How Lobbly handles personal data

This policy explains how CODE BARRES BARCODE processes personal data when you visit Lobbly, create an account, join a workspace, use real-time rooms or receive service emails.

Data controller

Controller: CODE BARRES BARCODE
Registered office: CS 20005, 29 boulevard de la Ferrage, 06400 Cannes, France
Privacy contact: bonjour@lobbly.io

Data we process

Account data: name, email address, encrypted password, avatar choices, language or interface preferences.
Workspace data: workspace name, URL slug, members, roles, invitations, room ownership and room settings.
Real-time presence data: online status, room location, device state, speaking indicators and network quality.
Support and service emails: verification, password reset, invitation and product communications.
Technical data: authentication cookies, security logs, IP address, browser information and error logs.
Audience measurement data: cookieless Matomo events and page statistics without user, workspace or room identifiers.
Billing data: subscription and payment information processed by LemonSqueezy when paid plans are used.

Audio, video and screen sharing

Lobbly provides real-time audio, video and screen sharing. These streams are transmitted to provide the meeting experience and are not recorded by Lobbly by default.

Purposes and legal bases

Providing the service, workspaces, rooms, accounts and billing: performance of a contract.
Securing the service, preventing abuse and maintaining logs: legitimate interest and legal obligations.
Sending transactional emails: performance of a contract and legitimate interest.
Measuring aggregate product usage and improving the service with self-hosted, cookieless Matomo analytics: legitimate interest, with a right to object.
Sending optional product updates: consent, where requested.
Complying with accounting, tax or legal obligations: legal obligation.

Processors

Lobbly uses Scaleway for hosting in France, Mailjet for transactional email, Google Workspace for email and internal productivity, and LemonSqueezy for billing and payment processing.

Audience measurement is performed with a self-hosted Matomo instance operated for Lobbly. The script and measurement requests are enabled by default in a cookieless, aggregate configuration. Tracked URLs use a generic host and contain no query, fragment or workspace subdomain. Events accept only controlled, non-identifying values. Measurement is not used for advertising, cross-site tracking or individual profiling. You can object at any time on the Cookies page.

Retention

Pending signup verification codes expire after 1 hour.
Workspace invitations are retained for up to 30 days after expiry or revocation.
Account and workspace data are retained while the account or workspace is active.
After a verified deletion request, account data is deleted or anonymized within 30 days, unless retention is required by law.
Security and connection logs may be retained for up to 12 months.
Matomo audience measurement data is retained for no longer than 25 months.
Backups are overwritten within a maximum of 90 days.
Invoices and accounting records are retained for 10 years as required by French accounting rules.

Your rights

You may request access, rectification, deletion, restriction, portability or objection to the processing of your personal data. You may object to audience measurement on the Cookies page and withdraw consent where another processing activity is based on consent. Contact bonjour@lobbly.io. You may lodge a complaint with the CNIL if you believe your rights are not respected.

International transfers

Lobbly hosts product data in France. Some processors, such as Google Workspace, Mailjet or LemonSqueezy, may process limited data outside France or the European Union under their contractual and legal transfer mechanisms.

Version: 2026-07-20.