Privacy Policy

1. Data collected

• Account: email, name, password (hashed)
• Usage: actions on the platform, audits run, reports generated
• Billing: handled by Stripe — Karavix never stores card data
• Technical: IP address (anonymized after 30 days), user-agent, access logs

2. Legal basis for processing

• Contract performance: service access, billing
• Legitimate interest: security, fraud prevention, service improvement
• Consent: marketing communications (optional)

3. Retention period

• Active account data: duration of the contractual relationship
• After termination: 6 months for billing data, then deletion
• Security logs: 90 days
• IP addresses in funnel events: anonymized after 30 days

4. User rights

Under GDPR and Law 25, you have the following rights:

• Access: obtain a copy of your data
• Rectification: correct inaccurate data
• Erasure: deletion of your data (right to be forgotten)
• Portability: receive your data in a structured format
• Objection: object to processing based on legitimate interest

To exercise these rights: privacy@karavix.com

5. Tracking and cookies

Karavix uses no third-party trackers without your explicit consent. Functional cookies are used for authentication and preferences. No advertising tracking cookie is set. With your consent, PostHog measures navigation, performance and errors. Session replays, when enabled, mask text and input fields. You can change your choice in Settings or through “Manage optional cookies”.

6. Subprocessors

• Supabase: database and authentication (GDPR-compliant hosting)
• Stripe: payments (PCI-DSS certified)
• Resend: transactional emails
• PostHog: usage and performance analytics with consent (US region)

7. DPO contact

Data Protection Officer: privacy@karavix.com
Karavix Inc. · Montréal, Québec, Canada