Privacy policy

1. Data controller

Korvus, whose publisher is identified in the legal notice, is the controller of the personal data collected via the korvus.fr website and the app.korvus.fr application.

For any question about the protection of your data: [email protected].

2. What Korvus processes

Korvus processes five distinct categories of data:

2.1 Korvus service client accounts

Last name, first name, business email address, billing information, connection data (IP address at the time of connection, user agent). This data is collected for account management, billing, security and sending alerts.

2.2 Use of the Korvus platform

To understand how the SaaS is used and improve its user journeys, Korvus measures navigation in the onboarding and the app.korvus.fr dashboard with PostHog Cloud EU. This measurement covers pages visited, clicks, interactions, performance, browser errors, heatmaps and session replays. It may include the business content displayed in the dashboard, in particular domains, amounts, incidents and briefs.

Users are identified by a technical UUID and events are linked to the UUID of their organization. Values entered in forms, passwords, API keys, webhooks, and network request bodies and headers are not transmitted. This measurement is enabled by default in the SaaS and can be disabled at any time in Settings, Data & privacy.

2.3 Client website visitors (via the snippet)

Korvus is an audience measurement and technical issue detection solution. The data collected on client websites is described exhaustively, field by field, in our public documentation: Data collected by the Korvus snippet. The list of sub-processors used by Korvus is published on the dedicated page.

In summary: no cookie is set during normal operation, sessions are identified viasessionStorageand end when the tab is closed, no personally identifiable data is collected (no name, no email, no form content, no individual heatmap, no fingerprinting, no cross-domain tracking) and no mouse or click coordinates are captured. Korvus does not record browsing continuously: when an incident is detected, and only on websites where the optional video evidence module has been enabled, a video recording may be produced as evidence, with text masked before any upload, viewable only from that incident's file. This module is the only exception to the two points above: it records only with the visitor's consent, and the capture then includes pointer positions and click coordinates, without which the video would prove nothing. The IP address is never stored: it is used once on the server side to derive the country, then deleted.

Sensitive data (Article 9 GDPR). On some client websites (e.g., a floral e-commerce site with categories related to bereavement, condolences or religious events), the snippet may temporarily receive in transit button labels or visible error messages containing potentially sensitive terms. This data is neutralized on the server side (replaced with [sensitive]) before anything is written to the database, using a multilingual dictionary (French, Italian, Spanish, English, German). No data relating to health, religion or orientation is therefore retained.

2.4 Shopify stores (via the Korvus app)

When a merchant installs the Korvus app on their Shopify store, the app subscribes to the order creation event and installs a checkout pixel. The permissions requested are read_orders, write_pixels and read_customer_events. Korvus does not request any of the granular permissions that grant access to the name, email address, phone number or postal address of the merchant's customers.

What is retained. When an order is received, Korvus retains only the order identifier, the total amount, the currency, the payment status, the number of order lines, the promo codes applied, and the technical checkout token. The checkout pixel transmits the amount, the currency, the number of items, the checkout token and an anonymous Korvus session identifier.

What is never retained. Shopify sends the app the complete order, which contains personal data. Korvus discards it before anything is written: name, email address, phone number, shipping address, billing address and IP address are neither stored nor logged. Filtering is applied on the server side through a field allowlist, not merely through a declarative policy. The pixel, for its part, runs in an isolated environment imposed by Shopify: it can neither read the content of the payment page, nor access banking details, nor the contents of the cart.

Purpose and roles of the parties. This data is used exclusively to detect failures in the checkout funnel and estimate their financial impact for the merchant. It is not resold, not used for advertising purposes, and not combined across merchants. The merchant remains the controller; Korvus acts as a processor within the meaning of Article 28 of the GDPR, under the data processing agreement concluded with the merchant.

Consent and erasure. Before each transmission, the checkout pixel checks that the visitor has consented to audience measurement by querying the consent management interface provided by Shopify. Without consent, no data is sent. The app handles the access and erasure requests forwarded by Shopify; since it has retained no customer personal data, it has nothing to return or erase in this respect. Uninstalling the app deletes the store's data and the associated events.

2.5 korvus.fr prospects

When a person asks to receive Korvus insights, we collect their email address, the address of their e-commerce website if they provide it, the page from which the request was made, the date of the request and the version of the consent text displayed. This data is used only to manage the prospect relationship and to send the communications the person has explicitly consented to.

A technical anti-abuse identifier derived from the IP address is kept for thirty minutes at most, without allowing Korvus to recover the IP address. The email address, the optional e-commerce website domain and the page from which the request was made are stored in a Cloudflare D1 database under European jurisdiction, then synchronized to the Lemlist CRM. They are then added to a Korvus email sequence, from which the person can unsubscribe at any time.

When a person requests the audit report for their website from the audit page, we collect their business email address, the address of the audited website, the date of the request and the version of the information text displayed. This data is used to send them the report and to follow up on that audit: discussions about the findings and an offer of a demo. This follow-up does not count as a subscription to Korvus insights, which remains subject to a separate, optional checkbox. Every message contains an unsubscribe link.

3. Purposes and legal bases

• Provision of the service (anomaly detection, impact calculation, alerts) — performance of the contract
• Billing and account management — performance of the contract and legal obligations
• Analysis of platform usage, replays, heatmaps, user journey improvement and error detection — Korvus's legitimate interest in improving and securing its B2B product
• Audience measurement and technical issue detection on client websites — legitimate interest, exempt from consent under Article 82 of the French Data Protection Act (loi Informatique et Libertés) (see the detailed CNIL classification in the documentation)
• Marketing-oriented measurement (UTM parameters, click identifiers, transaction values) — visitor consent
• Audience measurement for the korvus.fr website (Google Analytics) and measurement of the effectiveness of our advertising campaigns (LinkedIn), via Google Tag Manager. Legal basis: visitor consent, collected through the cookie banner and changeable at any time
• Sending Korvus insights and offers to prospects who signed up on korvus.fr — explicit consent, withdrawable at any time
• Sending the audit report requested on korvus.fr and following up on that audit with the professional who requested it — Korvus's legitimate interest in responding to a professional request, with the right to object at any time

4. Hosting and transfers

The data collected on clients' websites is hosted in France, on Scaleway servers located in the Paris region, with no transfer outside the European Union. Usage telemetry for the app.korvus.fr platform is separate: it is processed by PostHog Cloud EU, with primary data residency in Frankfurt (Germany). PostHog Inc. is bound by a data processing agreement and contractual safeguards for any access or sub-processors outside the European Economic Area. See the full list of our sub-processors.

The public website korvus.fr is delivered by Cloudflare Pages. Prospects' contact details are stored in Cloudflare D1 under European jurisdiction, then processed in Lemlist, whose main databases are hosted in the European Economic Area. Any transfers made by their sub-processors are governed by their data processing agreements and, where necessary, by the European Commission's Standard Contractual Clauses.

If you accept audience measurement cookies or advertising cookies, browsing data (pages viewed, cookie identifiers, IP address, browser information) is transmitted to Google (Google Tag Manager, Google Analytics) and to LinkedIn (LinkedIn Insight Tag). These companies may process this data in the United States; these transfers are governed by the EU–U.S. Data Privacy Framework, in which Google and LinkedIn participate, and by Standard Contractual Clauses. Without consent, no data is transmitted to these services.

4.1 AI diagnosis

When a searches with no results alert is created for one of our clients, Korvus sends Mistral AI (a French company, EU infrastructure) an aggregated summary of the search queries concerned (top 10 with a frequency count) along with the associated technical metrics (volumes and rates of searches with no results, e-commerce platform). Search queries are included only for visitors who have given their consent; without consent, only the aggregated metrics are sent.

No IP address, session identifier, user agent or personally identifiable data is transmitted to Mistral AI. The call is made only once, when the alert is created. Mistral AI does not retain any data beyond processing the request.

4.2 Sub-processors

Korvus's main sub-processors are:

• Scaleway — application and database hosting, France (Paris)
• Stripe — subscription payment processing, EU (Ireland)
• Mistral AI — AI diagnosis for searches-with-no-results alerts, French company, EU infrastructure
• PostHog — product analytics, heatmaps and replays for the platform, Cloud EU (Frankfurt)
• Cloudflare — website delivery, abuse protection and European storage of prospect requests
• Lemlist — CRM management and sending of consented communications to prospects, main databases in the EEA

The full list, including purposes, data processed and applicable safeguards, is available on the Sub-processors page.

5. Retention periods

• Client account data: duration of the subscription + 3 years
• Data collected by the snippet: 13 months maximum, automatic deletion through monthly partitioning
• Billing data: 10 years (French legal obligation)
• Connection logs: 12 months
• Platform usage events: 13 months maximum
• Platform replays: 30 days maximum
• Prospect data: 3 years from collection or from the last active contact with the prospect
• Data required to honor an objection: kept in minimal form for 3 years to avoid contacting the person again
• Incident video evidence (optional module, disabled by default): 90 days, then automatic deletion; 100 days maximum in any event, as the storage itself deletes any file that may have escaped that deletion

6. Your rights

Under the GDPR, you have the rights of access, rectification, erasure, portability, objection and restriction of processing. To exercise them, write to [email protected].

Right to object for client website visitors: even for data exempt from consent, visitors can refuse Korvus collection by setting the cookie korvus_optout=1. When this cookie is present, the snippet does not initialize at all.

Platform users can object to PostHog measurement from Settings, Data & privacy. Disabling it stops autocapture and replay and resets the local PostHog identifier in that browser.

Recipients of marketing communications can withdraw their consent at any time via the unsubscribe link included in every email or by writing to [email protected]. Withdrawal does not affect the lawfulness of processing carried out before it.

People who have requested an audit report can object at any time to the follow-up of that audit, via the same unsubscribe link or by writing to [email protected].

7. Cookies and local storage on korvus.fr and app.korvus.fr

7.1 Strictly necessary cookies

These cookies are essential for the website to function. They do not require your consent.

7.2 Cookies subject to your consent (korvus.fr)

These cookies are set only after you agree, via the cookie banner. Google Tag Manager, which triggers them, is loaded only at that point. You can change or withdraw your choice at any time from the "Cookie settings" link at the bottom of every page; withdrawal does not affect processing already carried out.

Without your consent, the public website korvus.fr sets no analytics or advertising cookies. It does not transmit any browsing data to PostHog. The authenticated app.korvus.fr application uses the browser's local storage for the PostHog technical identifier and to remember whether product measurement has been disabled. The setting is available at any time in Data & privacy.

7.3 Anonymous audience measurement on korvus.fr (no cookie)

To measure traffic to the site and the effectiveness of our actions (for example, meetings booked on the Contact page), korvus.fr uses the Korvus measurement collector (gtm.korvus.fr). It sets no cookie: a random visit identifier (_sa_sid) is kept in the browser's session storage and disappears when the tab is closed. The data collected is the page viewed, the referring page, campaign parameters (UTM), screen size, load time and, where applicable, the booking of a meeting. No name or email address is collected, and the data is used only to produce aggregate statistics for Korvus.

This measurement is exempt from consent under Article 82 of the French Data Protection Act (loi Informatique et Libertés). You may nevertheless object to it at any time from the "Cookie settings" link at the bottom of each page ("Anonymous audience measurement" setting). Your objection is remembered by the korvus_optout=1 cookie (13 months): as long as it is present, the collector does not start.