Privacy policy
Last updated: 22 October 2026
This English version is provided for convenience. The French version prevails in case of any difference.
Document being finalized
This document is being finalized: some legal information is still to be provided or the text has not yet received its final legal review.
This policy explains what data is processed when you visit the Connexus website or use the service, why, for how long and how to exercise your rights.
1. Who is responsible?
- For accounts, trial, billing and the website: TWM ADVISORY (see the legal notice) is the controller.
- For your partners’, contacts’ and opportunities’ data entered in Connexus: you are the controller and Connexus is the processor (see the DPA).
2. Data collected
- Identity and contact details.
- Account data.
- Usage data and logs.
- Billing data, processed through Stripe: Connexus does not store card numbers.
- Content entered by users.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service | Performance of the contract |
| Security and fraud prevention | Legitimate interest |
| Billing and accounting | Legal obligation |
| Commercial communications | Consent, or legitimate interest in B2B, with easy opt-out |
| Audience measurement | Consent |
4. Recipients and processors
| Processor | Role | Location |
|---|---|---|
| Supabase | Database hosting and server functions | European Union (Paris, France) |
| Vercel | Website and web application hosting | United States, global servers (indicative) |
| Stripe | Payment, once online payment opens | Stripe Payments Europe for the EU; United States (indicative) |
| Resend | Transactional e-mails | United States (indicative) |
The AI providers and integrations that the Customer enables with its own keys (for example OpenAI, OpenRouter, HubSpot, Slack, Pappers) act under its contract and are not sub-processors of Connexus.
The location of the database (Supabase) is confirmed. The location of the other providers is indicative and can be specified on request. The up-to-date list is available on request: tannous@connexus.fr.
5. Transfers outside the European Union
The service database is hosted in the European Union (Paris, France). Sub-processors established outside the European Union (Vercel, Stripe, Resend and the Supabase company) are covered by the European Commission’s standard contractual clauses or, for a certified provider, by the EU–US Data Privacy Framework. The mechanism used for each provider and a copy of the safeguards are provided on request at tannous@connexus.fr. The same applies, where applicable, to Google (audience measurement).
6. Retention periods
| Data | Period |
|---|---|
| Account and data entered by the customer | During the contract; after it ends, export on request for 30 days, then deletion within the following 30 days (see the DPA) |
| Database backups | Purged by rotation within 30 days |
| Audit log and technical logs | 12 months |
| Newsletter and leads | Until unsubscription, or 3 years without interaction |
| Invoices and accounting records | 10 years (legal obligation, article L123-22 of the French Commercial Code) |
7. Artificial intelligence
AI features use the customer company’s own key; data sent to the AI provider is governed by its contract with that provider. Connexus does not send data to an AI provider with a shared key. Actions proposed by agents are subject to human validation, unless the Customer itself allows low-risk internal actions to run automatically.
8. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw consent at any time and the right to set instructions for after your death. To exercise them: tannous@connexus.fr.
You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
No data protection officer has been appointed to date. For any question: tannous@connexus.fr.
9. Security
Connexus applies reasonable measures: database hosting in the European Union (Paris, France), encryption of AI keys and integration secrets, access controls designed to isolate each organization’s data and an audit log. No system is infallible, so these measures are not an absolute guarantee.