Data protection
Privacy policy.
What Hello Justice SAS does with your personal data, on the website, in the private areas and in the relationship that follows, and the trackers it uses, in accordance with Regulation (EU) 2016/679 (GDPR) and French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties.
Last updated: 5 November 2026
1. Data controller
The data controller is Hello Justice SAS (registered name HELLO JUSTICE), a société par actions simplifiée registered with the Lyon Trade and Companies Register under number 931 111 108, whose registered office is at 44 quater rue Saint‑Isidore, 69003 Lyon, France. Contact: contact@hello-justice.com.
For subscriptions for units of Hello Justice Capital 1 and the keeping of its register, the controller is Hello Justice Capital 1, a société civile registered with the Créteil Trade and Companies Register under number 989 268 917, represented by its manager, Hello Justice SAS.
The lawyer handling a case, in particular ACTIVE AVOCATS, a firm of the COGEP AVOCATS group, for Swiss franc mortgages, is the controller of the processing it carries out for its own engagement, under professional secrecy.
2. Data protection officer
Hello Justice SAS has appointed a data protection officer with the CNIL (designation no. DPO-177153, from 24 August 2026): Stratedge Consulting, 60 rue François Iᵉʳ, 75008 Paris, France. The officer can be reached at contact@hello-justice.com, with “Personal data” in the subject line.
3. Data processed, purposes and legal bases
Hello Justice SAS only collects what each use requires. A mandatory field is marked as such: without it, the request cannot be handled.
3.1 Browsing the website
Data: pages viewed, source of the visit (campaign parameters), random measurement identifier, device type, browser language. The host’s servers log the IP address and browser of each request. With your consent only: advertising click identifier and partner link session identifier.
Purposes: running and securing the website, measuring its audience and knowing which campaigns bring requests, counting views and clicks of partner inserts, measuring advertising campaigns with your consent.
Legal basis: the legitimate interest of Hello Justice SAS in running, securing and measuring its website (GDPR Article 6(1)(f)), within the limits the CNIL accepts for audience measurement without consent, and your consent for advertising (Article 82 of the French Data Protection Act). You can refuse audience measurement at any time.
3.2 Funding request and case submission
Data: identity, telephone, email, address, capacity (individual, company, lawyer), description of the dispute, opposing party, amount at stake, court, documents uploaded. For a Swiss franc mortgage: features of the loan, a co‑borrower’s contact details, loan offer, amortisation schedule, amendments and other useful documents. If you leave a form before sending it, the contact details already entered, your answers and the step reached are saved, as the form states.
Purposes: examining the request, analysing the eligibility of the case, contacting you again, preparing and concluding the agreement, opening your client area.
Legal basis: pre‑contractual steps taken at your request (GDPR Article 6(1)(b)), and the legitimate interest of Hello Justice SAS in calling back a person who started a request (Article 6(1)(f)).
The documents of a Swiss franc mortgage case can be accessed by ACTIVE AVOCATS and by the Hello Justice team handling the case, in accordance with professional secrecy. Nothing is sent to your bank while the case is being reviewed. If proceedings are brought, the lawyer communicates to the court and to the opposing party the documents that the rules of procedure require.
Hello Justice SAS asks for no sensitive data (health, opinions, trade union membership). If a document contains such data, it is only processed to the extent necessary for the establishment, exercise or defence of legal claims (GDPR Article 9(2)(f)).
3.3 Funded case and client area
Data: identity and civil status, contact details, occupation, documents, messages exchanged with the law firm and the team, calls, procedural calendar, damage estimate, invoices and payments, signed agreement.
Purposes: performing the agreement, funding and following the proceedings, keeping you informed of their progress, invoicing and collecting, keeping the accounts, defending the rights of Hello Justice SAS.
Legal basis: performance of the contract (GDPR Article 6(1)(b)), accounting and tax obligations (Article 6(1)(c)), the legitimate interest in defending its rights (Article 6(1)(f)).
3.4 Partner lawyers and law firms
Data: identity, firm, bar, year of admission, practice areas, SIREN number, certificate of bar registration, trade register extract, cases followed.
Purposes: examining a partnership application, concluding and performing the partnership agreement, following the cases entrusted.
Legal basis: pre‑contractual steps and performance of the contract (GDPR Article 6(1)(b)).
3.5 Investors and funders
Data: identity, date of birth, occupation, address, tax residence, contact details, investment experience and horizon, intended amount, verification documents (identity, address and, for a company, trade register extract, articles of association, beneficial owners, where applicable source of funds), exchanges and meetings. For a partner: units subscribed, capital calls, payments, tax documents. For a funder invited to review the documents for its due diligence: name, organisation, email address, verification code, documents opened, questions asked.
Purposes: pre‑qualifying the investor before opening the fund documentation to them, checking their identity and the source of the funds before their subscription form is signed, managing subscriptions, capital calls and distributions, keeping the register, answering questions, tracking access to confidential documents.
Legal basis: pre‑contractual steps and performance of the contract (GDPR Article 6(1)(b)), the fund’s legal obligations (Article 6(1)(c)), the legitimate interest in pre‑qualifying investors and protecting confidential documents (Article 6(1)(f)).
3.6 Website assistant
Data: messages exchanged, page and language, a hash of the IP address, browser. If you wish: name, email, telephone, profile and need, with your consent. In the client area, the assistant reads the status of your case: reference, stage, documents received and expected, date of the last exchange.
Purposes: answering your questions, contacting you if you ask, improving the answers.
Legal basis: the legitimate interest in answering visitors (GDPR Article 6(1)(f)), your consent for contact details left (Article 6(1)(a)), performance of the contract in the client area (Article 6(1)(b)).
3.7 Information talks
Data: day and slot chosen, number of companions, contact details, town, situation regarding the loan, year and bank of the loan, origin of the registration, attendance on the day.
Purposes: organising the days and appointments, sending the confirmation and the reminder, contacting you again if you accepted it.
Legal basis: pre‑contractual steps taken at your request (GDPR Article 6(1)(b)), your consent to be contacted again (Article 6(1)(a)).
3.8 Blog newsletter and prospecting
Data: email, language, page and source of subscription. For professionals met at an event: name, position, organisation and contact details read from the business card handed over.
Purposes: sending the blog newsletter, maintaining a professional relationship with investors, partners and lawyers.
Legal basis: your consent, given by subscribing (GDPR Article 6(1)(a)) and withdrawable through the link in each newsletter, and the legitimate interest for business‑to‑business prospecting (Article 6(1)(f)), which you may object to at any time. A person whose card was handed over is informed at the first contact.
3.9 Contact, people introduced and job applications
Data: identity, contact details, subject and message. For a person introduced by a referrer: that person’s name, contact details and context, with the referrer’s statement that the person agrees to be contacted. For a job application: education, availability, message and CV.
Purposes: answering requests, contacting the person introduced, reviewing applications.
Legal basis: the legitimate interest in answering and recruiting (GDPR Article 6(1)(f)), pre‑contractual steps taken at your request (Article 6(1)(b)).
3.10 Monitoring of public decisions
Data: court decisions published as open data, already pseudonymised by the Cour de cassation, and public legal notices.
Purposes: identifying serial disputes, without ever rating a litigant or a case.
Legal basis: the legitimate interest of Hello Justice SAS in following the case law of its business (GDPR Article 6(1)(f)).
Where data about you comes from another person (co‑borrower, referrer, business card handed over at an event), you are informed at the first contact, together with the source of the data.
4. Artificial intelligence and decisions
Artificial intelligence models help the team: they answer in the website assistant, read case documents to pick out the figures, help draft reports and read business cards. Their output is reviewed by the team.
No decision producing legal effects concerning you or similarly significantly affecting you is taken solely on the basis of automated processing (GDPR Article 22). The eligibility test only gives an indication, each funding opinion is given by a member of the team, and no score is given to a person or a case.
5. Recipients
Your data can only be accessed by the people at Hello Justice SAS who need it for their work, each according to their access rights. It may also be disclosed:
- to the lawyer handling your case, in particular ACTIVE AVOCATS for Swiss franc mortgages,
- to the chartered accountant and the banks of Hello Justice SAS and Hello Justice Capital 1, for accounting, payments and transfers,
- to the funders and investors of Hello Justice SAS, in a form that does not identify you,
- to administrative or judicial authorities, where the law requires,
- to the service providers below, who process it on behalf of Hello Justice SAS, on its instructions and under a confidentiality and security undertaking (GDPR Article 28).
| Provider | Role | Location |
|---|---|---|
| Lovable Labs Incorporated | Hosting of the website and private areas. Database, accounts and files on Lovable Cloud, built on Supabase infrastructure. | Data hosted in the European Union (Frankfurt). Company based in the United States. |
| Resend | Sending emails (confirmations, sign‑in links, blog newsletter). | European infrastructure when available. Company based in the United States. |
| Anthropic | Artificial intelligence models: website assistant, reading case documents, helping the team draft its reports, reading business cards. | United States. |
| Lovable (artificial intelligence gateway) | Access to Google and OpenAI models to read signed agreements and invoices, and to summarise public decisions. | United States. |
| DocuSign | Electronic signature of agreements. | According to its terms, inside or outside the European Union. |
| Overlord SAS | For Hello Justice Capital 1: incorporation, administration (company secretarial work, investor information), liquidation where applicable, and the white‑label subscription platform, where subscription forms are signed through Yousign. | France. |
| Plausible Analytics | Audience measurement, without cookies or identifiers. | European Union. |
| GitHub | Daily backup of the database, kept for thirty days. | United States. |
| Advertising campaign measurement (Google Ads), with your consent only: when a form is sent, your email and phone number are passed to Google in hashed form, to link the request to an ad. | United States. | |
| Tradedoubler | Affiliate network for the link to the partner Swiss Life: receives the placement and variant of the insert clicked, and the session identifier with your consent only. | European Union. |
| Calendly | Appointment booking, if you use the link offered in an email. | United States. |
If you write to the team on WhatsApp, your messages go through Meta’s service, under its own terms. Hello Justice SAS neither sells nor rents any personal data.
6. Transfers outside the European Union
Some providers are based in the United States or process data there. These transfers rely on an adequacy decision of the European Commission, in particular the EU‑US Data Privacy Framework for certified companies, or on the standard contractual clauses adopted by the Commission (GDPR Articles 45 and 46). A copy of the applicable safeguards can be obtained from the data protection officer at contact@hello-justice.com.
7. Retention periods
| Data | Period |
|---|---|
| Request not followed up: form sent or interrupted, case not accepted, contact details left with the assistant | Three years after the last contact |
| Funded case: agreement, documents, messages, follow‑up of the proceedings | Duration of the relationship, then five years |
| Invoices and accounting records | Ten years (Article L. 123-22 of the French Commercial Code) |
| Partner lawyers and law firms | Duration of the partnership, then five years |
| Investor who has not subscribed | Three years after the last contact |
| Partner of Hello Justice Capital 1, verification documents included | Duration of the holding, then five years |
| A funder’s access to the documents for its due diligence | Duration of the access, then five years |
| Information talks | Three years after the last contact |
| Blog newsletter | Until unsubscription, the address then remaining on an opt‑out list |
| Conversations with the assistant, with no contact details left | Twelve months |
| Job applications | Two years after the last contact, unless hired |
| Business cards received at an event | Three years after the last contact |
| Internal audience measurement | Thirteen months (visit events erased after four hundred days) |
| Views and clicks of partner inserts | Thirteen months |
| Sign‑in and email delivery logs | Twelve months (sign‑in attempts: ninety days) |
| Database backups | Thirty days |
At the end of these periods, data is deleted or anonymised. It may be kept longer, in restricted‑access archives, where a legal obligation requires it or for the establishment, exercise or defence of legal claims, for the applicable limitation period.
8. Your rights
Under GDPR Articles 15 to 22, you have the rights of access, rectification, erasure, restriction, portability and objection, in particular to prospecting, at any time and without giving reasons. Where processing is based on your consent, you can withdraw it at any time, without affecting what was done before. You can also set directives on what happens to your data after your death (Article 85 of the French Data Protection Act).
To exercise a right, write to the data protection officer at contact@hello-justice.com, or to Stratedge Consulting, 60 rue François Iᵉʳ, 75008 Paris, France. If there is reasonable doubt about your identity, proof may be requested (GDPR Article 12). You receive an answer within one month, which the complexity or number of requests may extend to three months, in which case you are informed.
If you consider that your rights are not respected, you can lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.
If you are a consumer, you can register free of charge on the French opt‑out list for telephone canvassing, at bloctel.gouv.fr (Article L. 223-2 of the French Consumer Code).
9. Cookies and trackers
The website sets or reads the trackers below in your browser. Those that are necessary for the website or that you request are always on. Audience measurement and your display preferences are on by default, within the limits the CNIL accepts without consent, and can be turned off at any time. Advertising trackers are only set with your consent, collected through a banner on campaign pages or in the cookie window.
Your choice is kept for six months. At the end of that period, advertising trackers are turned off until you choose again. Refusing does not prevent you from using the website.
| Tracker and use | Period | Category |
|---|---|---|
| sb-… (sign‑in session to a private area) | Until you sign out | Necessary, always on |
| hj_cookie_consent (your cookie choices) | Six months | Necessary, always on |
| hj‑lang (chosen language) | Until you change it | Necessary, always on |
| Drafts of the CHF process, of a case submission and of the investor questionnaire | Erased when the form is sent | Necessary, always on |
| Current conversation with the assistant | End of the session | Necessary, always on |
| Display memories (banner, window or button already closed) | End of the session, or until erased | Necessary, always on |
| Plausible Analytics | No cookie set | Audience measurement, on by default |
| hj‑vid (random internal measurement identifier) | Thirteen months at most | Audience measurement, on by default |
| hj‑sid, hj‑sref (session and origin of the visit) | End of the session | Audience measurement, on by default |
| hj‑utm (source of the visit: campaign parameters) | Thirty days | Audience measurement, on by default |
| hj_partner_imp_… (counting views of partner inserts) | End of the session | Audience measurement, on by default |
| hj‑theme (chosen light or dark theme) | Until you change it | Personalisation, on by default |
| Google Ads (gtag and its cookies) | Periods set by Google | Marketing, with your consent only |
| Advertising click identifier (gclid, gbraid, wbraid, msclkid, fbclid), kept in hj‑utm | Thirty days | Marketing, with your consent only |
| hj_partner_sid, hj_partner_variant_… (link to the partner and variant of the insert) | Thirty days | Marketing, with your consent only |
You can change your choices at any time from the “Manage cookies” link in the footer, or here. Your browser also lets you block or delete trackers.
10. Security
Hello Justice SAS implements technical and organisational measures appropriate to the risk (GDPR Article 32), including:
- encrypted exchanges between your browser and the website,
- data hosting in the European Union,
- private areas opened by a personal, time‑limited sign‑in link,
- mandatory two‑factor authentication for the team,
- data partitioned by account and by role, and files kept in private storage, served through temporary links,
- a log of access and sensitive operations, and regular backups.
A personal data breach that presents a risk to your rights is notified to the CNIL under the conditions of GDPR Article 33, and you are informed when the risk is high (Article 34).
The website’s services are intended for adults.
11. Changes
This policy follows changes to the website, the services and the law. Its update date is shown at the top of the page. In the event of a significant change, the people concerned are informed by email or in their private area. Terms of use · Terms of sale
The French version prevails.