What happens to the documents you trust Clivio with
When you upload a lease or a payslip, it’s fair to want to know where it goes. This page explains how your documents are protected and which providers handle them, including the places where things aren’t yet the way we’d like them to be.
IN SHORT
- Encrypted while they travel (TLS), then again once stored
- Files open through temporary links that expire quickly
- Two-factor authentication with an app or by text message
- Your data is never sold, and never used to train a model of our own
- A ZIP archive whenever you want, and permanent deletion 30 days after you ask
- Part of the processing happens in the United States, under Standard Contractual Clauses
How your files are protected
We don’t run servers of our own. Clivio runs on managed services from Google Cloud and Firebase, which host the app, the database, your files and the server functions.
Fictional example.
Encryption in transit
Everything between your device and Clivio goes over an encrypted connection (TLS), so nobody can read a document while it’s on its way.
Encryption at rest
Once they arrive, your documents and data are stored on Google Cloud, which keeps them encrypted.
Links that expire
When you open a file, it reaches you through a temporary link that expires quickly. When you share a document, you decide how long the link stays valid (1 hour, 24 hours, 3 days or 7 days), and you can hide amounts, IBANs, ID numbers and addresses.
Two-factor authentication
Your code arrives by text message or in an authenticator app (TOTP). We recommend turning it on, because a stolen password is then no longer enough to get into your account.
Part of the processing happens in the United States
Today, Clivio isn’t hosted only in Europe. Follow a document from the moment you upload it to the moment the AI analyzes it.
You add a document from your computer, by email or by taking a photo of it.
Encrypted transfer (TLS)The website, the app, your account, the database and your files are hosted here.
Server-side processing and scheduled tasks run on Cloud Functions and Cloud Tasks.
United States, us-central1 regionThis is what reads your documents, pulls out their information, summarizes and translates them, and answers your questions.
Including the United States, no EU data residencyThese transfers have legal safeguards. They rely on the European Commission’s Standard Contractual Clauses and, where the provider is certified, on the EU-US Data Privacy Framework. Write to us if you’d like a copy of these safeguards.
Privacy policyWhat does the AI see of your documents?
- Provider
- Google, Gemini API (Gemini Developer API)
- Models
- Gemini 2.5 Flash and Gemini Embedding
- Location
- Google infrastructure, including in the United States
- Usage
- 1 AI action per analysis, question or translation
Each time the AI works on a document, whether to read it, file it, translate it or answer your question, the document’s text and images are sent to the Google Gemini API, along with your question if you asked one. The result then comes back to your account.
We don’t sell your data, and we don’t use it for targeted advertising. It isn’t used to train a model of our own either. Searching your library doesn’t use any AI actions at all.
The AI doesn’t make decisions for you. Anything that comes in from outside waits for your approval in “To sort,” and when the AI gets something wrong, you correct the title, type, date or tags.
SENT TO THE GEMINI API
RETURNED TO YOUR ACCOUNT
Fictional example.
The providers that process data for Clivio.
This is the same list as in our privacy policy and DPA. For providers outside the European Economic Area, transfers are covered as explained above, by the European Commission’s Standard Contractual Clauses and, where the provider is certified, by the EU-US Data Privacy Framework.
| Provider | Role | Data | Location |
|---|---|---|---|
| Clivio service (app) | |||
| Google Cloud / Firebase (Google) | Hosting of the website and the app (Firebase App Hosting), authentication, database (Firestore), file storage (Cloud Storage), server functions and scheduled tasks (Cloud Functions, Cloud Tasks) | Account data, documents and extracted data, data entered in the app, technical logs | Server functions and tasks run in the United States (us-central1 region) |
| Gemini API (Google, Gemini Developer API) | AI processing: reading documents and extracting their data, summaries, classification, translation, semantic search (Gemini 2.5 Flash and Gemini Embedding models), answers to the questions you ask about your documents | Content of documents (text and images) and of the questions sent to the AI, generated results | Google infrastructure, including in the United States, without EU data residency |
| Twilio SendGrid (Twilio Inc.) | Sending service emails (sign-up, notifications, reminders) and receiving the emails forwarded to your @inbox.clivio.app address | Email address, name, content and attachments of the emails sent and received | United States |
| Stripe (Stripe Payments Europe Ltd, Stripe, Inc.) | Online payment, subscription and trial management, billing customer portal, invoices | Identity, email address, payment details (entered and stored by Stripe only), billing history | Ireland and United States |
| Upstash (Upstash, Inc.) | Request rate limiting (abuse protection) | Technical identifiers (IP address, account identifier) and request counters | United States |
| Sentry (Functional Software, Inc.) | Detection and diagnosis of technical errors | Error reports, technical data (browser, device, IP address), account identifier | United States |
| Integrations enabled at your request | |||
| Google Drive (Google) | Exchange of the files you choose, only if you connect your Google Drive account | Access token, selected files and their metadata | United States |
| Dropbox (Dropbox, Inc.) | Exchange of the files you choose, only if you connect your Dropbox account | Access token, selected files and their metadata | United States |
| clivio.fr website (cookies, after consent except CookieHub) | |||
| CookieHub (CookieHub ehf.) | Collecting and storing your cookie choices on clivio.fr | Consent choices, consent identifier, technical connection data | Iceland (European Economic Area) |
| Google Analytics 4 (Google) | Website audience measurement, only after your consent | Pages viewed, events, cookie identifiers, browser and device information, approximate location | United States |
| Microsoft Clarity (Microsoft Corporation) | Analysis of how the website is used (heatmaps, session replays), only after your consent | Interactions with pages (clicks, scrolling, movements), browser and device information, cookie identifiers | United States |
Export or erase your data
The GDPR protects every Clivio user, wherever they live. To exercise your rights, write to contact@clivio.app and we’ll reply within one month. You can also file a complaint with the CNIL, the French data protection authority.
- Access
- Rectification
- Erasure
- Restriction of processing
- Portability
- Objection and withdrawal of consent
Fictional example.
Download a ZIP archive with all your files and data, whenever you like.
You do it from the app, without having to write to us.
After that, the account and its documents are erased. Only subscription invoices are kept, for 10 years, because French law requires it.
About your data
Have a question that isn’t answered here? Write to us.
Who can read my documents?
You, first of all. Then the people you send a share link to, for as long as you chose. If you invite your accountant, they can also see your supporting documents, read-only (with Pro). For analysis, the content goes through the Google Gemini API, as explained above.
Are my documents used to train an AI?
Not by Clivio. We don’t sell your data, and we don’t use it to train any model of our own. Analysis goes through the Google Gemini API, and the details are in our privacy policy.
Does my data stay in Europe?
Not all of it. Server functions run in the United States (us-central1 region), and the Gemini API doesn’t offer to keep data in the EU. These transfers are covered by the European Commission’s Standard Contractual Clauses.
How do I get all my documents back?
You can do it yourself from Settings › My data. Download a ZIP archive of all your files and data there, up to three times a day, without having to ask us.
Does Clivio guarantee a level of uptime?
Not with a figure, because we don’t publish an SLA. Technical errors are reported to us automatically through Sentry, and the state of each service is shown live on the status page.
How do I report a security issue?
By email, at contact@clivio.app, with a description of what you saw. Your message goes straight to the team that develops Clivio.
Reference documents
Try it with three documents that don’t matter.
See what Clivio does with them. If it’s not for you, you leave with a ZIP archive of everything. Free for up to 50 documents.
Free with no time limit · no credit card