This Data Processing Agreement (the “DPA”) sets out the terms under which Clivio processes personal data on behalf of its customers, in accordance with Article 28 of the General Data Protection Regulation (GDPR).
1. Purpose and Scope
This DPA is entered into between Clivio, trade name of Félix Boittin, French sole proprietor (SIRET 894 584 770 00024, 10 rue des aqueducs, 94250 Gentilly, France) (the “Processor”), and the business customer using the Service (the “Controller”). The French version (Accord de traitement des données) is the reference version. It applies to all processing of personal data carried out by Clivio on behalf of the customer in the course of providing the Service.
This DPA forms an annex to the Terms of Service. In the event of any conflict between the Terms of Service and this DPA on a matter relating to the processing of personal data, this DPA shall prevail.
2. Nature and Purpose of Processing
Clivio processes personal data on behalf of the customer solely for the following purposes:
- hosting, storing, and organizing the documents uploaded by the customer;
- extracting data from documents using artificial intelligence (Google Gemini API), as part of the features used by the customer;
- receiving the emails the customer forwards to their @inbox.clivio.app address;
- managing the user account and subscription;
- providing the technical support requested by the customer.
3. Types of Data and Data Subjects
The processing covers the following categories of data: the documents and files uploaded by the customer, the metadata and data extracted from those documents, and account data (name, email address, billing information).
The data subjects are those determined by the customer: the customer freely chooses which documents to upload to the Service and remains solely responsible for the lawfulness of their collection and transmission to Clivio.
4. Obligations of the Processor
Clivio undertakes to:
- process personal data only on documented instructions from the customer, including with regard to any transfers of data;
- ensure that persons authorized to process the data are subject to a duty of confidentiality;
- implement appropriate technical and organizational measures to ensure the security of the data.
These security measures include in particular:
- encryption of data in transit (TLS) for all network communications;
- encryption of data at rest (Google Cloud default encryption);
- short-lived signed URLs for document shares;
- an audit log of access to shared documents;
- the option to enable multi-factor authentication (MFA) on accounts.
5. Sub-processors
The customer authorizes Clivio to engage the following sub-processors (general authorization):
Clivio service (app)
Google — Google Cloud / Firebase
- Role
- Hosting of the website and the app (Firebase App Hosting), authentication, database (Firestore), file storage (Cloud Storage), server functions and scheduled tasks (Cloud Functions, Cloud Tasks).
- Data
- Account data, documents and extracted data, data entered in the app, technical logs.
- Location and transfer basis
- Server functions and tasks run in the United States (us-central1 region) — European Commission Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Google — API Gemini (Gemini Developer API)
- Role
- Artificial intelligence processing: reading documents and extracting their data, summaries, classification, translation, semantic search (Gemini 2.5 Flash and Gemini Embedding models), answers to questions asked to your documents.
- Data
- Content of documents (text and images) and of the questions sent to the AI, generated results.
- Location and transfer basis
- Google infrastructure, including in the United States, without EU data residency — European Commission Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Twilio SendGrid (Twilio Inc.)
- Role
- Sending service emails (sign-up, notifications, reminders) and receiving the emails forwarded to your @inbox.clivio.app address.
- Data
- Email address, name, content and attachments of the emails sent and received.
- Location and transfer basis
- United States — European Commission Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Stripe (Stripe Payments Europe Ltd, Stripe, Inc.)
- Role
- Online payment, subscription and trial management, billing customer portal, invoices.
- Data
- Identity, email address, payment details (entered and stored by Stripe only), billing history.
- Location and transfer basis
- Ireland and United States — European Commission Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Upstash (Upstash, Inc.)
- Role
- Request rate limiting (abuse protection).
- Data
- Technical identifiers (IP address, account identifier) and request counters.
- Location and transfer basis
- United States — European Commission Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Sentry (Functional Software, Inc.)
- Role
- Detection and diagnosis of technical errors.
- Data
- Error reports, technical data (browser, device, IP address), account identifier.
- Location and transfer basis
- United States — European Commission Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Integrations enabled at your request
Google Drive (Google)
- Role
- Only if you connect your Google Drive account: exchange of the files you choose.
- Data
- Access token, selected files and their metadata.
- Location and transfer basis
- United States — European Commission Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Dropbox (Dropbox, Inc.)
- Role
- Only if you connect your Dropbox account: exchange of the files you choose.
- Data
- Access token, selected files and their metadata.
- Location and transfer basis
- United States — European Commission Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Some of these sub-processors are established, or process data, outside the European Union, in particular in the United States; these transfers are covered by the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Clivio will inform the customer of any intended change concerning the addition or replacement of a sub-processor, giving the customer the opportunity to raise reasoned objections.
6. Data Subject Rights
Taking into account the nature of the processing, Clivio will provide the customer with reasonable assistance in responding to requests from data subjects exercising their rights (right of access, rectification, erasure, restriction, portability, and objection).
7. Data Breach Notification
Clivio will inform the customer without undue delay upon confirmation of a personal data breach affecting data processed on the customer’s behalf, describing, to the extent possible, the nature of the breach, its likely consequences, and the measures taken or proposed to address it.
8. Reversibility and Data Deletion
The customer may export all of their documents and associated metadata from the Service at any time.
Upon termination of the contract, and at the customer’s choice, Clivio will return or delete all personal data processed on the customer’s behalf within 30 days, unless a legal retention obligation requires otherwise.
9. Audits
Clivio will respond to reasonable security questionnaires submitted by the customer to enable the customer to verify compliance with the obligations of this DPA.
10. Legal Retention Responsibility
The customer remains solely responsible for complying with its own legal document retention obligations, including the obligation to retain commercial documents for ten years (Article L. 123-22 of the French Commercial Code). Clivio provides the export and return means enabling the customer to fulfil these obligations.
Contact
For any question relating to this DPA or to the processing of your data: contact@clivio.app.
Last updated Oct 11, 2026. If something on this page looks wrong, tell us at contact@clivio.app.