Privacy Policy
Last updated: 2026-02-12
Calyo Consulting respects your privacy. This page explains what data we collect, why, and how we process it.
Controller
- Calyo Consulting SASU, simplified joint-stock company (France)
- SIREN: 942 694 068 — Trade Registry: RCS Toulouse
- Data protection contact: [email protected]
- Website: www.calyo-consulting.fr
Calyo Consulting has not appointed a Data Protection Officer (DPO). For any question regarding your personal data, contact: [email protected]
Data we collect
Registered users (Calyo One)
- Account information: name, email, company name
- Subscription data: plan, dates, status
- Payment data: managed by Stripe (we do not store card numbers)
- Usage data: activated modules, logins
Prospects (interactive tools)
- Contact information: first name, last name, email, phone, company
- Scores and results from assessment tools
- Personal data (name, phone, company) is encrypted using AES-256-GCM in the database. Only the email address is stored in plain text for correspondence purposes.
Website visitors
- Technical data (IP address, visited pages, user agent) for security purposes
- Analytics cookies (Google Analytics): subject to your consent. You can accept or decline via the cookie banner displayed on your first visit. If declined, no analytics data is collected.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Managing your Calyo One account | Contract performance |
| Processing payments | Contract performance |
| B2B prospecting (interactive tools) | Legitimate interests |
| Security and fraud prevention | Legitimate interests |
| Analytics (GA4) | Consent |
| Administrative audit log | Legitimate interests |
Retention
| Data | Duration |
|---|---|
| User accounts | Until account deletion |
| Payment data (Stripe) | Per legal obligations (10 years accounting) |
| Leads (tool prospects) | 24 months after collection (automatic deletion) |
| Tool usage quotas | 24 months after last use |
| Audit logs (IP) | 90 days (IP automatically masked after) |
| Technical logs | Up to 12 months |
| Deletion tokens | 24 hours |
Processors and transfers
| Processor | Usage | Location | Safeguards |
|---|---|---|---|
| Stripe | Online payments | USA | EU-US Data Privacy Framework, PCI DSS |
| Google Analytics | Statistics (if accepted) | USA | EU-US Data Privacy Framework, IP anonymized |
| Authentik (self-hosted) | Authentication, MFA | France (dedicated server) | No transfer outside EU |
| MinIO (self-hosted) | File storage | France (dedicated server) | No transfer outside EU |
| Redis (self-hosted) | Cache and sessions | France (dedicated server) | No transfer outside EU |
| Maddy (self-hosted) | Transactional email server | France (dedicated server) | No transfer outside EU |
| Gotenberg (self-hosted) | PDF document generation | France (dedicated server) | No transfer outside EU |
| PostgreSQL (self-hosted) | Database | France (dedicated server) | No transfer outside EU |
Self-hosted components run on our dedicated servers in France. No data is transferred outside the EU except to Stripe and Google Analytics (if accepted), both covered by the EU-US Data Privacy Framework.
Your rights
Under the GDPR, you have the following rights:
- Access: obtain a copy of your data
- Rectification: correct inaccurate data
- Erasure: delete your account and data
- Restriction: restrict processing
- Objection: object to processing
- Portability: receive your data in a structured format
Automated exercise of your rights
If you have a Calyo One account, you can exercise your rights directly from your My Account page:
- Export my data: download all your data (profile, subscriptions, payments, modules) in JSON format
- Delete my account: request account deletion. A confirmation email will be sent. After confirmation, your account and all associated data will be permanently deleted.
Note: deleting your account does not delete prospecting data (leads) associated with your email, which is retained under our legitimate interest for 24 months.
For any other request: contact us at [email protected] with the subject of your request. You may also file a complaint with the competent supervisory authority (CNIL in France: www.cnil.fr).
Cookies
| Cookie | Purpose | Duration | Consent |
|---|---|---|---|
calyo_session | User session (HttpOnly) | Session | Not required (essential) |
calyo_logged_in | Login indicator (UI) | 7 days | Not required (essential) |
calyo_cookie_consent | Cookie choice | 1 year | Not required (preference) |
calyo_verified_lead | Tool email verification marker (email only) | 30 days | Not required (functional) |
Google Analytics (_ga, _ga_*) | Statistics | 14 months | Required (banner) |
Local storage (localStorage)
| Key | Purpose | Duration |
|---|---|---|
theme | Light/dark theme preference | Permanent (clearable by user) |
calyo_cookie_consent | Cookie choice backup | Permanent (clearable by user) |
This data stays on your device only and is never sent to our servers.
Security
We implement technical and organizational measures to protect your data:
- AES-256-GCM encryption of sensitive personal data
- Mandatory multi-factor authentication (MFA)
- JWT sessions signed with HMAC-SHA256, HttpOnly/Secure/SameSite cookies
- Rate limiting on authentication endpoints
- SHA-256 hashing of sensitive tokens (recovery, deletion)
- Automatic IP masking in audit logs after 90 days
Updates
We may update this policy. Last update: 2026-02-12