Privacy policy

1. Data controller

INNOVAE SASU, 47 rue Vivienne, 75002 Paris, France. Contact: contact@innovae.io. This policy covers visitors to innovae.io, people who write to us, merchants who use the software, and their customers whose data is recorded in it.

2. Our roles

As a controller, we decide how the data of visitors, prospects, and account holders is used.

As seller of record, we are also the controller of buyer data relating to the sales we collect: identity, delivery address, order, invoice, refund requests, and disputes.

As a processor, we host the other data that merchants record about their own customers: records, messages, notes, and orders collected outside Innovae. The merchant decides its purposes; we process it only to provide the software, on the merchant’s instructions.

3. Data we process

When you write to us or open an account: name, company, email address, phone number if you give it, billing address, the content of your messages, and your workspace settings.

Data recorded by merchants: their customers’ names, emails, phone numbers, and addresses, orders, tracking numbers, messages, and notes. When a payment is collected, we receive its status and amount from Stripe. We never receive or store card numbers: they are entered in fields provided by Stripe.

When you visit the site: technical connection data processed by our host, including your IP address. The country derived from it is used only to choose the display language, and the site does not keep it. The site uses no audience measurement and no advertising trackers.

4. Purposes and legal bases

Answering your requests and preparing a contract (pre-contractual steps). Creating and running your workspace and providing support (performance of the contract). Billing the subscription and keeping our accounts (legal obligation). Securing the service and preventing abuse (legitimate interest). Adapting the site to your language (legitimate interest). Sending you commercial information only with your consent, which you can withdraw at any time.

5. Recipients

Your data is accessible to authorized staff of INNOVAE SASU and to its technical subcontractors: hosting (Cloudflare, Inc.), email delivery, backups, all bound by contract. Payments are processed by Stripe, Innovae’s payment provider, which receives the information needed for each transaction and acts as controller for card data. The original merchant receives the information needed to prepare and deliver the order. Authorities may receive data where the law requires it. We do not sell your data.

6. Transfers outside the European Union

Some processors may handle data outside the European Union, including in the United States. These transfers rely on an adequacy decision or on the European Commission’s standard contractual clauses.

7. Retention

Exchanges with prospects: three years after the last contact. Account and billing data: the length of the contract, then the statutory accounting periods (ten years for accounting records). Data recorded by a merchant: the length of its subscription, then deletion within thirty days after the workspace closes, unless exported earlier or the law requires longer. Technical logs: ninety days.

8. Security

Data is encrypted in transit (TLS) and at rest by our host. Access to production systems is limited to authorized staff with individual credentials and two-factor authentication. If a data breach creates a risk to your rights, we inform you and the CNIL as the GDPR requires.

9. Your rights

You have rights of access, rectification, erasure, restriction, objection, and portability, and the right to set instructions for your data after your death. Write to contact@innovae.io; we answer within one month. If you are a merchant’s customer, we forward your request to that merchant. You can also complain to the CNIL, the French data protection authority (cnil.fr).

10. Children

The site and the software are for businesses and are not directed at children under sixteen.

11. Changes

We may update this policy. Material changes are announced on this page and, for account holders, by email before they take effect.

Updates

Last updated: November 5, 2026.