Privacy Policy

1. Introduction

CALYO SAS ("Calyo", "we", "us", or "our"), a company registered in France (SIREN 994 199 859, RCS Paris), located at 60 rue François Ier, 75008 Paris, operates the website calyo.ai and the Calyo platform.

This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable French data protection laws.

2. Data Controller

The data controller for the processing of your personal data is:

3. Data We Collect

3.1 Account Data

When you create an account, we collect:

• Full name
• Email address
• Company name
• Password (encrypted)

3.2 Payment Data

Payment information (credit card numbers, billing address) is collected and processed directly by our payment provider, Stripe. We do not store your full payment details on our servers. We may receive limited information from Stripe such as the last four digits of your card and billing country.

3.3 Usage Data

We may collect anonymized, aggregated data about how you use the Service, including pages visited, features used, and session duration. This data is collected without cookies and cannot be used to identify you personally.

3.4 Creator Data

Calyo aggregates publicly available data from social media platforms to power its creator discovery and analytics features. This may include public profile information, audience statistics, and content performance metrics. Users of the platform act as independent data controllers with respect to any creator data they access through the Service.

4. How We Use Your Data

We use your personal data for the following purposes:

• Providing the Service: To create and manage your account, process subscriptions, and deliver the features of the platform.
• Communication: To send you important service-related notifications, such as billing confirmations, security alerts, and product updates.
• Improvement: To analyze usage patterns (on an anonymized basis) and improve the Service.
• Legal compliance: To comply with applicable laws, regulations, and legal obligations.

5. Legal Basis for Processing

We process your personal data based on the following legal grounds under the GDPR:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide you with the Service you subscribed to.
• Legitimate interest (Art. 6(1)(f)): Processing necessary for improving and securing our Service, and for anonymized analytics.
• Legal obligation (Art. 6(1)(c)): Processing required to comply with applicable laws (e.g., tax and accounting obligations).
• Consent (Art. 6(1)(a)): Where applicable, for optional communications such as marketing emails. You may withdraw your consent at any time.

6. Cookies

This website does not use cookies. We use a cookieless analytics solution that does not track individual users and does not require a cookie consent banner.

7. Third-Party Service Providers

We use third-party service providers to help us operate and deliver the Service. These providers process data on our behalf and are contractually bound to protect your data in accordance with the GDPR.

A complete list of our sub-processors is available upon request by contacting [email protected].

8. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA), including in the United States. When personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, including the use of Standard Contractual Clauses (SCCs) approved by the European Commission.

9. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with the Service. Upon account deletion, we will delete or anonymize your personal data within 30 days, unless we are required to retain it for legal or regulatory purposes.

Payment records may be retained for up to 10 years to comply with French accounting obligations.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit, secure hosting infrastructure, and access controls.

11. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete data.
• Right to erasure: You may request deletion of your personal data, subject to legal retention requirements.
• Right to restriction: You may request that we restrict the processing of your data in certain circumstances.
• Right to data portability: You may request to receive your data in a structured, commonly used, machine-readable format.
• Right to object: You may object to the processing of your data based on legitimate interest.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

12. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will promptly delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. The "Last updated" date at the top of this page indicates when this policy was last revised.

14. Supervisory Authority

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the French data protection authority:

15. Contact

For any questions or requests related to this Privacy Policy or your personal data, please contact us at: