Privacy policy

1. Introduction & scope

This policy describes how KnowVault, published by Carthanet (hereinafter "the Publisher"), collects, uses and protects the personal data of people who use its services.

It applies to all of KnowVault's touchpoints:

• The marketing website: knowvault.fr
• The public demo: demo.knowvault.fr
• The application: app.knowvault.fr

2. Data controller

The data controller is:

Carthanet, a SASU registered with the Paris Trade and Companies Register under number 930 115 506
Registered office: 60 rue François Ier, 75008 Paris, France
Contact: legal@knowvault.fr

3. Data collected

The data collected varies according to your use:

3.1. Marketing website visitors

When you fill in the contact form, we collect: first and last name, work email address, company name and size. This information is used solely to respond to your request. While you browse, anonymous traffic statistics are also collected (see section 9.3).

3.2. Demo users

The demo is accessible without sign-up, through a shared demonstration account. No changes are saved: create, send and delete actions are blocked. Sign-in is protected by Cloudflare Turnstile. Technical data (IP address, user agent, session logs) may be recorded for security and operational purposes.

3.3. Application users

When creating an account: email address, name, password (stored as a hash), company, roles. During use: the videos and content you create, comments, feedback, associated metadata, and activity logs necessary for security and support.

The audio track of videos is transcribed automatically, and transcripts may be translated automatically to provide subtitles and in-video search (see the subprocessors in section 5). Sign-in and sign-up are protected by a Cloudflare Turnstile anti-bot check. If you choose to sign in with Google or Microsoft, that provider sends us your name and email address; it then acts as a separate data controller under its own privacy policy.

If your visit came from a Google ad, the corresponding click identifier is also stored with your account for 120 days, without any cookie (see section 9.4).

3.4. Paying customers

Billing information (company name, address, VAT number where applicable) and payment history. Credit card data is never stored by KnowVault: it is processed directly by Stripe.

To enable billing by number of active Contributors, we store in our database the technical Stripe identifiers associated with your organization (Stripe customer ID, subscription ID, subscription line item ID), the chosen billing frequency (monthly or annual), the subscription status and the end date of the current period. This data is used solely to synchronize the number of billed seats with the actual number of Contributors and to display your subscription status in the application.

You can access the full history of your invoices, download the PDFs and update your payment method either from app.knowvault.fr (Billing tab) or via the Stripe customer portal, the link to which is available from your account area.

4. Purposes & legal bases

We process your data for the following purposes:

• Responding to your contact requests — legal basis: pre-contractual steps taken at your request (art. 6.1.b GDPR)
• Providing the KnowVault service — legal basis: performance of the contract (art. 6.1.b)
• Invoicing and accounting — legal basis: legal obligation (art. 6.1.c)
• Securing the service, preventing fraud — legal basis: legitimate interest (art. 6.1.f)
• Improving the product — legal basis: legitimate interest, using aggregated and anonymized data only
• Measuring marketing-website traffic (Google Analytics) — legal basis: your consent (art. 6.1.a), collected via the cookie banner and revocable at any time
• Producing anonymous traffic statistics for the marketing website and the demo (in-house tool) — legal basis: legitimate interest (art. 6.1.f), consent-exempt measurement under the conditions described in section 9.3
• Measuring the effectiveness of our advertising campaigns (Google click identifier, no cookie) — legal basis: legitimate interest (art. 6.1.f), under the conditions described in section 9.4

5. Subprocessors & recipients

Your data may be processed by the following subprocessors, selected for their security guarantees and GDPR compliance:

• Supabase Inc. — database, authentication and video storage. Infrastructure hosted in the European Union (Ireland).
• OVHcloud (OVH SAS) — hosting of the servers for the marketing website, the demo, the application and video processing. Data hosted in France/EU.
• Resend, Inc. — sending of transactional emails (contact request confirmation, invitations, notifications).
• OpenAI — automatic transcription of the audio track of videos. Under its API terms, the data sent is not used to train its models.
• DeepL SE (Germany) — automatic translation of transcripts and subtitles.
• Stripe Payments Europe, Ltd. — payment processing, invoice issuance, hosting of the customer portal (updating the payment method, viewing invoices, cancellation, switching monthly ↔ annual frequency) and automatic VAT calculation based on the billing address. No credit card data is stored by KnowVault; it is processed in a PCI-DSS Level 1 certified environment by Stripe.
• Cloudflare, Inc. — Turnstile service (anti-bot protection on the sign-in and sign-up forms of the demo and the application).
• Google Ireland Ltd. / Google LLC — Google Analytics 4 service, used only on the marketing website knowvault.fr and triggered exclusively after your explicit consent. Google Analytics 4 does not log or store IP addresses. No Google analytics tool is loaded on the demo or the application. Google Ads also receives, from our servers and without any cookie, confirmation that an ad click led to a sign-up (see section 9.4); it then acts as a separate data controller.

No data is sold, rented or passed on to third parties for advertising purposes.

6. Retention periods

• Prospects (contact form): 3 years from the last contact (CNIL recommendation)
• Active user accounts: for the duration of use of the service
• Created content (videos, feedback): for the duration of the subscription + 30 days after account deletion (grace period for export)
• Transcripts and translations: same duration as the corresponding video
• Billing data & invoices: 10 years (accounting obligation)
• Security logs: 12 months
• Analytics cookies (Google Analytics): 13 months maximum (CNIL recommendation)
• Storage of your consent choice: 6 months, after which the banner is shown to you again
• In-house audience measurement: 25 months for statistics; the identifier stored in your browser expires after 13 months
• Advertising click identifier: 120 days from sign-up

7. Transfers outside the European Union

KnowVault's main infrastructure is hosted in the European Union. Some subprocessors (in particular Stripe, Cloudflare, Supabase, Resend, OpenAI and Google) are companies incorporated under US law or belong to US groups. Any transfer of data to a country outside the EU is governed by the Standard Contractual Clauses of the European Commission and, where applicable, by the EU-US Data Privacy Framework certification.

8. Security

We implement appropriate technical and organizational measures to guarantee the confidentiality and integrity of your data:

• AES-256 encryption at rest and TLS 1.2/1.3 in transit
• Strict access controls: roles, data isolation per organization
• Access to videos through signed links with a limited validity period
• Regular security audits and reviews
• Hosting in ISO 27001-certified data centers

9. Cookies

9.1. Strictly necessary cookies

The marketing website sets a language preference cookie (NEXT_LOCALE). Your analytics choice is stored in your browser's local storage, without a cookie. The demo and the application use user session cookies and the Cloudflare Turnstile token (anti-bot). These strictly necessary trackers do not require prior consent, in accordance with article 82 of the French Data Protection Act.

9.2. Analytics (Google Analytics)

The marketing website knowvault.fr uses Google Analytics 4 to measure traffic and improve the visitor experience. These cookies are only set after your explicit consent, collected via the banner shown on your first visit. Until you have accepted, no Google script is loaded.

When you consent, the following cookies may be set: _ga, _ga_<ID> (identifiers used by Google Analytics to distinguish visitors and sessions). Google Analytics 4 does not log or store IP addresses. No data is used for advertising purposes or cross-referenced with other Google services.

You can change your choice at any time by clicking "Manage cookies" at the bottom of the page. Declining or withdrawing your consent has no impact on access to the service.

The demo (demo.knowvault.fr) and the application (app.knowvault.fr) use no analytics cookies.

9.3. In-house audience measurement (no consent required)

To understand which content interests our visitors, the marketing website and the demo use an audience measurement tool developed and hosted by KnowVault. In line with CNIL guidelines, this measurement does not require consent, as it is strictly limited to producing anonymous statistics:

• a random identifier, unrelated to your identity, is placed in your browser's local storage for 13 months maximum, without being extended on each visit;
• we record: pages viewed, clicks on the main buttons (demo, sign-in, sign-up), whether a form was started or sent (never its content), active time spent in the demo, the source (referring website, campaign parameters), device type and country;
• the country is derived from the IP address upon receipt, using a geolocation database stored on our servers; the IP address is neither kept nor passed on to any third party;
• this data is not combined with any other processing, in particular contact requests, cannot be used to track your browsing on other websites, and is kept for 25 months maximum.

You can object to this measurement at any time, with no impact on access to the website. Your choice is saved in this browser, for the website on which you make it. For the demo, open this link: stop being measured on the demo.

9.4. Advertising conversion measurement (no cookie)

If you reach the marketing website from a Google ad, the page address contains an advertising click identifier (gclid) added by Google. We use it only to know which ads lead to a sign-up, not to track you.

• it is held in memory for the lifetime of your tab, then appended to the link when you click through to app.knowvault.fr: no cookie is set and nothing is written to your browser;
• if, and only if, you create an account, it is stored on our servers, attached to that account;
• we then send Google Ads, from our servers, only the fact that an ad click led to a sign-up and then to an account activation. Neither your name, nor your email address, nor any data from your account is sent;
• no Google measurement tool is loaded on the application: it contains no advertising script;
• this identifier is deleted after 120 days.

This processing relies on our legitimate interest in measuring the effectiveness of our campaigns (art. 6.1.f GDPR). As it involves neither reading nor writing information on your device, it falls outside the scope of the cookie banner. You may object at any time by writing to us (see section 12): the identifier associated with your account will be erased.

10. Your rights

In accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights:

• Right of access to your personal data
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw your consent at any time
• Right to set post-mortem directives

To exercise these rights, contact us at legal@knowvault.fr. We respond within a maximum of one month.

11. Complaint to the CNIL

If you believe your rights are not being respected, you may lodge a complaint with:

CNIL — French Data Protection Authority
3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
www.cnil.fr

12. Changes & contact

This policy may change over time. Substantial changes are notified to account holders by email. The date of the last update appears at the top of this page.

For any question: legal@knowvault.fr