This policy explains which personal data Clivio processes, why, on which legal basis, with which providers, for how long, and how to exercise your rights. It applies to the clivio.fr website and the dashboard.clivio.app app. The French version (Politique de confidentialité) is the reference version.
1. Data Controller
Clivio, trade name of Félix Boittin, Sole proprietor (French entrepreneur individuel / micro-entrepreneur)
SIRET: 894 584 770 00024
Address: 10 rue des aqueducs, 94250 Gentilly, France
Email: contact@clivio.app
No Data Protection Officer has been appointed. When your documents contain personal data of third parties, you remain the controller of that data and Clivio acts as your processor under the Data Processing Agreement.
2. Data, Purposes and Legal Bases
- Account — name, email address, login credentials, preferences. Legal basis: performance of the contract.
- Providing the service — documents you upload, forward to your @inbox.clivio.app address or receive through your Dropzone, data extracted from them, content you create. Legal basis: performance of the contract.
- AI features — the content of your documents and questions is sent to the Google Gemini API to extract data, summarize, classify, translate and answer your questions. Legal basis: performance of the contract.
- Payment, subscription and billing — identity, email, subscription and payment history; card details are entered and stored by Stripe, never by Clivio. Legal bases: performance of the contract and accounting/tax obligations.
- Service emails — sign-up, notifications, reminders you configured. Legal basis: performance of the contract.
- Support and contact requests — name, email, message. Legal basis: legitimate interest in answering you, or pre-contractual steps.
- Security and abuse prevention — IP address, technical identifiers, logs and error reports. Legal basis: legitimate interest in securing the service.
- Google Drive and Dropbox integrations — only if you connect them: access token and the files you choose. Legal basis: performance of the contract, at your request.
- Audience measurement on clivio.fr — Google Analytics 4 and Microsoft Clarity, only if you accept them. Legal basis: consent, which you can withdraw at any time.
Clivio does not sell your data, does not run targeted advertising and does not take decisions with legal effects based solely on automated processing.
3. Recipients and Sub-processors
Your data is accessible to Clivio as strictly necessary, and to the following providers acting on our behalf:
Clivio service (app)
Google — Google Cloud / Firebase
- Role
- Hosting of the website and the app (Firebase App Hosting), authentication, database (Firestore), file storage (Cloud Storage), server functions and scheduled tasks (Cloud Functions, Cloud Tasks).
- Data
- Account data, documents and extracted data, data entered in the app, technical logs.
- Location and transfer basis
- Server functions and tasks run in the United States (us-central1 region) — European Commission Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Google — API Gemini (Gemini Developer API)
- Role
- Artificial intelligence processing: reading documents and extracting their data, summaries, classification, translation, semantic search (Gemini 2.5 Flash and Gemini Embedding models), answers to questions asked to your documents.
- Data
- Content of documents (text and images) and of the questions sent to the AI, generated results.
- Location and transfer basis
- Google infrastructure, including in the United States, without EU data residency — European Commission Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Twilio SendGrid (Twilio Inc.)
- Role
- Sending service emails (sign-up, notifications, reminders) and receiving the emails forwarded to your @inbox.clivio.app address.
- Data
- Email address, name, content and attachments of the emails sent and received.
- Location and transfer basis
- United States — European Commission Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Stripe (Stripe Payments Europe Ltd, Stripe, Inc.)
- Role
- Online payment, subscription and trial management, billing customer portal, invoices.
- Data
- Identity, email address, payment details (entered and stored by Stripe only), billing history.
- Location and transfer basis
- Ireland and United States — European Commission Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Upstash (Upstash, Inc.)
- Role
- Request rate limiting (abuse protection).
- Data
- Technical identifiers (IP address, account identifier) and request counters.
- Location and transfer basis
- United States — European Commission Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Sentry (Functional Software, Inc.)
- Role
- Detection and diagnosis of technical errors.
- Data
- Error reports, technical data (browser, device, IP address), account identifier.
- Location and transfer basis
- United States — European Commission Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Integrations enabled at your request
Google Drive (Google)
- Role
- Only if you connect your Google Drive account: exchange of the files you choose.
- Data
- Access token, selected files and their metadata.
- Location and transfer basis
- United States — European Commission Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Dropbox (Dropbox, Inc.)
- Role
- Only if you connect your Dropbox account: exchange of the files you choose.
- Data
- Access token, selected files and their metadata.
- Location and transfer basis
- United States — European Commission Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
clivio.fr website (cookies, after consent except CookieHub)
CookieHub (CookieHub ehf.)
- Role
- Collecting and storing your cookie choices on clivio.fr.
- Data
- Consent choices, consent identifier, technical connection data.
- Location and transfer basis
- Iceland (European Economic Area).
Google Analytics 4 (Google)
- Role
- Website audience measurement, only after your consent.
- Data
- Pages viewed, events, cookie identifiers, browser and device information, approximate location.
- Location and transfer basis
- United States — European Commission Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Microsoft Clarity (Microsoft Corporation)
- Role
- Analysis of how the website is used (heatmaps, session replays), only after your consent.
- Data
- Interactions with pages (clicks, scrolling, movements), browser and device information, cookie identifiers.
- Location and transfer basis
- United States — European Commission Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
4. Transfers Outside the European Union
Several providers are established in, or process data in, the United States — in particular Google Cloud server functions (us-central1 region) and the Google Gemini API, which does not offer EU data residency. These transfers are covered by the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
5. Retention
- Account and service data: kept while your account is active and erased no later than 30 days after you request the deletion of your account.
- Documents: deleted when you delete them, and at the latest with your account (same 30-day period).
- Invoices and billing records: kept for the period required by law (10 years for accounting records under French law), including after account deletion.
- Support and contact requests: kept while handling the request and up to 3 years after our last exchange.
- Technical logs and error reports: kept for a limited period needed for diagnosis and security, then deleted automatically.
- Audience-measurement cookies: 13 months maximum; your cookie choice is kept for the same maximum period.
6. Cookies
clivio.fr uses CookieHub to collect your consent. Google Analytics 4 and Microsoft Clarity are loaded only after you accept them. You can change your choice at any time with the cookie settings button on the site.
7. Security
Data is encrypted in transit (TLS) and at rest (Google Cloud default encryption). Share links use short-lived signed URLs. We will notify you, and the CNIL where required, of any personal data breach affecting you.
8. Your Rights
You have the right of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent at any time and to set instructions for your data after your death. Write to contact@clivio.app; we answer within one month. You may lodge a complaint with the French data protection authority (CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr) or the authority of your country.
9. Audience
Clivio is offered to professionals (freelancers, businesses) and to consumers. It is not intended for minors.
10. Changes
We may update this policy, for instance when a provider changes. Significant changes will be announced by email or in the app. Last updated: October 11, 2026.
Last updated Oct 11, 2026. If something on this page looks wrong, tell us at contact@clivio.app.