Privacy policy

Have you received a proposal sent with Cuevr? What concerns you is in Article 4: the company that sent it to you is the controller of your data, and Cuevr processes it on that company’s behalf.

This policy explains what personal data Aetherly processes, why, for how long and with whom, in three situations: you visit the cuevr.com website (Article 2); you use the Cuevr application (Article 3); you read or sign a proposal sent with Cuevr (Article 4). It applies Regulation (EU) 2016/679 (“GDPR”) and the French Data Protection Act (loi Informatique et Libertés).

Article 1: Who we are

Cuevr is published by Aetherly, SAS with share capital of 5,000 euros, RCS Nantes 941 153 561, 9 rue Orion, 44115 Basse-Goulaine, France.

Aetherly is the controller for the website, its customers’ accounts, subscriptions, invoicing, support, the security of the service and its own prospecting. For the proposals its customers send with Cuevr, Aetherly is each customer’s processor (Article 4).

For any question or request about your data: dpo@cuevr.com.

Article 2: You visit cuevr.com

What we receive

• Demo request: first name, business e-mail address and company; surname and telephone number if you provide them.
• Contact form: e-mail address, reason and message, and any other fields you fill in.
• Origin of your request: each form sends the page where you filled it in, the campaign parameters in the address (UTM) and the site you came from (address without parameters).
• Proposal Roaster: the PDF file you upload, read while it is analysed by Google’s Gemini artificial intelligence and never kept; to receive the report, your first name, your business e-mail address and, if you wish, your company. To limit abuse, your IP address is turned into an unreadable hash, renewed each day and erased the next day.
• Booking a meeting: if you display the demo calendar, it is provided by Lemcal; if you have filled in the demo form, your name and e-mail address are pre-filled. You then book directly in that calendar.
• Audience measurement (Plausible, on our own instance hosted in Europe): pages viewed, referring site, country, device and browser type, clicks on the demo and trial buttons, outbound links. No cookies and no storage in your browser. To count visitors, your IP address and browser are sent to our instance, which keeps only a hash renewed each day.
• Bot protection: when you use a form, technical signals from your browser and your IP address are checked by Cloudflare Turnstile.

Why and on what legal basis

• To answer your request, organise the demo and send you the Proposal Roaster report: pre-contractual measures taken at your request.
• To contact you again about Cuevr after a request: our legitimate interest in presenting our service to professionals who are interested in it. You may object at any time, with one e-mail or through the unsubscribe link.
• To know how you found us and measure the website’s audience: our legitimate interest, with cookie-free measurement and aggregated statistics.
• To protect the forms against abuse: our legitimate interest.

How long

• Demo, contact and Proposal Roaster requests: 3 years after our last exchange, then automatic deletion.
• Proposal Roaster: the PDF is never kept; the analysis result is kept for no more than 15 minutes, the time needed to send it to you; the IP address hash is erased the next day.
• Audience measurement: aggregated statistics, with no data that identifies you.

Article 3: You use the Cuevr application

What we process

• Your account: e-mail address, password (stored as a hash, never in plain text), first name, surname, job title, language; photo, telephone number and “how did you hear about us” if you provide them.
• Your organisation: name, website, size, country and, if you enter them, contact details and legal information (address, SIRET, VAT).
• Subscription and invoicing: plan, number of seats, invoices. Your card is entered and stored by Stripe; we never have its number. Stripe receives the account e-mail address and the organisation’s name and country.
• Your content: what you create or import in Cuevr (proposals, templates, knowledge base, files, contacts). For this content and your prospects’ data, we act on your behalf, as provided in the Data Processing Agreement annexed to our Terms and Conditions.
• Cuevr AI: the content you submit to Cuevr AI is processed by our AI provider, Google (Gemini API), and technically monitored by Langfuse. It is not used to train any model.
• Support: on the Support page, the assistant and the ticket form are provided by Aidbase, which receives your user ID, your name, your e-mail address and the content of your exchanges.
• Security: at sign-up, Google reCAPTCHA receives your IP address and signals from your browser to keep out bots. When you log in, we record the IP address and browser of each session.
• Advertising attribution: if you arrive through a Google Ads advertisement, the click identifier (“gclid”) is linked to your account and to your customer record at Stripe, to measure the effectiveness of our advertisements.
• Usage measurement: with your consent given in the application banner, Google Analytics measures use of the application (pages and actions, with an account identifier).

Why and on what legal basis

• To provide the service, manage your account and organisation, and respond to support requests: performance of the contract.
• To invoice and keep our accounts: our legal obligations.
• To secure the service and prevent fraud (reCAPTCHA, login logs): our legitimate interest.
• To send you onboarding e-mails during the trial: our legitimate interest; each e-mail lets you unsubscribe in one click.
• To measure the effectiveness of our advertisements (gclid): our legitimate interest.
• To measure use of the application (Google Analytics): your consent, which you may withdraw at any time from the banner.

How long

• Account: as long as it exists. After a deletion request, it is erased 30 days later; you may cancel the request in the meantime.
• Organisation and content: during the subscription, then 90 days in read-only mode after it ends, then permanent deletion. An organisation that has never subscribed is kept until you delete it, or deleted after 12 months without a subscription or login, after a notice e-mail.
• Invoices and billing data: 10 years (Article L123-22 of the French Commercial Code).
• Cuevr AI technical traces at Langfuse: no more than 90 days.
• Login logs and technical logs: no more than 6 months.
• Google Analytics data: no more than 14 months.
• Backups: overwritten no later than 30 days after the data is deleted.

Article 4: You read or sign a proposal sent with Cuevr

This article concerns you if a company has sent you a sales proposal with Cuevr, whether you open it through a link, with a password or by invitation. This company is called “the seller” here.

Who is responsible for your data

The seller is the controller: it is the seller that decides to send you the proposal, to track how it is read and to invite you to sign it. Cuevr, published by Aetherly, acts as its processor: we host the proposal and process your data on the seller’s behalf, according to its instructions. We do not use your data for our own purposes and do not sell it.

Aetherly processes on its own behalf only what the security of the service requires: limiting the number of codes sent or passwords tried, and keeping the technical logs of its servers.

What is recorded

• You open the proposal: dates and times of your visits, active reading time, time spent on each section, version read, access mode. On a link opened without an invitation, you are not identified and Cuevr does not recognise you from one visit to the next.
• You were invited by e-mail: your e-mail address, provided by the seller; your reading is linked to your invitation. If you request an access code: the address and the number of attempts; the code is stored only as a hash.
• You choose quote options: the options selected and the corresponding amounts. Opening the signature form is also recorded.
• You forward the proposal: the e-mail address of the person you invite and the fact that the invitation comes from you; the e-mail they receive shows your address.
• You decline the proposal: the reason and name, if you choose to give them, the date and the version read.
• You sign the proposal: your name, your job title, your company and your e-mail address, verified by a code; the consent text; the date, the time and your time zone; your IP address and your browser; a hash of the signed content and of the options selected; the image of your signature if you draw it. This is a simple electronic signature.

To display the page, our servers receive your IP address; it is not recorded with the reading measurement. The proposal’s images are served by Cuevr’s hosting or, if the seller has inserted an image from another site, by that site, which then receives your IP address.

Why

• To give you access to the proposal and protect that access (password, code received by e-mail).
• To tell the seller when its proposal is read, for how long and which sections, so that it can respond to you better. The seller also sees an interest indicator from 0 to 3, calculated from this reading, your forwards, your option choices and the opening of the signature form: it is an aid to the seller’s follow-up, not a decision about you. These indicators prove neither attentive reading nor an intention to buy.
• To collect and prove your acceptance or refusal, and give you your signed file.
• To send you the journey e-mails: invitation, access code, signature code and link to your signed file.
• If the seller has enabled it, to pass this information to its own tools, for example its customer relationship management software (CRM).
• To ensure the security of the service (processing by Aetherly on its own behalf).

This data is never used for advertising or to train artificial intelligence.

On what legal basis

The seller, as controller, relies on the following legal bases, which Cuevr applies by default:

• Reading measurement: the seller’s legitimate interest in knowing whether its proposal has been received and read, in order to adapt its follow-up. This measurement is limited: you are informed of it on the page, no tracking cookie is used, no third-party tool is loaded, the details are deleted after 13 months and you may object to it.
• Access, journey e-mails, acceptance and refusal: pre-contractual measures taken at your request, then performance of the contract concluded with the seller.
• Proof of signature: the seller’s legitimate interest in being able to prove the agreement concluded.
• Security of the service: Aetherly’s legitimate interest in protecting the service against abuse.
• Access cookies: strictly necessary to open a protected document, they do not require your consent.

How long

• Reading details (visits, time per section, options, opening of the signature form): 13 months after the last activity. After that, only a total per proposal remains, with no identifier.
• Invitations, access codes, forwards and declines: as long as the proposal and your access exist; deleted with them.
• Security counters (codes sent, password attempts): erased automatically after one hour to one day, depending on the counter.
• Signature file: as long as the seller’s account exists; it is deleted with it, no later than 90 days after the end of the seller’s subscription. Download your signed file from the link received by e-mail: this link stops working on that deletion.
• Access cookies: 12 hours.
• Memory of options chosen in your browser: no more than 30 days.
• Server technical logs: no more than 6 months.
• Backups: overwritten no later than 30 days after the data is deleted.

If the seller deletes the proposal, its reading details are deleted with it. At the end of the seller’s subscription, the proposal remains accessible through its link for 90 days; all its data, including signature files, is then deleted and the link stops working.

Who receives your data

• The seller and the people in its company authorised in Cuevr.
• Authorised Aetherly staff, only when necessary for the service (assistance, security).
• Our processors: Scaleway (hosting, in France) and Mailjet (sending e-mails, in the European Union).
• The seller’s tools, if it has connected Cuevr to its CRM or other tools. They receive reading events, the options chosen and the reason for a refusal. Your name, your e-mail address, your company, your job title and, for a signature, your IP address are passed to them only if an administrator of the seller has expressly enabled it.
• Video services, only if you click on a video: it then loads from the service chosen by the seller (YouTube in “nocookie” mode, Vimeo, Loom or other), which applies its own policy.
• Judicial or administrative authorities, on a legal request.

No audience measurement or advertising tool is loaded on the reading page, and its fonts do not come from Google.

Your rights

You can access your data, have it rectified or erased, restrict its use, obtain a copy, and object to reading measurement.

Preferably, contact the seller: its name appears in the proposal, and replying to the invitation e-mail writes to it directly. You can also write to us at dpo@cuevr.com: we forward your request to the seller without delay and help it respond. If you object to reading measurement, your reading data is deleted, and the seller may send you a link without an invitation, whose reading is not linked to any name.

Article 5: Our processors

Each one receives only what its task requires.

• Scaleway (France): hosting of the application and its files, in France.
• Cloudflare (United States): hosting and delivery of the website, storage of forms, bot protection; United States and European Union.
• Hostinger: hosting of our audience measurement instance, in the European Union.
• Resend (United States): sending of our internal form notifications (first name, surname, e-mail, company, telephone, message); United States.
• Mailjet (France): sending of application e-mails, in the European Union.
• Stripe: payments and subscriptions; European Union and United States.
• Google (United States): Gemini API (Cuevr AI and Proposal Roaster), reCAPTCHA, Google Analytics for the application, Proposal Roaster tracking sheet, YouTube videos.
• Langfuse (Germany): technical monitoring of Cuevr AI, in the European Union.
• Aidbase, published by Highware GmbH (Switzerland): assistant and tickets on the Support page; Switzerland, with possible processing in the United States.
• Lemcal, published by lempire SAS (France): meeting booking calendar; data in the European Union.

Our AI providers work under a data processing agreement and do not use your data to train their models.

Your data may also be disclosed to judicial or administrative authorities, on a legal request.

Article 6: Transfers outside the European Union

Some processors (Cloudflare, Resend, Stripe, Google and Aidbase) may process data outside the European Union, in particular in the United States. These transfers are based on an adequacy decision of the European Commission (which covers Switzerland, as well as US companies that participate in the EU-US Data Privacy Framework) or on the European Commission’s standard contractual clauses.

Article 7: Cookies and storage in your browser

On the cuevr.com website. No measurement or advertising cookies, so no banner. The site stores nothing before you act, except what is necessary for it to work:

• your choices, when you make them: light or dark mode, reduced motion, declining the language suggestion, closing an announcement banner (browser local storage, with no date or identifier);
• when you use a form, Cloudflare Turnstile may set a technical cookie for bot protection.

Third-party content loads only if you request it: a YouTube video, played from youtube-nocookie.com, when you click its thumbnail; the Lemcal calendar, when you display it. These services then apply their own rules.

In the application. Session and security cookies, needed for you to log in. Google Analytics loads only with your consent, collected through a banner where you can accept, refuse and change your mind at any time.

On the reading page of a proposal. No tracking cookies, no banner, and Cuevr no longer stores a visitor identifier in your browser. Only the following remain:

• access cookies, where applicable: proposal_public_password_session for a password-protected document, proposal_public_invitee_session for an invitation-only document, after the code is entered. They last 12 hours, are read only by Cuevr and are not accessible to the page’s scripts;
• the memory of the options you choose in a quote opened through a link, so that you find them again if you reload the page. It contains no identifier and is erased after 30 days at the latest, or as soon as you sign.

Article 8: Security

We protect your data with appropriate measures: encrypted communications (TLS), separation of each customer’s data, role-based access rights, passwords and codes stored as hashes, limits on access attempts, hashes instead of IP addresses where possible, limited retention periods.

Article 9: Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, in particular to prospecting, at any time. Where processing is based on your consent, you may withdraw it at any time. You may also set instructions on what happens to your data after your death.

Write to us at dpo@cuevr.com. We reply within one month. If your request concerns a proposal received from a seller, see Article 4.

If you believe your rights have not been respected, you may lodge a complaint with the CNIL (the French data protection authority, www.cnil.fr) or with the data protection authority of your country.

Article 10: Changes to this policy

We may change this policy. The date of the last update appears at the top of the page. In the event of a significant change, we inform our customers by e-mail or in the application.