1. Data controller
The data controller for Suitra (and the broader CleverAI product family) is AZINOVE SAS, a French société par actions simplifiée registered with the Strasbourg RCS under SIREN 897 432 324, whose registered office is at 13 Rue de Dahlenheim, 67200 Strasbourg, France. Patrick Eiermann is the legal representative (Président).
Privacy contact: privacy@cleverai.ai. We have not formally appointed a Data Protection Officer (DPO) at this stage; we will do so as soon as the scope of our processing activities triggers GDPR Article 37(1).
2. What personal data we collect
We process the following categories of personal data:
- Account information: name, email address, profile picture, organization membership — provided directly by you or retrieved from your identity provider (Google, GitHub, Microsoft). Authentication is delegated to Clerk.
- Usage and telemetry: API call timestamps, model identifiers, token counts (for billing), feature interactions, IP address truncated for anti-abuse purposes.
- Technical data: browser user agent, device type, language preference, server-side error logs (no third-party error-tracking processor).
- Product analytics (PostHog): the pages you view and a few named product events, counted anonymously and without cookies; and, only if you accept “Analytics and session recordings” in the cookie banner, session recordings (page layout, mouse movements and clicks, with sensitive content masked), heatmaps and clicks, linked to a random device identifier and, if you are signed in, to a pseudonymous identifier. Details in the Cookie Policy.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provision of the CleverAI services to you | (b) Performance of a contract |
| Security, fraud prevention, abuse detection | (f) Legitimate interest |
| Product improvement (aggregated, non-identifying) | (f) Legitimate interest |
| Product analytics without cookies: anonymous counts of page views and product events (PostHog, cookieless mode) | (f) Legitimate interest |
| Improving the product with session recordings, heatmaps and click analysis (PostHog) | (a) Consent — opt-in in the cookie banner, withdrawable at any time |
| Marketing emails (newsletters, feature announcements) | (a) Consent — opt-in required |
| Customer support requests you initiate | (b) Performance of a contract |
4. AI-generated content and model training
We do not train AI models on your content. Your prompts and the corresponding model outputs are not used to train, fine-tune, or improve any third-party model. We pass your content to model providers (OpenAI, Anthropic, Google, Mistral, etc.) only to obtain the completion you requested, and we have contractually opted out of any training-data use where the provider offers such an option (OpenAI zero-data-retention, Anthropic no-training-by-default).
Outputs generated by AI may be inaccurate, biased, or otherwise unsuitable for any particular purpose. You remain responsible for verifying outputs before relying on them — see also our Terms of Service.
5. Recipients and subprocessors
We share personal data with the following subprocessors, each acting under a contract that incorporates GDPR Article 28 obligations:
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription billing, invoice management | US/IE | Standard Contractual Clauses (SCCs) |
| Vercel Inc. | Application hosting, edge runtime, CDN, cookieless aggregate audience measurement (Vercel Web Analytics) | US | Standard Contractual Clauses (SCCs) |
| Neon Inc. | Managed PostgreSQL database hosting | US/EU (Frankfurt) | Standard Contractual Clauses (SCCs) |
| OpenAI, OpCo, LLC | Large language model inference (ChatGPT, GPT-4, DALL-E) | US | Standard Contractual Clauses (SCCs) |
| Postmark / ActiveCampaign LLC | Transactional email delivery (account, billing, notifications) | US | Standard Contractual Clauses (SCCs) |
| Vercel Inc. (AI Gateway) | Routes Pro AI requests (quote lines from a description or a photo, leads and contacts from a pasted message, email drafts, tidied call notes, plain-words filters, summaries and next steps) to the model provider listed above, with zero data retention and no training on the data. Used only when a user starts an AI action. | US | Standard Contractual Clauses (SCCs) |
| PostHog, Inc. | Product analytics to improve the service: anonymous, cookieless page views and product events and, only with consent, session recordings and heatmaps with sensitive content masked. Data hosted on PostHog EU Cloud. | EU (Frankfurt) | Standard Contractual Clauses (SCCs) |
6. International data transfers
Some of our subprocessors are based in the United States. Where data is transferred outside the European Economic Area, we rely on either the EU-US Data Privacy Framework (for certified recipients such as Google) or the European Commission's Standard Contractual Clauses (Decision 2021/914) for all other US recipients, supplemented by appropriate technical and organizational measures.
7. Retention
- Account data — retained while your account is active, deleted within 30 days of account closure (90 days for encrypted backups).
- Usage logs — 12 months for security and abuse detection.
- Product analytics events (PostHog) — 13 months.
- Session recordings (PostHog, only with your consent) — 30 days.
8. Your rights under GDPR
You have the right to:
- Access your personal data (Art. 15)
- Request rectification of inaccurate data (Art. 16)
- Request erasure (Art. 17) — "right to be forgotten"
- Restrict processing (Art. 18)
- Receive your data in a portable format (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time (Art. 7(3))
- Lodge a complaint with a supervisory authority — for France, the CNIL
To exercise any of these rights, contact privacy@cleverai.ai. We will respond within one month, extendable by two months for complex requests (GDPR Art. 12(3)).
9. Access by AZINOVE personnel
Authorized AZINOVE staff bound by written confidentiality obligations may access your personal data when strictly necessary for: (a) responding to a support request you initiate; (b) investigating suspected abuse, fraud, or security incidents; (c) legal compliance (subpoena, court order, regulatory request — where lawful, we will notify you); (d) operating, debugging, or maintaining the service. All such accesses are minimized to the data needed for the purpose and logged for audit.
10. Security
We implement appropriate technical and organizational measures to protect personal data, including encryption in transit (TLS 1.3), encryption at rest (database-level), Clerk-managed authentication with MFA support, audit logging, and segregation of duties for production access. Despite these measures, no system is perfectly secure; if we become aware of a personal-data breach affecting you we will notify you and the CNIL within 72 hours as required by GDPR Art. 33-34.
11. Cookies
See our dedicated Cookie Policy for the complete cookie inventory and consent mechanism.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or in-product notice at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.
Suitra-specific provisions
Suitra — Your business records: AZINOVE is your processor
Suitra stores the records your team enters in your workspace:
- Contacts: companies and people, with names, job titles, email addresses, phone numbers, postal addresses, websites and SIREN numbers.
- Sales: opportunities (stage, expected revenue, probability, deadlines, tags, lost reasons), activities, notes, chatter messages and the history of changes to each record.
- Documents: products, quotations, orders, invoices and payments, with the delivery addresses printed on them.
- Your company: the legal identity, VAT number and bank details printed on your documents, and your team members' names and email addresses.
For these records your business is the data controller and AZINOVE SAS acts as its processor (GDPR Art. 28), on the terms of the Data Processing Agreement. You decide what goes into Suitra, you inform the people concerned, and you need a legal basis to keep their data. When one of your contacts asks to see or erase their data, the request is yours to answer: Suitra lets you view, correct, export and delete records, and we help as the agreement describes. AZINOVE is the controller only for what the rest of this policy describes: your users' accounts, the security of the service and, once paid plans open, its own billing.
Suitra — How long records are kept
- Records stay in your workspace until you delete them. Opportunities, quotations, draft invoices, payments and contacts that no quotation or invoice refers to can be deleted. Products are archived instead, so past documents keep their lines. Posted invoices are locked and cannot be deleted.
- A workspace admin can download everything Suitra stores for the workspace, or delete the workspace, from Account & data. Deletion removes every record from the live database at once; copies in the database host's backups expire within the backup period stated under Retention above.
- Invoices and accounting documents must be kept for 10 years by the business that issued them (Code de commerce, art. L123-22). That obligation is yours: Suitra gives you a PDF of every quotation and invoice and a full export of the workspace, but keeps no copy once you delete the workspace.
Suitra — AI features (Pro plan)
AI runs only on the Pro plan, and only when a user clicks an AI action. Nothing is sent to a model in the background. The public demo shows fixed example outputs on its sample data and calls no AI. Each AI action shows what it sends before you use it; email addresses, phone numbers and bank details from your records are never sent. What each feature sends:
- Opportunity summary and next step: the opportunity's name, customer and contact name, stage, status, expected revenue, probability, expected closing date, tags and internal description, its planned activities, and its 30 most recent chatter entries with their authors' names.
- Quote lines from a description or a photo: the description you typed or dictated, or the photo of your notes (shrunk on your device and not stored by Suitra), and up to 300 products of your catalogue (references, names, units and descriptions, without prices).
- Lead from a pasted message, and filling a contact from text: the text you paste, which may contain the sender's contact details, and your tag names.
- Email drafts (follow-ups, quotations waiting for an answer, payment reminders): the record's name and status, the contact's first name and company name, your name, and the chatter notes you leave ticked. Amounts and dates are added by Suitra from your records after the draft is written.
- Tidying call notes: the notes you typed or dictated, and the record's stage, expected revenue, probability and expected closing date (for an opportunity) or job title (for a contact).
- Filtering a list in plain words: your sentence and the list's field names and choices, never its records.
The request goes through the Vercel AI Gateway to OpenAI, OpCo, LLC, which generates the answer, with zero data retention: the provider keeps neither the request nor the answer, and neither is used to train models. Suitra keeps the answer only if you do something with it: log it as a note, apply it to a record or a quotation, or copy it. For each AI request Suitra records only when it ran, who started it, the feature, the model, the number of tokens, its cost and whether the result was used, never the text sent or received; this record is kept for 400 days, and what “Undo AI changes” needs (previous field values) for 30 days.
Dictation: the Dictate button uses your browser's built-in speech recognition, and Suitra receives only the text. Depending on your browser, the audio may be processed by its vendor (for example Google for Chrome, or Apple for Safari) under that vendor's own terms. Type the description instead if you prefer.
AI results are suggestions for a person to review. Suitra makes no automated decision about anyone (GDPR Art. 22).
Suitra — The public demo
Opening /demo creates a private sandbox: a copy of a fictional company whose names are invented and whose email addresses use the reserved .example domain. You need no account and we ask for no personal data. A suitra_sandbox cookie remembers which sandbox is yours (see the Cookie Policy). If you accept session recordings in the cookie banner, your visit to the demo may be recorded with every form field masked, but the text shown on its pages is not masked, including what you added to the sandbox.
What you type in the demo is stored in our database like any workspace, so do not enter real personal data. A sandbox expires 24 hours after it was opened: it can no longer be reached, and the automatic clean-up then deletes it with everything typed into it. “Leave the demo” deletes it at once.
Suitra — Billing
Pro cannot be bought online yet, so Suitra collects no payment data today. Stripe is listed among the subprocessors in advance: once paid plans open, it will process payments, and AZINOVE will keep its own invoices and billing records for 10 years (Code de commerce, art. L123-22).
Suitra — Exercising your rights
- Your workspace: an admin downloads everything Suitra stores for it (a JSON file) or deletes it from Account & data, in the menu under your name.
- Your sign-in identity: your name, email address and sign-in methods (password, passkeys, two-factor) are kept by AZINOVE in Suitra's own database. You may belong to several workspaces, so deleting a workspace does not delete them. To get a copy of your identity, correct it or delete it, write to privacy@cleverai.ai.