Privacy Policy

Last updated: March 2026

1. Introduction

Corelix SAS (“we”, “us”, “our”) operates the website corelix.io and the cloud platform at app.corelix.io. This privacy policy explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable French data protection legislation.

We are committed to transparency and to safeguarding the privacy of every individual who interacts with our services. By using our website or platform, you acknowledge that you have read and understood this policy.

2. Data Controller

The data controller responsible for the processing of your personal data is:

Corelix SAS
10 rue de Penthièvre
75008 Paris, France

For any questions or requests related to data protection, please contact us via the contact page and select “Data Protection Request” as the inquiry type.

3. Data We Collect

3.1 Contact Form

When you submit an inquiry through our contact page, we collect:

  • Your name
  • Your email address
  • Your organisation (if provided)
  • The content of your message

3.2 Cloud Platform (app.corelix.io)

When you register for and use our cloud platform, we process:

  • Account information (name, email address, password hash)
  • Usage data (deployments, resource configurations, project metadata)
  • Deployment metadata (build logs, deployment history, application settings)
  • Server logs (access times, IP addresses, request paths)

3.3 Website Analytics

We collect anonymised analytics data to understand how visitors use our website. We use:

  • OpenPanel — a self-hosted, privacy-focused analytics solution. No data is shared with third parties.

We do not use third-party advertising cookies. We do not use Google Analytics.

3.4 Payment Information

All payment processing is handled by Stripe, which is PCI DSS Level 1 compliant. We do not store, process, or have access to your full credit card numbers. Stripe processes payments through its European entities.

4. Legal Basis for Processing

Under Article 6 of the GDPR, we process your personal data on the following legal bases:

  • Consent (Art. 6(1)(a)) — when you submit the contact form or opt in to communications.
  • Contract performance (Art. 6(1)(b)) — when processing is necessary to provide the cloud platform services you have subscribed to.
  • Legitimate interest (Art. 6(1)(f)) — for website analytics, service improvement, security monitoring, and fraud prevention, where our interests do not override your fundamental rights.

5. How We Use Your Data

We use the personal data we collect to:

  • Provide, operate, and maintain the Corelix cloud platform
  • Improve and develop our services based on usage patterns
  • Respond to your inquiries and provide customer support
  • Send service-related communications (e.g., maintenance notices, security alerts)
  • Monitor and ensure the security of our infrastructure
  • Detect, prevent, and address fraud and abuse
  • Comply with legal obligations

We do not send marketing communications without your explicit consent. Service communications relating to your account or active subscriptions are sent as necessary for contract performance.

6. Data Storage & Location

All personal data is processed and stored within the European Economic Area (EEA):

  • Cloud platform infrastructure — hosted by Hetzner Online GmbH in Germany and Finland
  • Website — hosted on GitHub Pages
  • Analytics data — processed on EU-hosted infrastructure

We do not transfer personal data outside the EEA. Corelix SAS is a French company with no US subsidiary. This structure provides full immunity from the US CLOUD Act and other extraterritorial data access legislation.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

  • Contact form submissions — 2 years from the date of submission
  • Account data — for the duration of your account, plus 30 days after account closure to facilitate potential reactivation
  • Server and access logs — 90 days
  • Payment records — retained as required by the French Commercial Code (Code de commerce), currently 10 years

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised.

8. Your Rights

Under Articles 15 to 22 of the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15) — obtain confirmation of whether your data is being processed and receive a copy
  • Right to rectification (Art. 16) — request correction of inaccurate or incomplete data
  • Right to erasure (Art. 17) — request deletion of your personal data (“right to be forgotten”)
  • Right to restriction (Art. 18) — request that processing of your data be limited
  • Right to data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format
  • Right to object (Art. 21) — object to processing based on legitimate interest
  • Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us via the contact page and select “Data Protection Request” as the inquiry type. We will respond within 30 days as required by law.

You also have the right to lodge a complaint with the French data protection authority:

CNIL (Commission Nationale de l’Informatique et des Libertés)
3 Place de Fontenoy, TSA 80715
75334 Paris Cedex 07, France
www.cnil.fr

9. Cookies & Tracking

We take a privacy-first approach to analytics and tracking:

  • Self-hosted analytics (OpenPanel) — runs on our own infrastructure. No data is shared with third parties. No cookies are set.
  • No advertising tracking — we do not use any advertising pixels, retargeting scripts, or behavioural tracking technologies.
  • No Google Analytics — we do not use Google Analytics or any other Google tracking services.
  • Essential cookies only — the cloud platform (app.corelix.io) uses strictly necessary session cookies for authentication. These do not require consent under the ePrivacy Directive.

10. Third-Party Services

We use the following third-party services to operate our platform. Each has been selected for its data protection commitments and European presence where possible:

11. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

  • Encryption at rest — NaCl SecretBox authenticated encryption for all backup data stored on S3-compatible storage
  • Encryption in transit — HTTPS (TLS 1.2+) for all communications between clients and our services
  • Access controls — role-based access with granular project and environment-level permissions
  • Network isolation — per-environment Docker network segmentation
  • Regular security assessments — ongoing review of infrastructure, dependencies, and access patterns

12. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last updated” date at the top of this page.

We encourage you to review this policy periodically. Your continued use of our services after any changes constitutes acceptance of the updated policy.

13. Contact

For any questions regarding this privacy policy or our data protection practices, please contact us via the contact page and select “Data Protection Request” as the inquiry type.