Privacy policy

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit the Chloris website or use the Chloris platform. Personal data is any data that can be used to identify you personally. More detailed information is set out in the following privacy policy.

Data collection on this website and platform

Who is responsible for data collection?

Data processing is carried out by Chloris SAS, the operator of the website and platform. You can find the operator's contact details in the 'Information on the controller' section of this privacy policy.

How do we collect your data?

On the one hand, your data is collected when you provide it to us, for example by subscribing to Chloris Insights, contacting us, requesting a demo, exchanging emails with us, signing a quotation, creating an account, using the platform, or requesting support.

Other data is collected automatically or with your consent by our IT systems and service providers when you visit the website or use the platform. This is primarily technical and usage data, such as browser type, operating system, IP address, time of access, usage events, logs, error data, performance data, and session information.

What do we use your data for?

Some of the data is collected to provide the website and platform without errors, authenticate users, manage subscriptions, send requested research and product updates, provide support, secure the service, and comply with legal obligations. Other data can be used to analyze usage, troubleshoot issues, improve the product, and understand how users interact with the platform.

What rights do you have with regard to your data?

You have the right to receive information about the origin, recipient, and purpose of your stored personal data. You also have the right to have this data corrected or deleted and to request that processing be restricted. You may also have the right to object to processing, request data portability, and withdraw consent where processing is based on consent. If you have any questions, you can contact us at any time. You also have the right to lodge a complaint with a supervisory authority.

2. Hosting

External hosting

Our website and platform are hosted externally. Personal data processed through the website or platform may be stored on the servers of our hosting and infrastructure providers. This includes IP addresses, account data, authentication data, contact requests, metadata, communication data, contract data, project data, logs, and website or platform access data.

Hosters and service providers used

Supabase, Inc. Authentication, database, backend infrastructure, and storage of platform data. Data processing is based on Art. 6(1)(b) GDPR where necessary to provide the service and Art. 6(1)(f) GDPR for secure and reliable operation of the platform.

Render Services, Inc. Application hosting and deployment infrastructure. Data processing is based on Art. 6(1)(b) GDPR where necessary to provide the service and Art. 6(1)(f) GDPR for secure and reliable technical operation.

3. General notes and mandatory information

Data protection

We treat your personal data confidentially and in accordance with applicable data protection laws, including the GDPR. This privacy policy explains what data we collect and how we use it.

Information on the controller

Responsible for data processing is:

Chloris SAS 47 rue Vivienne 75002 Paris France

SIREN: 103898094 VAT number: FR23103898094 Email: privacy@chloris.ai

Chloris has not appointed a data protection officer at this stage.

Legal basis for data processing

- Art. 6(1)(a) GDPR: consent, where consent is required, for example for certain cookies or optional analytics technologies;

- Art. 6(1)(b) GDPR: performance of a contract or pre-contractual steps, for example to provide the platform, manage accounts, subscriptions, quotations, support, and billing;

- Art. 6(1)(c) GDPR: compliance with legal obligations, for example accounting, tax, and legal record-keeping obligations;

- Art. 6(1)(f) GDPR: legitimate interests, for example security, troubleshooting, product improvement, business communications, and prevention of misuse.

4. Analysis tools and telemetry

Google Analytics on the public website

When it is configured, the public Chloris website uses Google Analytics only after you accept optional analytics. It helps us understand aggregate page use and which product stories and calls to action are useful. It may process page URLs, interaction events, browser and device information, approximate location, and online identifiers used by the service.

Provider for users in the European Economic Area: Google Ireland Limited. Processing is based on your consent under Art. 6(1)(a) GDPR. You can withdraw that choice by clearing the website's stored data in your browser.

PostHog

We use PostHog for product analytics, telemetry, error monitoring, and session recordings.

Provider: PostHog, Inc.

PostHog helps us understand how users interact with the platform, detect technical issues, improve user experience, and secure the service. PostHog may process usage events, user identifiers, business email addresses where users are identified, browser and device information, IP address or anonymized IP information, logs, errors, performance data, and session recordings.

We have a data processing agreement in place with PostHog. Sensitive fields such as passwords should be masked or excluded. Users should not enter sensitive personal data into fields that are not intended for that purpose.

The processing is based on Art. 6(1)(f) GDPR for product improvement, troubleshooting, and security. Where consent is required for cookies or similar technologies, processing is based on Art. 6(1)(a) GDPR.

5. Plugins, AI tools, and business tools

Chloris Insights email subscriptions

If you subscribe through the public website, we process your email address, subscription date and status, consent version, the website form and landing path used, and any campaign parameters present in the page URL. Supabase provides the protected database and request-processing infrastructure for this subscription list.

We use this information to maintain the requested subscription and send occasional original research and major Chloris product updates. Processing is based on your consent under Art. 6(1)(a) GDPR. You can withdraw your consent at any time by contacting privacy@chloris.ai or using an unsubscribe method included in a message. We retain the subscription record while it is active and may retain limited suppression and consent evidence where necessary to respect an opt-out and demonstrate compliance.

AI providers

The Chloris platform may include AI features. Where these features are used, prompts, messages, project context, tool outputs, and generated responses may be processed by AI service providers only for the purpose of providing the requested feature.

Providers used may include Anthropic, PBC and OpenAI, L.L.C., depending on the feature and configuration.

Business, billing, and payment tools

We may use business tools to manage quotations, invoices, payments, accounting, banking, electronic signatures, emails, calendars, and customer communications.

Providers used may include Pennylane, Qonto, Stripe, Google Workspace, and electronic signature or document management providers selected by Chloris.

6. Cookies and similar technologies

Our website and platform may use cookies, local storage, software development kits, and similar technologies. Some are necessary to provide the service, authenticate users, maintain sessions, remember preferences, and secure the platform.

Other technologies may be used for analytics, telemetry, performance monitoring, product improvement, and session recordings. Where consent is required by applicable law, we will ask for it before using the relevant technology. You can also control cookies through your browser settings.

7. International transfers

Some service providers may be established outside the European Union or European Economic Area. Where personal data is transferred internationally, we rely on appropriate safeguards such as adequacy decisions, the EU-U.S. Data Privacy Framework, standard contractual clauses, data processing agreements, and other safeguards required by applicable law.

8. Your rights

Right of withdrawal

You can withdraw your consent to data processing at any time where processing is based on consent. The lawfulness of processing carried out before withdrawal remains unaffected.

Right of appeal

You have the right to lodge a complaint with a supervisory authority. In France, the competent authority is the CNIL: www.cnil.fr.

Information, deletion, correction, and restriction

You have the right to obtain information about stored personal data concerning you and to request correction, deletion, restriction, objection, or portability, subject to applicable law. To exercise your rights, contact us at alessandro.rossi@chloris.ai.

9. Data security

The website and platform use SSL or TLS encryption to transmit data securely. We also use technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

This privacy policy is regularly reviewed and may be updated to reflect legal, technical, or operational changes.