Privacy policy

Data controller

The controller is KARVEO, whose registered office is at 30 rue du Roggenberg, 68560 Hirsingue, France, registered with the RCS Mulhouse (the Mulhouse trade and companies register) under number 106 419 484.

For any question about your data: contact@karveo.app or +33 6 37 18 59 47.

What we collect

We apply the data minimisation principle: only what is strictly necessary.

Contact form: your name, your email address and the content of your message.

Form on the KARVEO AI page: in addition, if you tick the box provided, your WhatsApp number, so we can get back to you that way. The box is never ticked in advance; without your agreement the number is neither sent nor kept, and any exchange that follows takes place on WhatsApp, a Meta service, under its own terms.

Technical data: our hosting provider may record the IP address, the date and the browser type, for security and for the proper running of the site. It is not used to identify you, nor to track you.

Why

The information from the form has a single purpose: to handle and answer your request.

We undertake never to use it for unsolicited marketing, never to resell it, and never to pass it to third parties for commercial purposes.

Legal basis: the fact that you contacted us of your own accord, and our legitimate interests in replying (Article 6(1)(f) of the RGPD, the French name for the GDPR), together with the pre-contractual measures taken at your request (Article 6(1)(b)).

Getting back to you by WhatsApp relies on your consent (Article 6(1)(a) of the RGPD), which you can withdraw at any time by writing to us.

The chat assistant (KARVEO AI)

The site offers you a chat assistant, KARVEO AI. It is a computer program, not a person, and it tells you so from its very first message.

What you write in that window is sent to Google LLC, which writes the answer using its Gemini service. Nothing else is sent: not your name, not your address, and no information drawn from your browsing. The assistant will never ask you for contact details.

This assistant currently runs on the free tier of Google's service. Google states that content sent on that tier may be used to improve its products. We therefore encourage you not to write confidential information or personal data in it: for anything that must stay between us, write to us directly.

KARVEO keeps none of these conversations. They exist only in your browser, for the length of your visit, and disappear as soon as you close the window. We keep no copy, no statistics and no record of them.

If you decide to send us your exchange, it happens through a button you press yourself, never automatically.

Legal basis: our legitimate interests in informing visitors to the site (Article 6(1)(f) of the RGPD).

You can attach a document to your message: a working document, an image, a text file. It is never required, and the assistant answers just as well without one.

The file you attach is sent to Google LLC together with your message, for the sole purpose of letting the assistant read it and answer you. It is used for no other purpose, and it is not matched against any other information about you.

KARVEO does not receive it, does not store it and does not archive it: it passes through our server in memory, for the duration of a single request, and leaves nothing behind. Neither the file, nor its content, nor its name is written to our technical logs. We therefore do not keep it, and its retention period with us is nil.

Because Google's service runs on the free tier, Google states that what is sent to it may be used to improve its products, and that people may read it. That is why the window reminds you of this when you attach a file. Do not attach a confidential document: write to us directly, and it will not leave our exchange.

You stay in control of what you attach: attach only a document you have the right to pass on. A file holding the personal data of your customers or your employees has no place here — you cannot give consent on their behalf.

Legal basis: your own decision to send it, since nothing is sent unless you have chosen the file and clicked to send it (Article 6(1)(f) of the RGPD, our legitimate interests in informing you).

Enhanced confidentiality

Beyond personal data, any confidential information about your business entrusted to us — business data, projects, documents, processes — stays strictly between you and KARVEO.

It is not disclosed, not shared, and not used for any purpose other than those agreed with you.

Recipients and processors

Your data is intended for KARVEO alone and is accessible only to its legal representative.

Vercel Inc. — hosting of the site.

Resend, Inc. — delivery of the emails sent from the form.

OVH SAS — hosting of the contact@karveo.app mailbox. Messages you send directly to that address pass through its servers, located in France.

Google LLC — receipt of messages in a Gmail mailbox, and the Gemini service that writes the assistant's answers.

WhatsApp Ireland Limited (Meta group) — if you choose to write to us on WhatsApp. That channel stays optional.

Transfers outside the European Union

Vercel, Resend and Google are established in the United States: data passing through them leaves the European Union.

OVH is a French company and hosts the mailbox in France: that flow does not leave the European Union.

WhatsApp Ireland Limited is established in Ireland, but belongs to a US group and may transfer data outside the Union under its own terms.

These transfers are governed by the mechanisms the RGPD provides for, in particular the European Commission's standard contractual clauses and, where the provider has signed up to it, the EU–US Data Privacy Framework.

For how long

Your messages are kept for as long as it takes to handle your request, then archived or deleted. Without a contractual relationship, they are deleted no later than three years after our last exchange.

Trackers

No advertising cookies, no audience measurement, no third-party trackers. No consent is therefore required and no banner is needed.

The site carries a verification tag for Google Search Console, which sets no cookie.

Your browser may remember, for the length of your visit only, two technical items: that an opening animation has already been shown to you, and — only if you ask to send us your exchange with the assistant — the text of that exchange, long enough to place it in the form. It is erased as soon as it has been placed there.

These items never leave your device and disappear when the tab is closed. They are not used for any tracking.

Only one item is kept beyond your visit: if you decline the suggestion to read the site in the other language, your browser remembers it so as not to suggest it again. It does not leave your device either, is not used for any tracking, and disappears if you clear the site's data in your browser. Like any language choice, it is exempt from consent.

Security

The site is served over HTTPS. KARVEO puts in place reasonable technical and organisational measures to protect your data against unauthorised access, loss or alteration.

Your rights

You have the right to access your data, to have it rectified or erased, to restrict or object to its processing and to data portability. You can withdraw your consent at any time.

To exercise them, write to contact@karveo.app. We answer within one month.

If our answer does not satisfy you, you can lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés), the French data protection authority, at cnil.fr.

If you are in Switzerland, the revised Federal Act on Data Protection (FADP), in force since 1 September 2023, gives you comparable rights, which you exercise in the same way. You can also contact the Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch.