Privacy Policy
Last updated: October 15, 2026
1. Who we are
custovox.ai is a service operated by Corpstxt, a French simplified joint-stock company (SASU) registered with the Lille Métropole Trade and Companies Register under number 929 712 404, whose registered office is at 238 route de Linselles, 59118 Wambrechies, France.
Corpstxt is the data controller for the personal data described in this policy (except for the files you send us for a case study, see section 3).
Privacy contact
Email: privacy@custovox.ai
Post: Corpstxt — Privacy, 238 route de Linselles, 59118 Wambrechies, France
2. What we collect and why
| When | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| You request a free case study | Professional email, industry, number of customer conversations per month, page and language of the form, date, your consent choices | Prepare and send your case study, follow up on your request | Steps taken at your request before a contract (Art. 6(1)(b)) |
| You tick “keep me informed” (optional) | Send news about custovox.ai | Your consent (Art. 6(1)(a)), withdrawable at any time | |
| You use the contact form | Name, email, company (optional), message, page and language, date | Answer your message, manage our business relationship | Our legitimate interest in answering requests, or steps before a contract (Art. 6(1)(f) / 6(1)(b)) |
| You accept audience measurement | Pages viewed, device and browser type, approximate location (country/city), traffic source, cookie identifiers | Understand how the site is used and improve it | Your consent (Art. 6(1)(a)) |
| You visit the site | IP address, browser information, requested pages (technical logs of our host) | Deliver the site, security, prevent abuse | Our legitimate interest (Art. 6(1)(f)) |
We do not collect sensitive data (health, political opinions, etc.) and we do not make decisions based solely on automated processing that produce legal effects concerning you.
Fields marked as required in our forms are needed to process your request; without them we cannot answer you.
3. Data sent for a case study
To prepare a case study, you send us by email a sample of your customer reviews, tickets or messages. These texts may contain personal data about your customers (names, email addresses, opinions).
- For this data, you are the data controller and Corpstxt acts as your processor. We process it only on your instructions, for the sole purpose of producing your case study, and never for any other purpose.
- By sending it, you confirm that you are entitled to share it with us for this purpose. Where possible, please remove or pseudonymize names and contact details first.
- Only the people at Corpstxt preparing your study have access to it. It is received in our professional mailbox, then analyzed with our own scripts on infrastructure hosted in France; it is never sent to third-party AI providers.
- It is deleted within 30 days after we deliver your case study (emails and attachments included), unless you ticked the optional box asking us to keep it (see section 7). You can ask us in writing to delete it earlier at any time: it is then deleted within 72 hours.
- We will inform you without undue delay of any personal data breach affecting it.
If you need a signed data processing agreement (Art. 28 GDPR), write to privacy@custovox.ai.
4. Cookies and audience measurement
We use no cookies before you choose. When you first visit, a banner lets you accept or refuse audience measurement — refusing is as easy as accepting, and the site works the same either way.
If you accept, we load Google Tag Manager, which runs Google Analytics 4 (Google Ireland Limited / Google LLC) with Google signals and advertising features turned off. Google Tag Manager itself sets no cookie; Google Analytics sets these cookies:
| Name | Provider | Purpose | Lifetime |
|---|---|---|---|
| _ga | Google Analytics | Distinguishes visitors | 13 months |
| _ga_<ID> | Google Analytics | Keeps the session state | 13 months |
Your choice is stored in your browser (local storage, key cvx-consent) for 6 months, after which we ask again. You can change your mind at any time with the “Cookie settings” link at the bottom of every page; if you withdraw your consent, the Analytics cookies are deleted.
If your browser sends a Global Privacy Control signal, we treat it as a refusal and do not load audience measurement.
5. Who receives your data
Your data is accessible only to the Corpstxt team who needs it, and to our service providers acting on our behalf:
- our office suite and email provider (storage of form submissions and emails);
- our website host (hosting and technical logs);
- Google Analytics (Google Ireland Limited / Google LLC), only with your consent.
We do not sell personal data and we do not share it with third parties for their own marketing or for cross-context behavioral advertising. We may disclose data if required by law or to protect our rights.
6. International transfers
Some of these providers (our website host, our office suite and email provider, Google Analytics) may process data in the United States. These transfers rely on the EU–US Data Privacy Framework (the providers concerned are certified) and, where applicable, on the European Commission's Standard Contractual Clauses.
7. How long we keep it
| Data | Retention |
|---|---|
| Case study requests (prospects) | 3 years after our last contact with you |
| Contact form messages | 3 years after our last contact; if you become a customer, for the duration of the relationship plus legal limitation periods |
| Files sent for a case study | Deleted within 30 days after the case study is delivered |
| Analyzed data you asked us to keep (optional box “retain my analyzed data”) | Kept for 24 rolling months so you can compare your indicators from one analysis to the next, unless you ask us to delete it earlier |
| Data analyzed under a subscription | Duration of the contract + 30 days; after cancellation, 30 days to retrieve your data, then permanent deletion |
| Any data above, on written deletion request | Deleted within 72 hours |
| Newsletter consent | Until you unsubscribe (or 3 years without any interaction) |
| Google Analytics data | 14 months |
| Cookie consent choice | 6 months |
| Hosting technical logs | As set by our host for security purposes (short-term) |
8. Your rights (European Union and United Kingdom)
Under the GDPR (and UK GDPR), you have the right to:
- access your data and get a copy of it;
- rectify inaccurate data;
- erase your data;
- restrict processing;
- data portability;
- object to processing based on our legitimate interest, and to direct marketing at any time;
- withdraw your consent at any time, without affecting processing done before;
- (France) give instructions on what happens to your data after your death.
Write to privacy@custovox.ai. We answer within one month (extendable by two months for complex requests) and may ask for proof of identity if there is a reasonable doubt.
You can also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of your country of residence.
9. Your rights (United States)
Depending on your state of residence (including California under the CCPA as amended by the CPRA, and Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with comprehensive privacy laws), you may have the right to:
- know / access the personal information we hold about you and obtain a portable copy;
- delete it;
- correct inaccurate information;
- opt out of the sale or sharing of personal information and of targeted advertising — we do not sell or share personal information and do not use it for targeted advertising;
- appeal our decision on your request;
- not be discriminated against for exercising your rights.
Categories of personal information collected in the last 12 months
- Identifiers: name, email address, IP address, cookie identifiers (cookies only with consent);
- Professional information: company, industry, volume of customer conversations;
- Internet activity: pages viewed and interactions with the site (only with consent);
- Approximate geolocation derived from the IP address (only with consent).
We collect them from you directly, for the purposes and with the recipients described in sections 2 and 5. We do not collect sensitive personal information and we do not derive inferences to create a profile about you.
To exercise your rights, write to privacy@custovox.ai (you may use an authorized agent). We will verify your request by confirming it with the email address we hold, and answer within 45 days (extendable once as permitted by law). We honor Global Privacy Control signals.
10. Marketing emails
We only send news about custovox.ai if you ticked the optional box. Every marketing email identifies Corpstxt, includes our postal address and a one-click unsubscribe link, in line with the GDPR, the French Postal and Electronic Communications Code and the US CAN-SPAM Act. Emails about your own request (your case study, our answer to your message) are not marketing emails.
11. Security
We use encrypted connections (HTTPS), access restricted to the people who need it, and reputable providers. No transmission over the Internet is completely secure; if a breach likely to result in a risk to your rights occurs, we will notify the competent authority and, where required, you.
12. Children
Our services are intended for businesses and are not directed to children. We do not knowingly collect personal data from anyone under 16 (or under 13 in the United States). If you believe a child has sent us data, contact us and we will delete it.
13. Open-source MCP servers
Our open-source MCP servers published on PyPI (such as custovox-sentiment) run on your own computer. Recent versions send anonymous usage counters (tool used, sentiment label, number of texts, package version, random session ID). The analyzed text is never sent and no personal data is collected. You can turn this off with the environment variable CUSTOVOX_TELEMETRY=0.
14. Changes to this policy
We may update this policy to reflect changes in our services or in the law. The date at the top shows the latest version. If the changes are significant, we will inform you by appropriate means.