by a staff member. No decision producing legal effects concerning you is based solely on automated processing. The decision to grant a loan rests with the lending institution.
5. Recipients
Your data is accessible to authorised Invexa staff according to their role, and to our technical processors solely as needed for their tasks. To the extent necessary, it may be shared with:
- the credit institutions, financing companies, guarantee providers and insurers approached for your file, which act as independent controllers;
- notaries and other professionals involved in the purchase, at your request;
- our technical processors, to the extent necessary for their tasks: hosting (in France), artificial intelligence tools, team email and work tools, sending of emails and of the newsletter, instant messaging, appointment booking, call recording and transcription, e-signature, automation between our tools and technical error monitoring. The list of our processors is available on request at louis@invexa.fr;
- Google, acting as an independent controller, when you display the login page ("Sign in with Google" prompt) or fill in an address form (address suggestions by Google Maps Platform);
- competent administrative or judicial authorities (ACPR, Tracfin, tax authorities) where required by law.
Invexa does not sell or rent your data.
6. Transfers outside the European Union
Your data is hosted in France. However, some of our processors (artificial intelligence tools, team email and work tools, email sending, instant messaging, appointment booking) are established in the United States, or may process data in other countries where they have facilities. These transfers are governed by the Data Privacy Framework, for processors that participate in it, or by the European Commission's Standard Contractual Clauses.
The Data Privacy Framework is the EU–US data protection framework: in an adequacy decision of 10 July 2023, the European Commission recognised that it ensures an adequate level of protection for data transferred to US companies that participate in it. Standard Contractual Clauses are data protection clauses adopted by the European Commission and included in our processors' contracts.
Our other processors host your data in the European Union. Where their parent company is established outside the Union, access from that country is governed by the same safeguards.
You may obtain a copy of these safeguards at louis@invexa.fr.
7. Retention periods
| Data | Period |
|---|---|
| Account with no active file | 3 years after last contact, then deletion |
| Financing file and supporting documents | Duration of the relationship, then 5 years (AML/CFT, Art. L561-12 French Monetary and Financial Code) |
| Accounting and invoicing records | 10 years (Art. L123-22 French Commercial Code) |
| Connection logs (IP address, device) | 12 months |
| History of actions on your file | Duration of the relationship, then 5 years |
| Call and video meeting recordings | 1 year |
| Marketing data | 3 years after last contact |
8. Security
Invexa implements appropriate technical and organisational measures: encryption of data in transit and of stored documents, role-based access control, authentication, logging, hosting of servers, database and documents in France (transfers outside the Union are described in section 6) and staff training. If a personal data breach is likely to result in a high risk to you, you will be informed as required by the GDPR.
9. Your rights
You have the right to access, rectify, erase, restrict and object to the processing of your data, the right to data portability, and the right to set instructions regarding your data after your death. You may withdraw your consent at any time.
Some rights are limited by Invexa's legal obligations: data retained for AML/CFT purposes cannot be erased before the statutory period expires, and access to certain such data is exercised through the CNIL (Art. L561-45 French Monetary and Financial Code).
To exercise your rights: louis@invexa.fr or JAYLO – Invexa, 12 La Rue, 50330 Carneville, France, enclosing proof of identity where necessary. We respond within one month, which may be extended by two months where necessary.
You may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 (www.cnil.fr), or with the supervisory authority of your country of residence within the EU.
10. Cookies
The Portal does not use any analytics tool or advertising cookie. It only places the cookies needed for it to work, which do not require your consent:
| Cookie | Purpose | Duration |
|---|---|---|
__Secure-better-auth.session_token and __Secure-better-auth.session_data | Keep you securely logged in; the session ends after a period of inactivity | Duration of the session |
__Secure-better-auth.state | Secure the login with a Google account, only if you choose that login method | 5 minutes |
NEXT_LOCALE | Remember your chosen language (French or English) | 1 year |
The Portal also stores two technical items in your browser to keep your session consistent across tabs.
Some pages use Google services; Google then receives your IP address and information about your browser, and acts as an independent controller:
- the login page offers to sign in with a Google account; this service may place a cookie (
g_state) that remembers whether you closed that prompt; - address forms suggest addresses as you type, using Google Maps Platform: the characters you type are sent to Google.
Should analytics tools be added in the future, they would only be activated with your consent, collected through a dedicated banner.
11. Changes
This policy may change. You will be notified of any material change on the Portal or by email. In the event of any discrepancy between the French and English versions, the French version prevails.